ISO 27001, DPDPA, the RBI framework, SEBI CSCRF — if you’re an Indian business, the alphabet soup of cybersecurity compliance can feel overwhelming, and it’s tempting to treat each as a separate project. The good news: these frameworks overlap heavily. Build a strong security foundation once, and you satisfy most of what all of them ask for. This guide explains what each framework is, who it applies to, and where they converge — so you can plan one programme instead of four.
The four frameworks at a glance
| Framework | Type | Who it applies to |
|---|---|---|
| ISO/IEC 27001:2022 | Voluntary international standard | Any organisation seeking a certified ISMS |
| DPDP Act, 2023 | Data-protection law | Anyone processing personal data of individuals in India |
| RBI cyber-security framework | Sectoral regulation | Banks, NBFCs, co-operative banks, payment operators |
| SEBI CSCRF | Sectoral regulation | SEBI-regulated entities (brokers, AMCs, depositories…) |
ISO 27001 is the common backbone
ISO 27001 is a voluntary standard for building an Information Security Management System (ISMS) — a structured, risk-based way of managing security across people, process and technology. Crucially, it’s the foundation the others lean on. SEBI CSCRF makes ISO 27001 mandatory for its larger entities; RBI and DPDPA don’t name it, but an ISO 27001 ISMS delivers most of what they require. Get ISO 27001 right and you’re most of the way to the rest.
DPDPA: the data-protection layer
The Digital Personal Data Protection Act, 2023 is a law, not a standard, focused specifically on personal data. It adds obligations the others don’t emphasise — valid consent, notices, data-principal rights, breach notification to the Data Protection Board — but its “reasonable security safeguards” requirement maps directly onto ISO 27001 controls. (We cover it in depth in our DPDP Act guide.)
RBI and SEBI: the sectoral layers
If you’re a regulated financial or securities entity, you carry an additional, prescriptive layer. The RBI framework governs banks, NBFCs and payment operators with tiered expectations based on size and risk. SEBI’s CSCRF (issued August 2024) does the same for the securities market — see our SEBI CSCRF guide. Both prescribe specifics the others leave open: mandatory VAPT cadences, SOC/monitoring, incident reporting timelines, and periodic audits.
Where they all converge
Strip away the labels and the same core controls appear in every framework:
- Risk assessment & governance — know your assets and risks; assign accountability.
- Security controls — access control, encryption, patching, secure configuration.
- Testing — regular VAPT to find and fix weaknesses.
- Monitoring & detection — a SOC or MDR to catch threats.
- Incident response — a tested plan and defined reporting (to CERT-In, the DPB, RBI or SEBI as applicable).
- Audit & continuous improvement — periodic review and evidence.
Build these once, well, and you’re compliant-by-design across the board — adding only the framework-specific extras (DPDPA consent flows, SEBI’s VAPT cadence, RBI’s reporting) on top.
A single, layered compliance strategy
- Start with ISO 27001 as your ISMS backbone.
- Layer DPDPA for personal-data obligations (consent, notices, breach notification).
- Add your sectoral layer (RBI or SEBI) if you’re regulated — the prescriptive VAPT, SOC and reporting specifics.
- Validate continuously with VAPT, monitoring and audits — the evidence every framework wants.
Frequently asked questions
If I’m ISO 27001 certified, am I DPDPA compliant?
Not automatically — ISO 27001 covers most of the security safeguards, but DPDPA adds legal obligations (consent, notices, data-principal rights, breach notification) you must implement specifically.
Do RBI and SEBI frameworks replace DPDPA?
No. They’re additional, sector-specific layers. A SEBI-regulated broker handling personal data must meet both CSCRF and the DPDP Act.
Can one VAPT satisfy multiple frameworks?
Largely yes — a well-scoped VAPT with proper reporting supports ISO 27001, DPDPA due diligence, and RBI/SEBI testing requirements at once. The key is mapping the report to each obligation.
Plan one programme, not four
Selkey Cyber Security helps Indian organisations design a single, layered compliance programme — ISO 27001, DPDPA, RBI and SEBI CSCRF — backed by VAPT, SOC monitoring and audit support. Our team holds credentials including ISO 27001 Lead Auditor, OSCP, CEH Master and CPENT.
Explore Selkey’s compliance services or book a compliance strategy call →
This article is general information, not legal advice. Confirm your specific obligations against each framework’s current text, or with qualified advisors.