Guidelines on Classification of Cybersecurity Incidents

पेंशन निधि विनियामक और विकास प्राधिकरण PENSION FUND REGULATORY AND DEVELOPMENT AUTHORITY

परिपत्र सं.:पीएफआरडीए/2025/05/आईसीएस/01 04.09.2025

परिपत्र

सेवा में सभी मध्यस्थ एवं विनियमित संस्थाएँ

विषय: साइबर सुरक्षा घटनाओं के वर्गीकरण संबंधी दिशा-निर्देश

1. यह परिपत्र सं. PFRDA/24/14/ICS/01 दिनांक 01.08.2024 से संबद्ध है, जो मध्यस्थों/विनियमित संस्थाओं हेतु सूचना एवं साइबर सुरक्षा नीति दिशा-निर्देश – 2024 से संबंधित है।
2. उक्त दिशा-निर्देशों में पीएफआरडीए के अधीन विनियमित संस्थाओं एवं मध्यस्थों के लिए साइबर घटनाओं एवं प्रत्युत्तर प्रबंधन की व्यापक रूपरेखा दी गई है। साथ ही, घटनाओं का प्रभावी प्रबंधन सुनिश्चित करने हेतु उनका उचित प्राथमिकता निर्धारण अत्यंत आवश्यक है।
3. विनियमित संस्थाओं/मध्यस्थों को परिशिष्ट-I में संलग्न दिशा-निर्देशों के आधार पर घटनाओं का उपयुक्त वर्गीकरण एवं प्राथमिकता निर्धारण सुनिश्चित करने की सलाह दी जाती है।
4. यह परिपत्र पेंशन निधि विनियामक और विकास प्राधिकरण अधिनियम, 2013 की धारा 14 के अंतर्गत प्रदत्त शक्तियों के अधीन जारी किया जाता है।

कविता सिंगम जेवियर

महाप्रबंधक सूचना एवं साइबर सुरक्षा विभाग

---

Circular No.: PFRDA/2025/05/ICS/01 04.09.2025

CIRCULAR

To All Intermediaries & Regulated entities

Subject: Guidelines on Classification of Cybersecurity Incidents

1. This is with reference to the circular no PFRDA/24/14/ICS/01 dated 01.08.2024 pertaining to Information & Cyber Security Policy Guidelines – 2024 for intermediaries/Regulated Entities.
2. The said section outlines broad framework for Cyber Incident and Response Management for REs & Intermediaries under PFRDA. Further, in order to effectively manage the incidents, proper prioritization of incidents is crucial.
3. REs/Intermediaries are advised to ensure appropriate classification and prioritization of incidents based on guidelines attached as Annexure I.
4. This circular is issued in exercise of the powers conferred under Section 14 of the Pension Fund Regulatory and Development Authority Act, 2013.

Kavita Singam Xavier

General Manager Information & Cyber Security Department

---

Annexure I

Guidelines on Classification of Cybersecurity Incidents

1. It is to inform that Section 4.1.5 of Information & Cyber Security Policy Guidelines – 2024 for Intermediaries/Regulated Entities dt 01.08.2024 issued by Authority outlines broad framework for Cyber Incident and Response Management for REs & Intermediaries under PFRDA. However, the classification of incidents is not part of the existing policy.
2. Security incidents may impact the confidentiality, integrity, and availability of an organization’s information. Prioritizing the response to such incidents is one of the most critical aspects of the incident handling process.
3. It is advised that incidents be addressed based on their priority, rather than on a first-come, first-served basis. Regulated Entities (REs) should determine the response priority by assessing the potential business impact and the estimated effort required for recovery, rather than the ease of recoverability.
4. REs/Intermediaries should assess the impact of an incident on the current functionality of the affected systems. In addition to evaluating the immediate functional disruption, REs should also consider the potential future impact if the incident is not promptly contained.
5. REs/Intermediaries may classify Cybersecurity incidents into the following four categories. The parameters for classification of the incidents are as follows:

6. Any cyber incident that results in disruption, stoppage or variance in the normal functions/ operations of systems of the entity thereby impacting normal/ regular service delivery and functioning of the entity, must be classified as High or Critical incident.
7. REs/Intermediaries to ensure timely and effective response to incidents, consistent with the principles of operational resilience and continuity of critical functions.

---