Appearance

Applied professional context · Sources checked 20 October 2026

Frameworks and Indian regulatory context

Learn how to ask which source applies, who owns the action and what evidence supports a conclusion. These introductions supplement the courses; they are not a legal opinion, compliance certification or a claim that every item is an official exam requirement.

Binding Indian instruments, voluntary standards, reference frameworks and market-conduct rules have different roles. Check the exact entity, activity, amendment, commencement and current source before operational use. Public ISO overviews were reviewed; licensed clauses are not reproduced.

Showing CISM learning applications for all references.

Reference directory

Indian regulatory context

CERT-In Directions · 28 April 2022

Type: Statutory directions; check entity and incident applicability

Applicability boundary: Covered service providers, intermediaries, data centres, bodies corporate and government organizations; read the Directions and official FAQs together.

For covered Annexure I incidents, the Directions specify reporting within six hours of noticing or being informed. They also address time synchronization, a designated contact and rolling 180-day ICT log retention within India. Additional provider-specific record duties require separate scope checks. Do not substitute this reporting trigger for a full investigation deadline.

Apply it in study

Assign reporting authority, preparedness and oversight.

Fictional exercise: Using a fictional alert, record the notice time, scope check, escalation owner, available facts and evidence gaps. Do not delay initial reporting merely to finish root-cause analysis.

Indian regulatory context

SEBI CSCRF · 2024 and later clarifications

Type: Regulatory circulars for SEBI-regulated entities

Applicability boundary: Applicability, categories, controls and transition provisions depend on the regulated entity and subsequent circulars.

Use the 20 August 2024 CSCRF circular with later clarifications, including the 28 August 2025 technical clarification. Establish the entity category and current applicable instructions before designing evidence. A generic framework checklist is not sufficient to establish compliance.

Apply it in study

Govern ownership, assurance, exceptions and resilience evidence.

Fictional exercise: Create a fictional applicability register: entity/activity, source circular, applicable control owner, evidence, review date and unresolved clarification.

Indian regulatory context

RBI IT governance and bank cyber frameworks

Type: RBI directions/circulars with different covered populations

Applicability boundary: The 2023 IT Governance, Risk, Controls and Assurance Practices Directions and the 2016 Cyber Security Framework in Banks have distinct applicability.

The 2023 Directions took effect on 1 April 2024. Review their covered entities, exclusions and later instructions; do not treat every bank, financial company or technology vendor as interchangeable. The 2016 bank framework is a separate source, not another name for the 2023 Directions.

Apply it in study

Connect board oversight, assurance and risk treatment.

Fictional exercise: For a fictional institution, identify its category before assigning governance, audit and continuity evidence. List the source applicable to each duty.

Indian regulatory context

DPDP Act 2023 and Rules 2025

Type: Law and rules with phased commencement

Applicability boundary: Determine processing scope, role, applicable provision and its commencement; do not assume every provision is already operative.

Read the Act together with the Rules, commencement notification and corrigendum. Rule 1 sets immediate, one-year and eighteen-month phases for different rule groups. At the October 2026 review date, future phases must not be described as already in effect. Read each applicable provision’s date directly from the official texts.

Apply it in study

Assign privacy risk decisions and accountable implementation.

Fictional exercise: Trace a fictional personal-data flow: purpose, roles, recipients, security, retention and rights-handling owner. Record commencement assumptions instead of using one universal compliance date.

International standards and references

ISO/IEC 27001:2022

Type: ISMS requirements standard; certification is scoped

Applicability boundary: Not automatically a law for every organization. Contracts, regulators or organizational choices may make particular requirements relevant.

An information security management system connects organizational context, risk treatment, controls, assurance and improvement. A certificate’s stated scope matters; it does not prove that every product or service is secure. Use an authorized copy for clause-level work.

Study this ISO foundation course →

Apply it in study

Connect management-system governance and risk treatment.

Fictional exercise: Describe a fictional ISMS scope and one risk-treatment decision, then identify evidence that a selected control operates.

International standards and references

ISO/IEC 27002:2022

Type: Information-security control guidance

Applicability boundary: Complements an ISMS; not a standalone universal compliance checklist or certification claim.

Use control guidance to reason about implementation and evidence appropriate to risk and context. A control name does not establish that it is implemented or effective. This is the additional sixth international reference proposed for the original five-entry list.

Apply it in study

Select controls based on risk rather than a product list.

Fictional exercise: Choose a fictional access-control objective and describe its owner, implementation, evidence and failure conditions.

International standards and references

NIST CSF 2.0

Type: Voluntary risk-management framework; obligations may adopt it

Applicability boundary: The six functions are Govern, Identify, Protect, Detect, Respond and Recover. Framework mapping does not establish equivalence or regulatory compliance.

Use the functions to organize outcomes and gaps, not as a mandatory sequence that ends after recovery. Govern provides direction and accountability across the other functions. Keep any SEBI cross-reference tied to the actual applicable source and version.

Apply it in study

Use governance, outcomes and priorities for program decisions.

Fictional exercise: Map a fictional ransomware-readiness decision to an outcome, owner, evidence and improvement action, including governance.

International standards and references

MITRE ATT&CK Enterprise

Type: Adversary-behavior knowledge base, not a regulation

Applicability boundary: Technique mapping is a hypothesis about behavior and evidence; it is not proof of attribution or complete detection coverage.

Use named techniques to describe what evidence a detection needs. Validate telemetry, logic, false positives, approved tests and response ownership. Financial-sector examples here are original fictional use cases, not an official MITRE sector profile.

Apply it in study

Use evidence-based coverage and resource prioritization.

Fictional exercise: Work through the dedicated financial-sector detection examples and explain an evidence gap before calling a technique covered.

Financial-sector detection examples →

International standards and references

ISO/IEC 27090:2026

Type: Published AI security guidance; not an AI management-system certification

Applicability boundary: ISO records publication on 14 October 2026. Public overview only was reviewed; detailed clauses require authorized access.

Study AI-specific security risks such as corrupted training data and model theft across development and operation. Conventional identity, logging and data controls remain relevant alongside AI-specific safeguards. Do not claim full implementation or mandated use from this introductory reference.

Study this ISO foundation course →

Apply it in study

Assign AI risk ownership and treatment decisions.

Fictional exercise: For a fictional AI-assisted alert triage service, identify protected data/model assets, a poisoning scenario, validation evidence and a human escalation owner.

International standards and references

ISO/IEC 42001:2023

Type: AI management-system requirements standard

Applicability boundary: Applies to the defined management-system scope; it is not a guarantee of ethical or secure output from every model.

Use an AI management system to establish accountable processes for AI development or use. In SOC examples, retain ownership for data handling, human review and change decisions. Distinguish management-system assurance from technical attack resistance addressed by AI security guidance.

Study this ISO foundation course →

Apply it in study

Connect AI governance, oversight and improvement.

Fictional exercise: Record a fictional AI use-case purpose, accountable owner, approved data, review criteria and change approval evidence.

Exchange and securities-market context

NSE / BSE member system-audit context

Type: Entity-specific exchange and SEBI requirements

Applicability boundary: Do not assume one annual technology-audit deadline or scope applies to every member category and exchange.

System audit and cyber-resilience audit are distinct obligations. SEBI’s January 2025 system-audit supervision framework and an NSE implementing circular were checked, together with NSE’s April 2026 cyber-audit circular. Verify the latest exchange/category instrument, period, auditor eligibility, template and submission route before operational use. A current BSE-specific filing schedule has not been verified here; the primary PDF was access-restricted during this review.

Apply it in study

Govern findings, accountable remediation and submission decisions.

Fictional exercise: Prepare a fictional audit evidence index and action-taken register. Identify the exact exchange/category source needed to settle scope and due dates.

Exchange and securities-market context

SEBI PFUTP Regulations 2003

Type: Securities-market conduct regulation

Applicability boundary: This is market-surveillance and conduct context, distinct from cybersecurity incident detection. Consult the current consolidated text and qualified compliance interpretation.

SEBI’s consolidated publication checked here is amended through 5 December 2025. Fictional wash-trading, layering or front-running alerts need trade/order context and investigation; an alert is not proof of unlawful conduct. Insider trading has a separate PIT Regulations 2015 framework, which should also be considered where relevant.

Apply it in study

Understand governance and escalation interfaces with surveillance.

Fictional exercise: Compare a synthetic suspicious-order pattern with legitimate explanations. Preserve authorized evidence and escalate to market-surveillance/compliance specialists; do not accuse a real person.

Additional references worth considering

Use NIST SP 800-61 Rev. 3 for incident-response context. Add more detailed RBI outsourcing/payment, SEBI insider-trading or exchange-specific material only after confirming the learner’s role and applicable instruments. These additions are not presented as already covered in depth.

Use the evidence workbook · Report a source correction