TRUST & COMPLIANCE — INDIA STATUTORY FRAMEWORKS
India's Quantum Readiness Mandates Are Live. The CBOM Obligation Starts Here.
Four regulatory frameworks — CERT-In, RBI, SEBI, and DPDP — now collectively require every regulated BFSI, Healthcare, and Critical Infrastructure entity to know exactly what cryptography they are running, how vulnerable it is, and what they plan to do about it. Qvantica Labs produces the inventory, the risk assessment, and the regulatory mapping your board needs to answer that question.
- CERT-In CISG-2025 & CISG-2024-02 v2.0 (CBOM & QBOM)
- RBI Master Directions 2026 & Q-SAFE Expert Committee
- SEBI CSCRF 2024/2025 & DPDP Act 2023 SDF Rules
CERT-IN MANDATES
India's National Cybersecurity Auditor Just Named the CBOM and QBOM as Mandatory Inventory Items
CERT-In's 2025 guidelines are the broadest mandate on this page — they cover every public and private organisation operating digital systems in India, not just BFSI. And they explicitly name the Cryptographic Bill of Materials as a required audit deliverable.
CERT-IN CISG-2024-02 V2.0 — FIVE REQUIRED INVENTORIES
CERT-In Comprehensive Cyber Security Audit Policy Guidelines 2025
Mandatory annual third-party cybersecurity audits for all public and private entities operating digital systems in India. Effective 25 July 2025.
What CERT-In Requires:
- Annual Third-Party Cybersecurity Audit: Mandatory audit by a CERT-In empanelled auditor for every entity operating digital systems in India.
- Mandatory CBOM & QBOM: Cryptographic Bill of Materials explicitly named alongside SBOM, HBOM, AIBOM, and Quantum BOM under CISG-2024-02 v2.0.
- OT/ICS Scope Extension: Guidelines extend beyond IT to cloud, operational technology, AI systems, and supply chains.
- Domestic Data Residency: Audit evidence stored within India, encrypted at rest and in transit. Metadata submitted to CERT-In within 5 days of completion.
- Change-Triggered Audits: Major technology migrations and configuration overhauls trigger immediate re-audit cycles.
How Qvantica Labs Maps to This:
RESERVE BANK OF INDIA
The RBI Has Two Simultaneous Mandates Running. One Is Already Law.
The Master Directions 2026 are in force now. The Q-SAFE Expert Committee's quantum-specific roadmap lands Q4 2026 or Q1 2027 — and every bank that waits for the report before starting the CBOM will be starting late.
Cybersecurity, Technology: Risk, Resilience & Assurance
Effective 31 July 2026, replacing the 2016 framework. Applies to all scheduled commercial banks.
What RBI 2026 Requires:
- Technology Risk Inventory: Demonstrable inventory and control over technology risk — including cryptographic assets — with board visibility and independent CISO oversight.
- Six-Monthly VA Cadence: Mandatory semi-annual vulnerability assessments and annual penetration testing for critical systems with 24×7 SOC telemetry.
- 6-Hour DAKSH Reporting: Mandatory 6-hour incident disclosure to the RBI via DAKSH, with simultaneous CERT-In notification.
- Vendor & Third-Party Accountability: Banks held directly liable for fintech-partner and vendor security, requiring right-to-audit clauses and shareable VA/PT evidence.
How Qvantica Labs Maps to This:
RBI Q-SAFE Committee — Quantum-Safe Financial Infrastructure Roadmap
Chaired by Prof. Anil Prabhakar, IIT Madras. Mandated to evaluate the financial sector's cryptographic estate through a CBOM.
What Q-SAFE Mandates:
- CBOM of Every Bank's Estate: The committee's first explicit statutory task is to construct and verify the cryptographic bill of materials across financial networks.
- Crypto-Agility Readiness: Demonstrating that core banking and payment switches can swap algorithms without requiring complete architectural rebuilds.
- Quantum-Safe Transition Roadmap: Phased migration covering India's retail payments (UPI/IMPS), RTGS, and interbank messaging (SWIFT).
How Qvantica Labs Maps to This:
CAPITAL MARKETS & PRIVACY
SEBI CSCRF & DPDP Act Safeguards
Market infrastructure institutions, asset managers, healthcare networks, and fintechs face stringent cryptographic accountability under SEBI and DPDP statutes.
SEBI Cybersecurity & Cyber Resilience Framework
Mandatory for Market Infrastructure Institutions (MIIs), brokers, asset managers, and depositories.
- SBOM & CBOM Expectations: CSCRF technical controls require software inventory; CERT-In pairs this with mandatory CBOMs.
- Dedicated HSM Mandate: CIR/2025/60 requires dedicated HSM key management auditing.
- Cyber Capability Index (CCI): Cryptographic posture constitutes a scored dimension in half-yearly MII audits.
- Qvantica Labs Mapping: AQRA audits HSM interface parameters, provides CBOM evidence, and formats board-ready summaries for annual review.
Digital Personal Data Protection Act Obligations
Enforceable data protection mandates for Data Fiduciaries and Significant Data Fiduciaries (SDFs). Max penalty ₹250 crore.
- Reasonable Security Safeguards (S.8): Mandatory robust cryptographic controls proportionate to data sensitivity (genomic, health, financial).
- Data Protection Impact Assessments (S.10): Independent audit evidence required for high-risk processing.
- Strict Localisation: Personal health data prohibited from foreign transfer by SDFs.
- Qvantica Labs Mapping: Air-gapped deployment prevents data export; CBOM establishes verifiable safeguards to defend against breach penalties.
Summary Matrix
One Engagement. Four Frameworks.
A single Qvantica Labs quantum readiness audit engagement produces the artefacts that map across all four regulatory frameworks simultaneously — because the underlying obligation across all four is the same: know your cryptographic estate, score it for risk, and have a plan to fix it.
| Framework | Who It Covers | Specific Obligation | Status | Qvantica Labs Deliverable |
|---|---|---|---|---|
| CERT-In CISG-2025-02 | All public & private entities in India | Annual cybersecurity audit; CBOM + QBOM explicitly named | In Force Jul 2025 | CycloneDX CBOM (Phase 02) + QBOM risk scoring for empanelled auditors |
| RBI Master Directions 2026 | Scheduled commercial banks | Technology risk inventory; 6-monthly VA; vendor accountability; 6-hr DAKSH reporting | In Force Jul 2026 | CBOM as technology risk inventory; recurring discovery runs; zero-egress deployment |
| RBI Q-SAFE Committee | All banks and payment operators | CBOM of financial sector cryptographic estate; crypto-agility assessment; PQC roadmap | Report Q4 26/Q1 27 | Complete Phase 01–03 output — CBOM, crypto-agility framework, NIST FIPS-aligned roadmap |
| SEBI CSCRF 2024 | All SEBI Regulated Entities | SBOM/CBOM expectations; HSM mandatory (MIIs & QREs); CERT-In VAPT; CCI scoring | In Force Aug 2025 | CBOM satisfies cryptographic SBOM expectation; HSM audit; CCI evidence; board risk summary |
| DPDP Act 2023 + Rules 2025 | All entities processing personal data; SDFs | Reasonable security safeguards; DPIA for SDFs; data localisation; breach readiness | In Force — Rules 2025 | CBOM as DPIA evidence layer; air-gapped zero data transfer; breach-readiness inventory |
YOUR NEXT STEP
Your CBOM is the Evidence Every Framework Demands. Let's Build It.
A scoping call establishes your regulatory context, entity classification, and which frameworks apply to your specific environment. We scope the engagement accordingly.