Cybersecurity, Aligned to Where You Operate.

CERT-In has issued directions covering cybersecurity practices, cyber-incident reporting, log maintenance and related information-security requirements. Organisations need incident processes, logging and governance that can meet these expectations in practice — not only on paper.

Applicability and specific obligations depend on the organisation’s role and the services it provides.

How Cyphrna helps

• CERT-In readiness assessment
• Cyber-incident reporting readiness
• Incident response governance
• Incident classification and escalation
• Log-management assessment
• Vulnerability-management governance
• Cybersecurity policy development
• Incident-response tabletop exercises

The DPDP framework sets out how organisations may collect and use digital personal data — including notice and consent, reasonable security safeguards, breach notification and the rights of individuals. The Rules notified in November 2025 are being brought into force in phases.

Relevant to organisations processing digital personal data in India, with obligations that vary by role and classification.

How Cyphrna helps

• DPDP readiness assessment
• Personal-data inventory
• Data mapping
• Data classification
• Security-control assessment
• Third-party data-risk assessment
• Data retention and lifecycle governance
• Data-breach readiness
• Privacy and security governance

The Information Technology Act, 2000 and rules made under it form part of the broader legal landscape for information security, intermediaries and cyber incidents in India.

Specific requirements depend on the organisation’s activities; not every provision applies to every organisation.

How Cyphrna helps

• Applicability and obligations review
• Information-security policy alignment
• Security-practice gap assessment
• Governance and accountability mapping

Banking, capital markets, insurance, telecommunications and other regulated sectors carry additional cybersecurity, IT-governance and resilience expectations set by their regulators.

Applies to regulated entities within each sector, subject to their licence category and regulator.

How Cyphrna helps

• Sector-requirement mapping
• IT and cyber-risk assessment
• Board and management reporting
• Third-party and outsourcing risk
• Cyber-resilience and continuity review
• Audit and inspection readiness

The ECC define the minimum cybersecurity requirements across governance, defence, resilience and third-party security. The 2024 edition updates and streamlines the original 2018 controls.

Applies to government entities and their affiliated entities, and to private-sector organisations that own, operate or host critical national infrastructure.

How Cyphrna helps

• ECC gap assessment
• Cybersecurity maturity assessment
• Control implementation support
• Evidence-readiness assessment
• Cyber-risk assessment
• Policy and procedure development
• Remediation planning
• Management dashboards

An extension of the ECC with additional requirements for systems classified as critical.

Relevant to in-scope entities operating systems classified as critical under NCA methodology.

How Cyphrna helps

• Critical-system risk assessment
• Security architecture review
• Governance assessment
• Cloud and third-party risk
• Privileged-access assessment
• Cyber resilience
• Disaster-recovery assessment

An extension of the ECC setting cybersecurity requirements for cloud computing, with separate control sets for cloud service providers and cloud service tenants.

Relevant to applicable cloud service providers and to in-scope organisations using cloud services.

How Cyphrna helps

• Cloud-security assessment
• Cloud GRC
• AWS / Azure security governance
• Cloud control gap assessment
• Shared-responsibility assessment
• Cloud data protection
• Third-party cloud risk

Controls focused on protecting data throughout its lifecycle, aligned to data classification.

Relevant to in-scope entities, depending on the classification of the data they handle.

How Cyphrna helps

• Data-security governance
• Data classification
• Data-access governance
• Data lifecycle management
• Third-party data risk
• Data-security maturity assessment

Controls for industrial control systems and operational technology, where safety and availability are paramount — typically relevant to oil & gas, petrochemicals, energy, utilities, manufacturing, mining and other industrial operators.

Relevant to in-scope entities operating OT / ICS environments.

How Cyphrna helps

• OT cybersecurity risk assessment
• IT/OT segmentation review
• ICS security governance
• OT asset inventory
• Remote-access risk assessment
• Third-party OT risk
• OT incident response
• IEC 62443 alignment

Saudi Arabia’s data-protection law governs the processing of personal data, including security safeguards and breach handling.

Relevant to organisations processing personal data of individuals in the Kingdom, subject to the law’s scope.

How Cyphrna helps

• Privacy and security gap assessment
• Personal-data security controls
• Data classification
• Data-flow assessment
• Third-party data risk
• Privacy-risk management
• Incident and breach readiness

SAMA sets cybersecurity and resilience expectations for the financial institutions it regulates.

Applies to applicable SAMA-regulated financial-sector organisations.

How Cyphrna helps

• Cybersecurity readiness
• Cyber-risk assessment
• Third-party risk
• Cyber resilience
• Incident management
• Security governance

The UAE’s federal data-protection law sets requirements for processing personal data, including security measures and breach notification. Free zones such as DIFC and ADGM operate their own data-protection regimes.

Scope depends on where and how personal data is processed, including free-zone status.

How Cyphrna helps

• Data-protection readiness
• Privacy and security assessment
• Data inventory
• Data classification
• Data-flow mapping
• Security controls
• Third-party data risk
• Breach readiness
• Privacy-by-design security advisory

The national Information Assurance framework defines governance and security controls to protect information assets and critical information infrastructure across the UAE.

Relevant to applicable federal entities and organisations within its scope, including critical-infrastructure sectors.

How Cyphrna helps

• Information-security maturity assessment
• Cybersecurity governance
• Risk assessment
• Control-framework mapping
• ISO 27001 alignment
• NIST alignment
• Security policy development
• Information classification
• Third-party risk

Dubai’s information-security regulation sets governance, operational and assurance controls for Dubai Government entities.

Particularly relevant to Dubai Government entities and organisations that work with them. It does not apply universally to all UAE companies.

How Cyphrna helps

• ISR readiness
• Governance assessment
• Risk assessment
• Control gap analysis
• Policy development
• Third-party risk
• Audit and evidence readiness

The Central Bank sets technology-risk, resilience and cybersecurity expectations for the institutions it regulates.

Applies to applicable CBUAE-licensed financial institutions.

How Cyphrna helps

• ICT and cyber-risk assessment
• Cyber resilience
• Third-party risk
• IAM / PAM assessment
• Vulnerability-management governance
• Incident-response readiness
• Board-level cyber-risk reporting

Qatar’s national information-assurance policy provides a structured approach to classifying information and selecting security controls to manage information-security risk.

Relevant to government entities and other organisations within its scope, including critical-sector operators.

How Cyphrna helps

• NIA readiness assessment
• Information-security maturity assessment
• Cybersecurity governance
• Risk assessment
• Control implementation
• ISO 27001 / NIA mapping
• Security policies
• Compliance evidence management
• Audit readiness

The NCSA’s compliance framework through which organisations demonstrate conformance with Qatar’s information-security requirements, including NIA certification by accredited bodies.

Relevant to organisations seeking or required to demonstrate compliance under NCSA programmes.

How Cyphrna helps

• Compliance readiness
• Control assessment
• Evidence preparation
• Cybersecurity governance
• Security maturity assessment

Qatar’s data-protection law governs the processing of personal data, including safeguards to protect it.

Relevant to organisations processing personal data within its scope.

How Cyphrna helps

• Personal-data security assessment
• Data inventory
• Data classification
• Privacy and security controls
• Data-flow assessment
• Third-party data risk
• Data governance
• Breach preparedness

Protection of the information infrastructure that critical sectors depend on — typically energy, oil & gas, financial services, government, utilities and transportation.

Relevant to organisations operating or supporting critical information infrastructure.

How Cyphrna helps

• Critical-asset identification
• Cybersecurity risk assessment
• IT/OT security
• Network segmentation
• Third-party risk
• Incident response
• Business continuity
• Disaster recovery
• Cyber resilience

QCB sets technology-risk, cybersecurity and resilience expectations for the financial institutions it regulates.

Applies to applicable QCB-regulated financial institutions.

How Cyphrna helps

• Cybersecurity readiness
• IT and cyber risk
• Technology governance
• Third-party risk
• Incident management
• Cyber resilience
• Business continuity
• Disaster recovery