Regulations & frameworks
Compliance that stands up to the regulator
Find the regime that applies to you and see how we help you meet it. Each name links to the official source.
| Regulation or framework | Region | What it covers | How we help |
|---|---|---|---|
| CERT-In directions (28 Apr 2022) cert-in.org.in | India | Incident reporting within 6 hours, 180-day log retention and time-sync obligations for service providers, intermediaries and bodies corporate. | Reporting playbooks, log and NTP design, incident readiness. |
| SEBI CSCRF sebi.gov.in | India | Cybersecurity and Cyber Resilience Framework for SEBI-regulated entities (circular of 20 Aug 2024 and later clarifications), including audit and resilience expectations. | Gap assessment, control mapping, SOC monitoring, audit evidence. |
| RBI IT governance, risk, controls and assurance directions rbi.org.in | India | Master Direction (7 Nov 2023) on IT governance, risk, controls, assurance and business continuity for banks, NBFCs and other regulated entities. | Programme design, SOC, identity and data controls, testing. |
| DPDP Act, 2023 indiacode.nic.in | India | Digital Personal Data Protection Act and Rules: consent, data principal rights, security safeguards and breach intimation. | Data inventory, privacy programme, breach response and notification playbook. |
| Revised Schedule M (GMP), Drugs Rules 1945 cdsco.gov.inPharma & life sciencesOfficial CDSCO copy: Gazette of India Extraordinary No. 738, 28 Dec 2023 (Hindi and English PDF, 272 pages). | India | Revised good manufacturing practice requirements notified as G.S.R. 922(E) on 28 Dec 2023, including controls for computerised systems and records. | Computerised-system access control, audit trails, data integrity and validated-state security. |
| New Drugs and Clinical Trials Rules, 2019 cdsco.gov.inPharma & life sciences | India | Rules for new drugs, clinical trials, bioavailability and bioequivalence studies in India, including ethics committees and record-keeping. | Secure trial data handling, access governance, vendor and site oversight. |
| 21 CFR Part 11 ecfr.govPharma & life sciences | United States | FDA rules for electronic records and electronic signatures used in place of paper under FDA regulations. | Access control, audit trails, signature controls, validation support. |
| FDA CGMP data integrity guidance fda.govPharma & life sciences | United States | FDA's 2018 questions and answers on data integrity and compliance with drug CGMP. | Data integrity gap assessment, system controls, remediation plans. |
| FDA medical device cybersecurity (section 524B) fda.govPharma & life sciences | United States | Premarket cybersecurity expectations for cyber devices under section 524B of the FD&C Act, including vulnerability management plans and an SBOM. | Threat modelling, secure product development, SBOM and vulnerability handling processes. |
| HIPAA Security Rule hhs.gov | United States | Security safeguards for electronic protected health information held by covered entities and business associates. | Risk analysis, safeguards, business-associate controls. |
| NIS2 Directive (EU) 2022/2555 eur-lex.europa.eu | European Union | EU directive on cyber risk management and incident reporting for essential and important entities. | Applicability review, risk management measures, supplier oversight. |
| DORA Regulation (EU) 2022/2554 eur-lex.europa.eu | European Union | Digital operational resilience for financial entities and their ICT providers. | ICT risk framework, resilience testing, third-party register. |
| GDPR Regulation (EU) 2016/679 eur-lex.europa.eu | European Union | General Data Protection Regulation: lawful processing, security of processing and breach notification. | Privacy impact assessments, technical safeguards, breach readiness. |
| ISO/IEC 27001:2022 iso.org | Global | International standard for an information security management system. | Scoping, controls, internal audit and auditor liaison. |
| SOC 2 aicpa-cima.com | Global | AICPA attestation on security, availability and confidentiality controls for service organisations. | Readiness, control design, evidence collection. |
| PCI DSS pcisecuritystandards.org | Global | Security standard for organisations that handle payment card data. | Scope reduction, segmentation, testing and compliance support. |
| NIST Cybersecurity Framework nist.gov | Global | Voluntary framework to govern, identify, protect, detect, respond and recover. | Maturity assessment and roadmap. |
Descriptions are summaries to orient you, not legal advice. Links go to the publisher's page and may change. Check the current text and any amendments before relying on a requirement. NAPSECURE is an advisory firm and does not issue certifications or regulatory approvals.
Not sure which rules apply?
We will map your obligations and show the shortest path to evidence.