A practical reference mapping e91 ISP's capabilities to the specific identity-related clauses in DPDP, RBI CSCRF, SEBI, IRDAI, CERT-In Directions, and international standards. Built for CISOs, compliance officers, and auditors who need to produce evidence quickly.
This library maps identity-related controls from each framework to specific e91 ISP capabilities. It is a reference tool, not a legal opinion. Regulatory language evolves — clause numbers and exact wording should be verified against the latest official circular before use in audit evidence or contractual commitments.
Coverage ratings reflect the product's direct contribution: Direct (e91 ISP substantively satisfies the clause), Supports (e91 ISP provides a meaningful component; other controls may be needed), Contextual (clause is partly identity-adjacent; e91 ISP provides useful evidence).
India's Digital Personal Data Protection Act 2023. Consent, residency, access controls, erasure.
Reserve Bank's Cyber Security Framework for banks, NBFCs, and payment-system operators.
Cybersecurity and Cyber Resilience Framework for regulated capital-market entities.
Information & Cybersecurity Guidelines for insurers, reinsurers, and intermediaries.
April 2022 Directions on incident reporting, log retention, and cyber-hygiene baselines.
Guidelines for Critical Information Infrastructure — power, telecom, banking, transport.
Digital Identity Guidelines — authenticator types, assurance levels, lifecycle.
Information security management system controls (Annex A, 2022 revision).
India's foundational data-protection law. Applies to any entity (Data Fiduciary) processing personal data within India or of Indian citizens. While DPDP is framework-agnostic on how controls are implemented, identity security sits at the heart of three obligations: preventing unauthorised access, maintaining accountability records, and enabling secure erasure.
180-day retention plus DPDP documentation needs.RBI's layered cybersecurity regime — the most prescriptive of India's sectoral frameworks. Identity controls (authentication, privileged access, logging, audit) appear throughout the baseline requirements, C-SOC operating model, and incident-reporting expectations. For BFSI customers this is the audit every deal is written against.
syslog/TLS or Kafka. Pre-built detection rules for impossible travel and credential-stuffing patterns.SEBI's CSCRF applies to regulated entities in capital markets — stock brokers, AMCs, Market Infrastructure Institutions (exchanges, clearing corps, depositories), RTAs, and portfolio managers. SEBI has clarified that RBI-equivalent compliance is accepted for entities already regulated by RBI, avoiding duplicate effort. Size categorization (Small/Mid/Large) drives the applicable control intensity.
IRDAI's guidelines cover insurers, reinsurers, intermediaries, and insurance web aggregators. The identity-relevant controls sit primarily in the Access Management, Logging & Monitoring, and Third-Party Risk sections. Insurance policyholder data is considered Sensitive Personal Information under DPDP — so IRDAI controls often overlap with DPDP obligations.
CERT-In's 2022 Directions apply horizontally across all Indian service providers, intermediaries, data centres, body corporates, and government organisations. The identity-relevant obligations are incident reporting (6-hour window) and log retention (180-day minimum). These are the clauses most auditors will open with.
NCIIPC oversees designated Critical Information Infrastructure in sectors including power, banking, telecom, transport, government, and strategic public enterprises. CII operators face heightened obligations around air-gap deployment, indigenous technology preference, and strict incident reporting. This is the framework that makes air-gap deployment a hard requirement rather than a nice-to-have.
The international reference for digital identity assurance. While not directly mandated by Indian regulators, NIST 800-63B is widely cited as best practice and frequently appears in RFP requirements from sophisticated buyers. Compliance here signals engineering maturity. The framework defines Authenticator Assurance Levels (AAL1, AAL2, AAL3) that scale with risk.
ISO 27001 is the dominant enterprise security certification globally. While Indian sectoral regulators don't mandate it, large enterprise buyers routinely include it in RFP requirements and vendor-risk questionnaires. The 2022 revision consolidated Annex A into four themes: Organizational, People, Physical, and Technological controls. Identity sits mainly in the Technological controls (A.8).
The same e91 ISP capabilities satisfy controls across multiple frameworks. That's the compounding value — one implementation, many compliance wins.
| e91 ISP capability | Primary frameworks satisfied |
|---|---|
| Multi-factor authentication (8 types) | DPDP §8(5) · RBI Access Mgmt · SEBI Protect · IRDAI Access Mgmt · NIST AAL2/AAL3 · ISO A.8.5 |
| Tamper-evident audit log (SHA-256 chain) | DPDP §8(6) · RBI Audit Logs · CERT-In Direction 4 · IRDAI Logging · ISO A.8.15 |
| RBAC & access reviews | DPDP §8(5) · RBI User Access Control · ISO A.5.15 · A.8.2 |
| India-resident deployment / air-gap | DPDP §16 · CERT-In Direction 4 · NCIIPC Network Isolation · SEBI Data Security |
| KMS integration + PQC readiness | RBI Cryptography · SEBI Data Security · ISO A.5.17 |
| FIDO2 / phishing-resistant auth | NIST AAL3 · SEBI Protect · RBI Access Mgmt (high-risk) |
| SIEM streaming & detection rules | RBI C-SOC · SEBI Detect · CERT-In Direction 1 · ISO A.8.16 |
| Made-in-India + source escrow | NCIIPC Supply Chain · GeM procurement · MeitY empanelment path |
In discovery. Open with: "Which regulatory frameworks are you reporting against this year?" Point them to the relevant section. That one move differentiates you from vendors who open with feature lists.
In RFPs. Copy the mapping tables directly into RFP responses. Every regulated buyer has a compliance annex — this library gives you pre-filled answers.
In customer conversations with auditors. After a customer deploys, forward this library to their audit team. It positions e91 ISP as a mature vendor and removes a common audit friction point.
As a marketing lead magnet. Gated download on the marketing site. CISOs search for these checklists actively; every download is a warm, self-qualified lead.