Security & Compliance Blog | CERT-In, RBI, SEBI, DPDP | Intellinative

Evidence-led analysis of Indian cybersecurity regulation and threat trends: CERT-In advisories, RBI cyber directions, SEBI CSCRF, DPDP and software supply chain.

• CERT-In's September Alerts: Edge Devices Under Fire and the 12-Hour Patch Window — CERT-In published 20 vulnerability notes in nine days. Several covered critical or actively exploited flaws in internet-facing gateways and firewalls. That is the scenario CERT-In's 12-hour remediation guidance was written for.
• RBI's 2026 Cyber Directions: Technology Architecture Is Now Risk Architecture — RBI Deputy Governor Rohit Jain told bankers on 24 September that technology risk is now a first-order enterprise risk. The 31 July 2026 directions already make that enforceable, with no transition period.
• The EU CRA Clock Started on 11 September. What Indian Software Exporters Must Do Now — Since 11 September, anyone selling software with digital elements into the EU must report actively exploited vulnerabilities within 24 hours. The same month, attackers compromised npm, PyPI and Terraform release pipelines. An accurate SBOM is now required to meet the deadline.
• DPDP Countdown: SBI Targets December. Is Your Organisation Ready for May 2027? — India's largest bank says it will be DPDP compliant five months early. The Rules name specific security safeguards and set a 72-hour breach report to the Board. Here is what that means for your security stack.
• SEBI Widens the Cyber Net: MII Subsidiaries, FIRE Reporting and the AI-Era CSCRF — SEBI's 11 September consultation would bring MII subsidiaries under the parent's IT and cyber framework. With FIRE-format incident reporting and a new IT Resilience Index, capital-market cyber rules are tightening quickly.