Information and Cyber Security Policy Guidelines for Intermediaries and Regulated Entities

PENSION FUND REGULATORY AND DEVELOPMENT AUTHORITY

परिपत्र

परिपत्र संख्या: पीएफआरडीए/2024/14/आईसीएस/01

01 अगस्त, 2024

सेवा में,

पीएफआरडीए के सभी मध्यवर्ती / विनियमित संस्थाएं

महोदया / महोदय,

सूचना और साइबर सुरक्षा नीति दिशानिर्देश - 2024 पर मध्यवर्ती / विनियमित संस्थाओं के लिए परिपत्र

1. प्रौद्योगिकी में लगातार हो रहे संवर्धन और उभरते हुए खतरों के बीच, साइबर सुरक्षा उपायों के माध्यम से आईटी अवसंरचना और डेटा की सुरक्षा भी बहुत महत्वपूर्ण है। यह उम्मीद की जा रही है कि विनियमित संस्थाओं ने साइबर सुरक्षा मामलों पर रोक लगाने के लिए अतीत में उपाय किए होंगे, लेकिन अभिदाताओं के हितों की रक्षा करने और विकसित हो रहे स्थापत्य की सुरक्षा और उसकी सत्यनिष्ठा सुनिश्चित करने के लिए, प्राधिकरण द्वारा सूचना और साइबर सुरक्षा नीति दिशानिर्देश - 2024 को अनुलग्नक में प्रदान किया गया है। ये दिशानिर्देश, विनियमित संस्थाओं के लिए साइबर खतरों को प्रभावी ढंग से प्रबंधित करने, महत्वपूर्ण आस्तियों की रक्षा करने और डिजिटल युग में विश्वास और भरोसा बनाए रखने के लिए एक रोडमैप के रूप में काम करेंगे। ये दिशानिर्देश विनियमित संस्थाओं के लिए एक व्यापक मानदंड के रूप में भी कार्य करेंगे ताकि वे अपनी सूचना और संचार प्रौद्योगिकी (आईसीटी) अवसंरचना को साइबर खतरों से बचाने के लिए आवश्यक नियंत्रणों और प्रक्रियाओं को समझ सकें और उन्हें कार्यान्वित कर सकें।

2. यह परिपत्र, पेंशन निधि विनियामक और विकास प्राधिकरण अधिनियम की धारा 14 के अंतर्गत प्रदत्त शक्तियों का प्रयोग करते हुए जारी किया गया है।

3. ये दिशानिर्देश 01 अगस्त, 2024 से लागू होंगे।

(हस्ताक्षर) सचिन जोनेजा महाप्रबंधक सूचना और साइबर सुरक्षा विभाग

---

PENSION FUND REGULATORY AND DEVELOPMENT AUTHORITY

CIRCULAR

Circular No.: PFRDA/2024/14/ICS/01

01.08.2024

To

All Intermediaries / Regulated Entities of PFRDA

Madam/Sir,

Circular on Information & Cybersecurity Policy Guidelines- 2024 for Intermediaries/Regulated entities

1. With the rapid technological advancements and emerging threats, protection of IT infrastructure and data through cybersecurity measures is of considerable importance. While the regulated entities are expected to have taken measures in the past to prevent the cyber security issues, in order to protect the interest of the subscribers and ensure safety and integrity of the evolving architecture the Authority hereby lays down Information & Cybersecurity Policy guidelines - 2024 as per Annexure. These guidelines will serve as a roadmap for Regulated Entities to effectively manage cyber risks, protect critical assets and maintain trust and confidence in the digital age. The guidelines shall also act as a broad standard for the Regulated Entities to understand and implement essential controls and procedures to protect their Information & Communication Technology (ICT) infrastructure from cyber threats.

2. This circular is issued in exercise of powers conferred under section 14 of the Pension Fund Regulatory and Development Authority Act.

3. These guidelines shall come into effect from 01st August, 2024.

(Signature) Sachin Joneja General Manager Information & Cyber Security Department

---

ANNEXURE

PENSION FUND REGULATORY AND DEVELOPMENT AUTHORITY

Information and Cyber Security Policy Guidelines - 2024 For Intermediaries / Regulated Entities

---

Table of Contents

1. Introduction and scope ............................................................................................. 3
2. Preliminary ................................................................................................................. 5 2.1 Short Title and Commencement ............................................................................. 5 2.2 Applicability.............................................................................................................. 5 2.3 Definitions ................................................................................................................ 6
3. Information and Cybersecurity Policy....................................................................... 7
4. Components of Information and Cybersecurity Policy (ICP) ................................. 8 4.1 Core Components of the Information and Cybersecurity Policy (ICP) ................. 9 4.1.1 Governance: ................................................................................................... 9 4.1.2 Identify .......................................................................................................... 10 4.1.3 Protect .......................................................................................................... 11 4.1.4 Detect ........................................................................................................... 23 4.1.5 Respond ....................................................................................................... 23 4.1.6 Recover ........................................................................................................ 24 4.2 Cyber security audits .............................................................................................. 25 4.3 Capacity Management ............................................................................................ 26 4.4 Audit Trails ............................................................................................................. 26 4.5 Reporting of Cyber incidents .................................................................................. 26

---

1. Introduction and scope

In today's interconnected digital landscape, the financial services sector stands as a prime target for cyber threats due to the vast amounts of sensitive data it handles, including personal and financial information. Cyber-attacks are increasing in frequency, sophistication and impact, with perpetrators continually refining their efforts to compromise systems, networks and information world-wide. A key driver of this trend is the increasing usage of technology by the financial services sector to improve customer service and operational efficiency.

The following emerging trends in technology and their extensive use in almost all spheres of financial services is creating opportunities and threats in the form of Cybersecurity risk to the business:

• Cloud storage has revolutionized the way we manage and access data, offering unparalleled convenience and flexibility. It enables users to store vast amounts of information remotely, accessible from anywhere with an internet connection. However, this convenience comes with its own set of cybersecurity risks.
• APIs (Application Programming Interfaces) serve as the backbone of modern software, enabling different systems to communicate and share data efficiently. Vulnerabilities in these APIs, such as injection flaws or insecure direct object references, can be exploited by attackers to access or manipulate data without proper authorization.
• Mobile applications introduce significant cybersecurity risks due to their access to sensitive data and widespread usage. These risks include data breaches, malware infiltration, insecure data storage and communication, weak authentication mechanisms, vulnerabilities in third-party dependencies, code tampering, and susceptibility to phishing attacks.
• The increasing use of artificial intelligence (AI) as a tool by industry as well as by cyber attackers also introduces new challenges and risks, as cyber attackers leverage AI-driven techniques to launch more sophisticated and targeted attacks. Still, AI technologies have the potential to revolutionize cybersecurity practices, offering innovative solutions for threat detection, incident response, and vulnerability management.

Objective and Purpose:

In the NPS architecture there is significant element of data storage, transmission and recordkeeping with Central Recordkeeping Agencies (CRA’s), PFMs, POPs, Custodian and Trustee bank and the safety and security of which is of primary concern to the regulator in order to ensure systemic protection. The continued safety and security of the systems, data and privacy of the information is of utmost importance to the regulator in light of the protection of subscriber’s interest.