ISO 27001 A.5.5: Contact with Authorities

Quick Reference

What the Control Asks For

In short:

ISO 27001:2022 Annex A 5.5 asks organizations to establish and maintain contact with relevant authorities.

Do you need this control?

A.5.5 is not mandatory in itself: under clause 6.1.3 you include it if your risk assessment calls for it, and record the decision in your Statement of Applicability. Most organisations include it, because they must know whom to call (CERT-In, police, sector regulators) when something goes wrong. It could be excluded only if no authority has any relevant role, which is very unusual in India where CERT-In reporting applies to all body corporates.

This control requires organizations to:

1. Identify relevant authorities: government bodies, regulatory agencies, law enforcement, and statutory bodies that have jurisdiction over the organization's information security activities
2. Establish formal contact mechanisms: designate points of contact, maintain communication channels, and ensure accessibility
3. Maintain ongoing relationships: regular engagement, not just reactive contact during incidents
4. Report as required: submit mandatory reports, disclosures, and notifications in accordance with legal and regulatory requirements
5. Coordinate during incidents: have pre-established channels for incident reporting, evidence preservation, and investigation support
6. Stay informed of regulatory developments: track changes in laws, regulations, guidelines, and enforcement priorities that affect the organization's security obligations

The control encompasses both proactive engagement (building relationships before they are needed) and reactive engagement (reporting and coordination during incidents).

Why It Matters

Legal and Regulatory Compliance

Indian law mandates specific interactions with authorities for cybersecurity incidents:

• IT Act, 2000 (Section 70B): CERT-In has powers to issue directions for cybersecurity incident reporting
• CERT-In Directions (2022): Mandatory reporting of 20 categories of incidents within 6 hours of noticing them, for all service providers, intermediaries, data centres, body corporates and government organisations
• DPDP Act 2023: Upcoming data breach notification requirements to the Data Protection Board
• Sectoral regulations: RBI, SEBI, IRDAI, TRAI, and others have specific reporting and coordination requirements

Failure to maintain contact with authorities can result in regulatory penalties, criminal liability, and loss of operating licenses. A bank that cannot report a cybersecurity incident to RBI within the required timeframe faces not just fines but potential restrictions on digital operations.

Incident Response Acceleration

Pre-established relationships with authorities dramatically accelerate incident response:

• CERT-In can provide technical assistance, threat intelligence, and coordination during major incidents
• Police cybercrime units (state and national) can initiate investigations, preserve evidence, and pursue attackers
• Sector regulators (RBI, SEBI) can provide guidance on customer communication, regulatory reporting, and operational continuity during breaches
• NCIIPC provides critical infrastructure protection support and sector-wide coordination

Pre-established contacts save hours when they matter most: if you already know the CERT-In reporting route, your regulator's contact and the local cyber cell, you can report within the 6-hour window and get help while containing the incident.

Access to Government Threat Intelligence

Authorities possess intelligence that commercial providers cannot access:

• CERT-In receives international threat intelligence through FIRST and bilateral agreements
• NCIIPC has access to national security-level threat assessments for critical infrastructure
• State police cybercrime units have visibility into local threat actor activities, arrest records, and investigation outcomes
• NIA and IB (for critical national security matters) provide intelligence on APT groups targeting Indian interests
• Ministry of Home Affairs coordinates on national cybersecurity policy and threat landscape assessments

Regulatory Foresight and Preparation

Organizations with active authority engagement receive early warning of regulatory changes:

• Participation in RBI's cybersecurity consultations provides months of advance notice before new requirements take effect
• SEBI's working groups allow market participants to shape cybersecurity guidelines
• CERT-In workshops preview upcoming directions and compliance expectations
• DSCI's government liaison provides insight into DPDP Act implementation timelines and requirements

This foresight allows organizations to pre-position compliance investments, avoiding the scramble that follows surprise regulatory announcements.

Protection of National Interest

For organizations handling critical infrastructure, defense contracts, or sensitive national data, authority engagement is a matter of national security:

• NCIIPC mandates formal coordination for all Critical Information Infrastructure (CII) entities
• Defence suppliers must follow the security conditions in their Ministry of Defence contracts and report as those contracts require
• Government organizations are required to implement CERT-In directions and participate in national cybersecurity exercises
• Telecom operators must coordinate with DoT on network security and surveillance requirements

Evidence Preservation and Legal Admissibility

Proper authority engagement ensures that incident evidence is preserved in a legally admissible manner:

• Police coordination ensures chain of custody for digital evidence
• Forensic protocols established with authorities improve evidence quality for prosecution
• Regulatory reporting creates contemporaneous records that may be valuable in litigation
• CERT-In incident reports provide official documentation of attack timelines and impact

Reputation and Trust Preservation

Organizations that demonstrate proactive authority engagement are viewed more favorably by regulators, customers, and partners:

• Regulatory trust reduces scrutiny and audit intensity
• Customer confidence improves when organizations can demonstrate government coordination
• Insurance benefits: cyber insurance underwriters view authority engagement as a positive risk factor
• Partner trust in supply chain security assessments

Access to Government Support Programs

Authorities offer support programs that organizations can only access through engagement:

• CERT-In cybersecurity awareness and training programs
• MeitY's cybersecurity R&D grants and innovation programs
• NCIIPC's sectoral capacity building and exercise programs
• State government cybersecurity initiatives and funding (e.g., Karnataka, Maharashtra)
• BIS standards development participation and early access to drafts

Scope and Applicability

In Scope

This control applies to:

• All organizations seeking ISO 27001 certification, regardless of size or sector
• Government organizations and public sector undertakings (mandatory engagement)
• Critical Information Infrastructure (CII) entities (mandatory NCIIPC coordination)
• Regulated entities (banks, NBFCs, insurance companies, securities market participants, telecom operators)
• Organizations handling large volumes of personal data or children's data (DPDP Act preparation)
• Organizations handling defense or national security contracts
• Any organization that may be subject to cybercrime investigation or incident reporting requirements

Organizational Size Considerations

Small Organizations (≤50 employees):

• Maintain basic CERT-In contact and advisory subscription
• Register with local police cybercrime unit
• Track sector-specific regulatory requirements
• Designate a single point of contact (typically the business owner or IT lead)

Medium Organizations (50–500 employees):

• Maintain formal contact with CERT-In and relevant sector regulator
• Register with state and national police cybercrime units
• Establish legal counsel relationship for incident coordination
• Participate in regulatory workshops and consultations

Large Organizations (≥500 employees) and Regulated Entities:

• Full authority engagement program with dedicated government liaison
• Formal NCIIPC coordination (if CII)
• Multi-level police contacts (local, state, national, cybercrime)
• Sector regulator working group participation
• Legal team with regulatory expertise
• Budget: –+ annually

Sector-Specific Authority Engagement

Key Definitions

Relationship to Other Controls

Directly Related Controls

Indirectly Related Controls

Implementation Roadmap

Phase 1: Identification and Registration (Weeks 1–4)

Phase 2: Formalization (Weeks 5–8)

Phase 3: Operationalization (Weeks 9–12)

Phase 4: Maturity (Months 4–12)

Detailed Guidance

Complete Authority Inventory

Organizations must systematically identify all authorities with which they must or should maintain contact. Use this framework:

Tier 1, National Cybersecurity Bodies (CERT-In for all; NCIIPC for CII)

• CERT-In: National incident response, advisories, mandatory reporting (for designated entities)
• NCIIPC: Critical infrastructure protection (mandatory for CII entities)
• National Cybercrime Reporting Portal: Cybercrime reporting (cybercrime.gov.in)
• MeitY: IT policy, STPI, cybersecurity R&D programs

Tier 2, Law Enforcement (report cyber crimes where required or advised; CERT-In reporting is the statutory duty)

• State Police Cybercrime Cells: Local cybercrime investigation and reporting
• Cybercrime Coordination Centre (I4C): National cybercrime coordination
• CBI Cybercrime Division: High-profile or interstate cybercrime cases
• Economic Offences Wing: Financial cybercrime (for banking/finance fraud)
• State Crime Investigation Departments: Organized cybercrime, cyberterrorism

Tier 3, Sector Regulators (Mandatory for Regulated Entities)

• RBI: Banking, NBFCs, payment systems, UPI operators
• SEBI: Securities markets, stock exchanges, depositories, brokers
• IRDAI: Insurance companies, insurance intermediaries
• TRAI: Telecom service providers, ISPs
• PFRDA: Pension funds, NPS providers

Tier 4, Data Protection and Privacy Authorities

• Data Protection Board of India (constituted under the DPDP Act; breach intimations go to it once the fiduciary duties commence, about May 2027)
• MeitY (policy owner for the IT Act and DPDP Act)
• State Information Commissions (under RTI Act for information access matters)

Tier 5, Specialized and Emerging Bodies

• National Security Council Secretariat (NSCS): For national security-related cybersecurity
• NIA: For cyberterrorism and national security incidents
• ED (Enforcement Directorate): For cybercrime-related financial investigations
• SFIO (Serious Fraud Investigation Office): For corporate fraud involving cyber elements

Tier 7, Continuity and Emergency Contacts (ISO 27002 also lists these)

• Emergency services: 112 (police, fire, ambulance)
• Fire department (for fire NOCs and incidents at your premises)
• Electricity distribution company and generator/UPS service provider
• Telecom and internet providers (circuit faults, line routing)
• Water supply and building management (cooling, flooding)
• Record when and by whom each is contacted, as ISO 27002 recommends for every authority

Tier 6, Local and State Bodies

• State CERTs (Maharashtra, Karnataka, etc.): Localized incident response and advisories
• State IT Departments: State cybersecurity policies and initiatives
• State Police: General law enforcement for cybercrime incidents
• District Cybercrime Cells: Local cybercrime reporting and investigation
• Municipal Bodies: For smart city and critical urban infrastructure

CERT-In Engagement Framework

CERT-In is the foundational authority engagement for virtually all Indian organizations.

Registration:

• Visit cert-in.org.in
• Register your organization with valid email domain
• Subscribe to CERT-In advisories (free email subscription)
• Download and review the CERT-In Directions of 28 April 2022 and the accompanying FAQs

Mandatory Reporting (CERT-In Directions under s.70B(6), 28 April 2022):

• 20 categories of incidents must be reported within 6 hours
• Categories include: data breaches, malware, DDoS, ransomware, APT, supply chain attacks, cloud security incidents, IoT attacks, etc.
• The Directions apply to all service providers, intermediaries, data centres, body corporates and government organisations; there is no size threshold
• Report through CERT-In's online portal or designated communication channels

Voluntary Engagement:

• Participate in CERT-In workshops and capacity-building programs
• Respond to CERT-In surveys and information requests
• Provide feedback on advisories and directions
• Participate in CERT-In coordinated exercises (cyber drills)
• Engage with CERT-In for vulnerability disclosure coordination

Incident Coordination:

• Contact CERT-In during major incidents for technical assistance
• Coordinate on threat intelligence sharing during active campaigns
• Request forensic support or investigation coordination for significant incidents
• Participate in post-incident reviews with CERT-In when requested

NCIIPC Engagement for CII Entities

Organizations designated as Critical Information Infrastructure (CII) have mandatory NCIIPC engagement.

CII Identification:

• Sectors: Energy, Banking & Finance, Telecom, Transport, Government, Defense, Space, Law Enforcement, Health, Water, Digital Infrastructure
• NCIIPC notifies organizations of CII designation
• Organizations may also self-assess and seek CII determination

Mandatory NCIIPC Engagement:

• Register with NCIIPC upon CII designation
• Designate NCIIPC liaison within the organization
• Implement NCIIPC sectoral guidelines and advisories
• Participate in NCIIPC sectoral risk assessment and coordination
• Report significant incidents to NCIIPC (in addition to CERT-In)
• Participate in NCIIPC exercises and capacity-building programs
• Allow NCIIPC audits and assessments as required

NCIIPC Coordination Activities:

• Sectoral working group participation
• Threat intelligence sharing through NCIIPC channels
• Joint incident response planning with sector peers
• Infrastructure vulnerability assessment coordination
• Crisis management and continuity planning alignment

Sector Regulator Engagement

Banking (RBI):

• RBI Cyber Security Framework and IT Governance Master Direction compliance reporting
• Incident reporting to RBI's CSITE cell (Department of Supervision) within 2 to 6 hours, and to CERT-In within 6 hours
• Participation in RBI's cybersecurity awareness programs
• Engagement with IDRBT for research and advisory
• RBI's "Cybersecurity Alerts" monitoring and response
• Annual cyber drills coordinated by RBI
• Reporting under the Digital Payment Security Control framework

Securities (SEBI):

• SEBI CSCRF (2024) compliance for MIIs and intermediaries
• Cybersecurity incident reporting to SEBI
• Participation in SEBI cybersecurity audits and reviews
• Engagement with stock exchange cybersecurity teams (NSE, BSE)
• Reporting on cybersecurity posture in periodic compliance filings

Insurance (IRDAI):

• IRDAI Information and Cyber Security Guidelines (2023) compliance and incident reporting (6 hours)
• Incident reporting to IRDAI IT Department
• Participation in IRDAI cybersecurity consultations
• Coordination on customer data protection and breach notification

Telecom (DoT/TRAI):

• DoT security directives compliance (licensing conditions)
• TRAI consultations on network security and data protection
• Reporting on network security incidents
• Coordination with Telecom-ISAC and DoT security division
• Compliance with encryption and lawful interception requirements

Law Enforcement Engagement

Police Cybercrime Unit Engagement:

• Identify the relevant police cybercrime unit for your jurisdiction (state cybercrime cell)
• Register your organization and obtain primary/secondary contact details
• Understand local cybercrime reporting procedures and requirements
• Establish relationship with the Station House Officer (SHO) or cybercrime Inspector
• For organizations with multi-state presence, maintain contacts in all relevant states

When to Contact Law Enforcement:

• Criminal cyberattacks (ransomware, unauthorized access, data theft with criminal intent)
• Financial fraud involving cyber elements
• Insider threats with criminal behavior
• Attacks on critical infrastructure with potential criminal attribution
• Evidence of APT activity with potential national security implications
• Cases requiring investigation, arrest, or prosecution

Evidence Preservation for Law Enforcement:

• Establish evidence preservation procedures that align with legal requirements
• Maintain chain of custody documentation
• Preserve logs, disk images, and network captures in forensically sound manner
• Coordinate with legal counsel before sharing evidence
• Understand that law enforcement may seize devices or require access to systems
• Document all evidence handling for legal admissibility

24/7 Contact Requirements:

• Cybercrime incidents often require immediate law enforcement notification
• Maintain 24/7 contact methods for critical incidents (not just business hours)
• Pre-agree communication channels for emergency incidents
• Have legal counsel available for after-hours incident support

Building Effective Government Relationships

Professionalism and Respect:

• Government officials operate under different constraints than private sector
• Be patient with bureaucratic processes and response times
• Respect hierarchy and chain of command in government organizations
• Understand that government officials may have limited technical depth, communicate clearly
• Build relationships with mid-level officials (who often have more operational flexibility than senior officers)

Proactive Engagement:

• Don't wait for incidents to establish contact
• Attend government workshops, seminars, and outreach programs
• Participate in regulatory consultations and working groups
• Provide constructive feedback on draft guidelines and advisories
• Offer to host or sponsor government cybersecurity awareness events
• Share anonymized threat intelligence proactively (where appropriate)

Reciprocity:

• Respond to government information requests promptly
• Provide accurate data for surveys and assessments
• Participate in government-coordinated exercises even when not mandatory
• Offer industry expertise for policy development and standards creation
• Acknowledge government support in public communications (when appropriate)

Confidentiality and Sensitivity:

• Be mindful of what you share with different authority levels
• Classify information appropriately for government sharing
• Understand that government bodies may have different confidentiality obligations than industry groups
• Obtain legal advice before sharing sensitive competitive or business information
• Be aware that information shared with government may be subject to RTI disclosure

Tools and Technologies

CERT-In Portal and Resources

NCIIPC Resources

Government Reporting Platforms

Communication and Documentation Tools

Policy Templates and Documentation

Authority Contact Policy (Template)

Incident Reporting Procedure (Template)

Risk Assessment

Risks of NOT Engaging with Authorities

Risks of Authority Engagement

Risk Treatment Plan

Audit and Assessment Checklist

Documentation Review

• Is there a documented Authority Contact and Engagement Policy?
• Is there an inventory of all relevant authorities with jurisdiction?
• Is there a documented incident reporting procedure with timelines and workflows?
• Is there an authority contact directory with 24/7 contact methods?
• Are liaison roles formally designated with primary and backup contacts?
• Is there evidence of authority registration (CERT-In, NCIIPC, etc.)?
• Are mandatory reporting requirements documented with legal basis?
• Is there evidence of legal review for reporting procedures and authority communications?
• Are evidence preservation and chain of custody procedures documented?
• Is there a record of authority engagement (reports, correspondence, meeting records)?
• Is there evidence of annual/quarterly policy review?
• Are staff training records on authority engagement maintained?

Implementation Review

• Has the organization registered with CERT-In and subscribed to advisories?
• Has the organization registered with relevant state police cybercrime units?
• Are sector regulator contacts established and documented?
• Is there evidence of active authority engagement (not just passive registration)?
• Has the incident reporting workflow been tested (tabletop exercise)?
• Is there evidence of authority advisory monitoring and response?
• Are reporting deadlines tracked and met?
• Is there evidence of participation in regulatory workshops or consultations?
• Are 24/7 authority contact methods maintained and tested?
• Is there evidence of CII coordination with NCIIPC (if applicable)?

Compliance Review

• Is the organization meeting all mandatory reporting requirements?
• Is there evidence of compliance with CERT-In directions?
• Is there evidence of compliance with sector-specific regulatory requirements?
• Is the organization prepared for DPDP Act data breach notification requirements?
• Are there records of all regulatory submissions and correspondence?
• Is there evidence of regulatory update monitoring and adaptation?
• Has the organization participated in any regulatory audits or assessments?
• Is there documentation of any regulatory findings and remediation?

Metrics and KPIs

Engagement Metrics

Reporting Metrics

Operational Metrics

Compliance and Foresight Metrics

Cost and Value Metrics

Common Pitfalls and How to Avoid Them

Reactive Engagement Only

Pitfall: Only contacting authorities during incidents, with no prior relationship or established procedures. Impact: Delayed response, authority unfamiliarity with your organization, missed cooperation opportunities, regulatory suspicion. Solution: Establish proactive engagement before incidents occur. Register, subscribe, attend workshops, and build relationships during calm periods.

Inconsistent or Outdated Contact Information

Pitfall: Authority contacts not updated, resulting in failed communications during incidents. Impact: Delayed reporting, missed coordination windows, compliance violations. Solution: Quarterly contact directory reviews, subscription to authority update notifications, verification of 24/7 contact methods.

Inadequate Legal Review

Pitfall: Sharing information with authorities without legal review, exposing the organization to liability or compromising legal privilege. Impact: Regulatory penalties, litigation exposure, waiver of legal privilege, competitive disadvantage. Solution: Mandatory legal review for all authority-bound reports and communications, privilege-preservation procedures, legal counsel training on cybersecurity issues.

Failure to Track Regulatory Changes

Pitfall: Missing updates to reporting requirements, new regulations, or changed compliance expectations. Impact: Regulatory non-compliance, surprise audit findings, penalties. Solution: Regulatory update monitoring system, participation in consultations, legal counsel alertness, subscription to regulatory update services.

Over-Reporting or Under-Reporting

Pitfall: Reporting incidents that don't meet thresholds (wasting authority resources and creating unnecessary scrutiny) or failing to report incidents that do meet thresholds (non-compliance). Impact: Authority fatigue, credibility loss, or regulatory penalties. Solution: Clear reporting thresholds documented in procedures, legal review of borderline cases, regular training on reporting requirements.

Poor Evidence Preservation

Pitfall: Failing to preserve evidence in a forensically sound manner, compromising investigation and legal proceedings. Impact: Evidence inadmissibility, failed prosecutions, regulatory criticism, inability to prove claims. Solution: Forensic evidence handling procedures, chain of custody protocols, trained staff, legal counsel oversight, use of certified forensic tools.

Lack of Board/Executive Awareness

Pitfall: Authority engagement treated as purely operational, without board-level awareness or strategic alignment. Impact: Insufficient resource allocation, missed strategic implications, inadequate executive support during crises. Solution: Board-level reporting on authority engagement, executive briefing on regulatory landscape, strategic risk discussions including authority relationships.

Single Point of Failure

Pitfall: Only one person knows authority contacts and procedures, creating vulnerability if that person is unavailable. Impact: Inability to report during incidents, compliance failures, response delays. Solution: Primary and backup liaisons for all authorities, documented procedures accessible to incident response team, cross-training on authority engagement.

Ignoring Local Authorities

Pitfall: Focusing only on national bodies (CERT-In, NCIIPC) while neglecting state police, state CERTs, and local bodies. Impact: Delayed local law enforcement response, missed localized threat intelligence, incomplete regulatory coverage. Solution: Complete authority inventory including all levels of government, state-specific registration and contact, participation in local cybersecurity initiatives.

Treating Engagement as a Checkbox

Pitfall: Going through the motions of registration and reporting without genuine engagement or strategic value extraction. Impact: Missed intelligence, superficial relationships, audit findings on engagement effectiveness. Solution: Active participation in workshops, proactive intelligence sharing, relationship building, feedback provision, genuine contribution to government initiatives.

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Indian Private Sector Bank, RBI and CERT-In Coordination During Nation-State APT Campaign

Organization: Large private sector bank with 10,000+ employees, 2,000 branches, significant international operations Sector: Banking and Financial Services Challenge: The bank detected sophisticated, long-term APT activity targeting its SWIFT infrastructure and international payment systems. The attack appeared to be nation-state sponsored, with tactics consistent with known APT groups targeting financial institutions in South Asia.

Pre-Incident Engagement:

• The bank had maintained active engagement with RBI's CSITE cell and IB-CART since 2019
• Participated in RBI's annual cyber drills and exercises
• Maintained formal liaison with CERT-In, including quarterly coordination calls
• Registered with the state police cybercrime cell in Mumbai (headquarters location)
• Had legal counsel with specific expertise in cybercrime and financial regulations
• Conducted semi-annual tabletop exercises including authority coordination scenarios

Incident Timeline:

Day 1 (Detection):

• SOC detected anomalous SWIFT gateway activity at 02:30 AM
• Incident Response team activated within 30 minutes
• CISO notified at 03:00 AM
• By 04:00 AM, preliminary analysis confirmed APT activity with nation-state indicators
• CISO decided to activate authority coordination at 04:30 AM

Day 1 (Authority Coordination):

• 05:00 AM: Contacted CERT-In through the 24/7 incident hotline (pre-established contact)
• 05:30 AM: Notified RBI (CSITE) and CERT-In through the designated channels
• 06:00 AM: Engaged legal counsel for reporting strategy and privilege protection
• 07:00 AM: Contacted Mumbai Police Cybercrime Cell for investigation support
• 08:30 AM: Submitted initial incident report to CERT-In (within 6-hour window for designated entities)
• 09:00 AM: Submitted regulatory notification to RBI with initial assessment
• 10:00 AM: CERT-In coordinated with international partners (through FIRST membership) to share IOCs
• 11:00 AM: RBI provided guidance on customer communication and operational continuity

Day 1–3 (Response and Investigation):

• CERT-In provided technical assistance and threat intelligence on the specific APT group
• RBI coordinated with other banks to check for similar activity (sector-wide protection)
• Mumbai Police initiated investigation and evidence collection
• International law enforcement (FBI, NCA) was engaged through government channels
• The bank preserved evidence with full chain of custody, supported by forensic specialists
• Legal counsel managed privilege and disclosure considerations throughout

Outcome:

• The APT activity was contained within 72 hours
• No fraudulent SWIFT transfers were executed (the detection was early enough)
• The bank's swift response and authority coordination was praised by RBI in a subsequent sector briefing
• No regulatory penalties were imposed, the bank was viewed as a model for incident response
• The bank's relationships with authorities were strengthened, leading to priority intelligence sharing in subsequent months
• Two bank employees were later invited to speak at CERT-In and RBI workshops on incident response

Key Success Factors:

• Pre-established relationships eliminated the relationship-building delay during crisis
• 24/7 contact methods worked as planned, all authorities responded within expected timeframes
• Legal counsel involvement from the outset protected privilege and managed disclosure
• RBI coordination enabled sector-wide protection, preventing peer banks from being victimized
• Evidence handling procedures ensured legal admissibility for potential prosecution
• Board and executive awareness ensured resource availability and strategic decision support

Lessons Learned:

• The 6-hour reporting window is tight but achievable with pre-established procedures
• Authority coordination during complex incidents requires dedicated staff, not just ad-hoc attention
• International coordination requires government channels, direct law enforcement contact is insufficient for cross-border cases
• Post-incident, the bank expanded its authority engagement program to include NCIIPC and international coordination channels

Illustrative Scenario 2: Indian Health Tech Startup, DPDP Act Preparation Through Regulatory Engagement

Organization: Health tech startup (150 employees) providing telemedicine and patient data management platform to 500+ hospitals and clinics across India Sector: Healthcare / Information Technology Challenge: The Digital Personal Data Protection Act (DPDP Act) was passed in 2023, creating significant uncertainty about compliance requirements, breach notification timelines, and regulator expectations. The organization needed to prepare for implementation while the regulatory framework was still being operationalized.

Engagement Strategy:

• The startup's Compliance Officer and CISO (external consultant) decided on proactive regulatory engagement rather than waiting for formal rules
• Joined DSCI's DPDP Act working group and consultation sessions in 2023–2024
• Participated in MeitY's stakeholder consultations on DPDP rules
• Engaged with the proposed Data Protection Board through DSCI's liaison
• Maintained contact with CDSCO on medical data protection requirements
• Registered with CERT-In for advisory and incident reporting
• Participated in NABH's cybersecurity consultations for hospital accreditation

Journey:

Phase 1: Intelligence Gathering (Months 1–3)

• Through DSCI consultations, the team gained early visibility into expected breach notification timelines (likely 72 hours for initial notification)
• Learned that the Data Protection Board would expect specific categories of documentation for breach reports
• Understood that the final DPDP Act has no separate "sensitive" category, but that health-sector rules (ABDM, Clinical Establishments) still add requirements for medical data
• Identified that consent management would be a major compliance area requiring platform redesign
• Cost of this intelligence: (DSCI membership + workshop attendance) vs. estimated + for equivalent consultant research

Phase 2: Implementation Preparation (Months 4–6)

• Used DSCI's DPDP Act readiness framework (shared with members) to conduct a gap assessment
• Implemented technical controls informed by regulatory expectations: encryption, access logging, data retention limits, consent management
• Redesigned patient data platform to include automated breach detection and notification workflows
• Prepared breach notification templates based on DSCI's shared guidance
• Trained clinical and technical staff on DPDP Act requirements using DSCI training materials
• Documented all processing activities in a format informed by regulatory consultation inputs

Phase 3: Readiness and Competitive Advantage (Months 7–9)

• When the Data Protection Board's draft rules were published, the organization had already implemented 80% of expected requirements
• The startup was able to market itself as "DPDP Act ready" to hospital clients
• A competitor (without similar engagement) was scrambling to implement controls after the rules were published, losing a major client to this startup
• The organization was invited to speak at a DSCI conference on "DPDP readiness for health tech", enhancing brand positioning
• When the first CERT-In advisory on health sector data breaches was issued, the organization was already compliant with the recommended controls

Outcome:

• Industry positioning: Recognized as a thought leader in health data protection
• Investor confidence: Series B investors specifically cited regulatory readiness as a factor in investment decision

Key Success Factors:

• Proactive engagement before regulations were finalized allowed influence and preparation
• DSCI membership provided structured guidance and peer learning
• Technical implementation was informed by regulatory expectations, not generic best practices
• The organization balanced compliance preparation with business opportunity capture
• Regulatory engagement was treated as a strategic investment, not just a compliance cost

Lessons Learned:

• Regulatory engagement during formulation (not just after implementation) provides massive competitive advantage
• Industry associations (DSCI) provide structured guidance that individual consultant research cannot match
• Health tech sector faces dual regulatory pressure (health + data protection) requiring coordinated engagement
• Early preparation allows marketing of compliance as a competitive differentiator
• The cost of proactive engagement is 5–10x lower than reactive compliance

Multi-Framework Mapping

NIST CSF 2.0 Mapping

PCI DSS v4.0.1 Mapping

SOC 2 Type II Mapping

COBIT 2019 Mapping

CIS Controls v8 Mapping

RBI Cybersecurity Framework Mapping

SEBI CSCRF Mapping

DPDP Act 2023: Relevant Provisions

---|---| | Section 8(5) Reasonable security safeguards | Protect personal data through the safeguards in this control |

Regulatory and Compliance Context

Indian Legal Framework for Authority Engagement

Information Technology Act, 2000 (as amended)

• Section 70B: Establishes CERT-In and empowers it to issue directions, collect information, and coordinate incident response
• Section 69: Government powers to intercept, monitor, or decrypt information (relevant for incident investigation coordination)
• Section 69A: Government powers to block public access to information
• Section 70: Protected system designation and penalties for unauthorized access
• Section 43A: Compensation for failure to protect sensitive personal data or information (in force until DPDP Act s.44(2) commences, about May 2027)
• Section 66: Computer-related offenses (hacking, data theft), requires police reporting

CERT-In Directions under section 70B(6) of the IT Act (28 April 2022)

• Mandatory reporting of 20 categories of cybersecurity incidents within 6 hours
• Applies to all service providers, intermediaries, data centres, body corporates and government organisations
• Requires maintenance of ICT logs for 180 days
• Requires synchronization of ICT system clocks
• Designates CERT-In as the central reporting authority

Digital Personal Data Protection Act, 2023

• Establishes the Data Protection Board of India; the DPDP Rules 2025 were notified in November 2025, and most fiduciary duties apply from about May 2027
• Will require data breach notification to the Board and affected data principals
• Mandates appointment of Data Protection Officers for significant data fiduciaries
• Penalties up to s for data breaches (depending on severity and category)
• Authority engagement will be essential for compliance and breach response

NCIIPC Framework

• Established under Section 70A of the IT Act
• Designates and protects Critical Information Infrastructure
• Mandates coordination with CII entities for protection, incident response, and risk management
• Issues sectoral guidelines and advisories
• Conducts exercises and capacity-building programs

Sectoral Regulatory Requirements

Law Enforcement and Cybercrime Reporting

National Cybercrime Reporting Portal (cybercrime.gov.in)

• Citizen and organizational reporting of cybercrime
• 1930 helpline for cybercrime reporting
• I4C (Indian Cybercrime Coordination Centre) for national coordination

Police Cybercrime Structure:

• National Level: CBI Cybercrime Division, NIA (for cyberterrorism), I4C
• State Level: State Cybercrime Cells, State Crime Investigation Departments
• District Level: District Cybercrime Cells, Economic Offences Wings
• Local Level: Police Station cybercrime handling, specialized cybercrime police stations in major cities

Reporting Triggers:

• Criminal hacking or unauthorized access
• Data theft with criminal intent
• Financial fraud involving cyber elements
• Ransomware with extortion
• Cyberstalking, harassment, or threats
• Child sexual abuse material (CSAM)
• Cyberterrorism or threats to national security
• Intellectual property theft through cyber means

International Considerations

Organizations with international operations must consider:

• GDPR: Data breach notification to supervisory authorities within 72 hours (for EU data subjects)
• UK Data Protection Act: Similar breach notification requirements
• US State Laws: Varying breach notification requirements (e.g., California CCPA/CPRA)
• APAC Regulations: Singapore PDPA, Australia Privacy Act, Japan APPI
• Cross-Border Coordination: Mutual Legal Assistance Treaties (MLATs) for international cybercrime investigation
• International Law Enforcement: Interpol, Europol, FBI (for US-related matters), NCA (UK)

RACI Matrix

Authority Engagement Activities RACI

R = Responsible, A = Accountable, C = Consulted, I = Informed

Documentation and Record Keeping

Suggested Records

ISO 27001 sets no retention periods. The periods below are examples; set yours from legal, contractual and DPDP erasure obligations.

Record Keeping Best Practices

• Legal Privilege: Mark and protect documents that may be subject to legal privilege or litigation hold
• Access Control: Restrict access to incident reports, evidence logs, and sensitive correspondence
• Version Control: Maintain version history for all policies and procedures
• Audit Trail: Ensure all authority interactions are logged with timestamps and participants
• Backup: Authority engagement records are critical for compliance and should be backed up with appropriate retention
• Cross-Border Considerations: Organizations with international operations must maintain records for multiple jurisdictions
• RTI Exposure: Be aware that information shared with government may be subject to Right to Information (RTI) requests
• DPDP Act Compliance: Ensure record keeping for personal data breaches aligns with upcoming Data Protection Board requirements

Continuous Improvement

Figure · Tiers

Maturity levels for contact with authorities

Maturity Model for A.5.5

Improvement Cycle

Plan:

• Annual authority engagement strategy review
• Regulatory horizon scanning and impact assessment
• Authority relationship health assessment
• Benchmarking against peer organizations and sector leaders

Do:

• Implement new authority registrations and relationships
• Enhance reporting workflows and automation
• Increase proactive engagement and consultation participation
• Upgrade evidence handling and forensic capabilities
• Expand legal counsel cybersecurity expertise

Check:

• Quarterly compliance metric reviews
• Annual regulatory audit preparation and review
• Post-incident authority coordination assessment
• Staff feedback and training effectiveness evaluation
• Peer benchmarking and competitive positioning

Act:

• Update authority inventory based on regulatory changes
• Enhance procedures based on exercise findings and incident lessons
• Invest in tools and capabilities that improve engagement efficiency
• Expand engagement scope based on organizational growth and sector changes
• Report improvement progress to board and executive leadership

Frequently Asked Questions

Q1: Is A.5.5 mandatory for ISO 27001 certification?

A: Not automatically. No Annex A control is mandatory. Under clause 6.1.3 you choose the controls your risk assessment calls for, then record A.5.5 in your Statement of Applicability as included (and how) or excluded (and why). For most organizations, A.5.5 is included because virtually every organization has some authority with jurisdiction (CERT-In, police, tax authorities, or sector regulators). Only organisations with genuinely no relevant authorities could justify excluding it, which is very rare in India.

Q2: Do we need to report every security incident to CERT-In?

A: You must report every incident that falls within the 20 categories in Annexure I of the CERT-In Directions (28 April 2022), within 6 hours of noticing it. The Directions apply to all service providers, intermediaries, data centres, body corporates and government organisations, so almost every Indian company is covered; there is no size threshold. Incidents outside those categories need not be reported to CERT-In, though voluntary reporting is welcome.

Q3: What is the difference between CERT-In and NCIIPC?

A: CERT-In is the national incident response agency for all cybersecurity matters, open to all organizations. NCIIPC specifically protects Critical Information Infrastructure (CII), designated systems in sectors like energy, banking, telecom, transport, government, and defense. NCIIPC engagement is mandatory only for CII entities. Both may be relevant for CII organizations, which must report to both.

Q4: How do we handle conflicting requirements from different authorities?

A: This is common. For example, a bank may need to report to both CERT-In (within 6 hours) and RBI (with different timelines). The solution is to: (1) document all requirements in a consolidated matrix, (2) prioritize the shortest timeline, (3) use legal counsel to navigate conflicts, (4) communicate proactively with authorities about multi-reporting. In practice, most organizations create a single report that satisfies multiple authorities, with minor customizations.

Q5: Can authority engagement expose us to regulatory penalties?

A: Properly managed engagement reduces penalties by ensuring compliance. However, improper engagement, such as sharing information that reveals non-compliance, or failing to follow legal procedures, can create exposure. The solution is to involve legal counsel in all significant authority interactions, follow documented procedures, and maintain privilege where possible. Remember: authorities already have enforcement power, engagement is about managing that relationship, not avoiding it.

Q6: What if we cannot meet a 6-hour reporting deadline?

A: The 6-hour deadline applies to initial reporting, which can be brief and factual. You don't need a complete investigation report within 6 hours, just notification that an incident has occurred, with basic details. Prepare a template with pre-filled organizational information so you only need to add incident-specific details. If you genuinely miss the deadline, report as soon as possible with an explanation. Repeated failures may attract penalties, but occasional delays with good cause are usually understood.

Q7: Should we engage with state authorities or just national bodies?

A: Both. National bodies (CERT-In, NCIIPC) provide strategic intelligence and coordination. State authorities (state police, state CERTs) provide localized response and may be faster for local incidents. For organizations with multi-state presence, maintain contacts in all relevant states. Some incidents (e.g., local cybercrime) are better handled by state police than national agencies.

Q8: How do we preserve legal privilege while engaging with authorities?

A: Legal privilege is complex in Indian law. Best practices: (1) involve legal counsel from the outset of incident response, (2) mark privileged communications clearly, (3) use separate legal counsel for regulatory compliance vs. litigation defense, (4) understand that privilege may be waived if information is shared too broadly, (5) document privilege claims. Work with Indian legal counsel experienced in cybersecurity and regulatory matters.

Q9: What is the cost of non-compliance with authority engagement requirements?

A: Under the IT Act, failure to comply with CERT-In directions can result in imprisonment up to 1 year and/or fines. RBI can impose monetary penalties and business restrictions for non-compliance. SEBI can impose penalties, suspend trading licenses, or initiate enforcement. DPDP Act (when fully operationalized) will have penalties up to s. Beyond direct penalties, non-compliance damages reputation, customer trust, and insurance coverage.

Q10: How do we balance authority transparency with business confidentiality?

A: Be transparent about security incidents and compliance status without revealing commercially sensitive information. Share technical indicators and compliance facts, not business strategy or competitive intelligence. Use legal review to ensure that shared information is appropriate. Remember that authorities are primarily interested in security and compliance, not your business model. When in doubt, share less and seek legal advice.

Q11: Can we use third parties (like Singahi) to manage authority engagement?

A: Yes, but with caveats. Third parties can help with preparation, documentation, and advisory, but the organization remains legally responsible for compliance. Authority registration and formal reporting should generally be done in the organization's own name (not the consultant's). Third parties can support incident response coordination, but the organization's liaison should be the primary contact. Think of third-party support as "advisory and preparation," not "outsourced authority relationship."

Q12: How do we prepare for the DPDP Act's data breach notification requirements?

A: The DPDP Rules 2025 were notified in November 2025 and the breach-intimation duty applies from about May 2027. Prepare now: (1) track DPDP Act rule developments through DSCI and MeitY consultations, (2) implement breach detection and notification workflows, (3) prepare breach notification templates, (4) establish legal review processes for breach notifications, (5) train staff on data breach response, (6) engage with the Data Protection Board (when operational) through formal channels. Early preparation will be a significant competitive advantage.

Q13: What should we do if an authority does not respond to our incident report?

A: First, ensure the report was submitted through the correct channel with acknowledgment. Follow up after 24 hours via alternative channels (phone, email, secondary contact). Document all follow-up attempts. If the incident is severe, escalate through the authority's hierarchy or sector regulator. For critical incidents, consider reaching out through industry associations (e.g., Banking-ISAC for RBI coordination). Maintain professionalism and patience, authorities are often under-resourced.

Q14: How do we handle authority requests for information beyond incident reporting?

A: Authorities may request information for surveys, investigations, or policy development. Evaluate each request: (1) Is there a legal basis for the request? (2) What is the scope and sensitivity? (3) Can we provide the information without exposing confidential data? (4) Should legal counsel review before sharing? (5) Can we negotiate scope or timing? Always respond professionally, but protect organizational interests. If a request is overly broad or inappropriate, seek legal advice before responding.

Q15: How do international organizations handle Indian authority engagement?

A: International organizations operating in India must comply with Indian authority requirements regardless of their global headquarters. Establish a dedicated Indian authority engagement program, register with CERT-In, comply with sector-specific requirements, and maintain local legal counsel. International holding companies should be aware that Indian subsidiaries may need to report incidents that affect parent company systems. Cross-border incident reporting requires coordination between Indian and international authorities (often through MLATs or CERT bilateral agreements).

The following toolkit assets are available for this control:

References and Further Reading

Standards and Frameworks

• ISO/IEC 27001:2022, Information Security, Cybersecurity and Privacy Protection, Information Security Management Systems, Requirements
• ISO/IEC 27002:2022, Information Security, Cybersecurity and Privacy Protection, Information Security Controls
• NIST Cybersecurity Framework 2.0 (2024)
• NIST SP 800-61, Computer Security Incident Handling Guide
• NIST SP 800-150, Guide to Cyber Threat Information Sharing

Indian Legal and Regulatory References

• Information Technology Act, 2000 (as amended through 2008)
• CERT-In Directions under section 70B(6) of the IT Act, 28 April 2022
• Digital Personal Data Protection Act, 2023
• RBI Cyber Security Framework in Banks (2016) and Master Direction on IT Governance, Risk, Controls and Assurance Practices (2023)
• SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, circular of 20 August 2024
• IRDAI Information and Cyber Security Guidelines, 2023
• NCIIPC Guidelines for Protection of Critical Information Infrastructure
• Indian Telegraph Act (for telecom security requirements)
• Companies Act, 2013 (for corporate governance and data protection obligations)

Government Resources

• CERT-In, cert-in.org.in
• NCIIPC, nciipc.gov.in
• National Cybercrime Reporting Portal, cybercrime.gov.in
• MeitY, meity.gov.in
• RBI, rbi.org.in
• SEBI, sebi.gov.in
• IRDAI, irdai.gov.in
• TRAI, trai.gov.in
• CDSCO, cdsco.gov.in
• CEA, cea.nic.in
• DoT, dot.gov.in
• MHA, mha.gov.in
• BIS, bis.gov.in

Industry and Academic Sources

• DSCI, Data Security Council of India, dsci.in
• IDRBT, Institute for Development and Research in Banking Technology
• C-DAC, Centre for Development of Advanced Computing
• NASSCOM, nasscom.in
• CII, cii.in
• FICCI, ficci.in
• ASSOCHAM, assocham.org
• ISACA India, isaca.org

International References

• FIRST, Forum of Incident Response and Security Teams, www.first.org
• Interpol Cybercrime, www.interpol.int
• Europol EC3, www.europol.europa.eu
• ENISA, European Union Agency for Cybersecurity, www.enisa.europa.eu
• AP-CERT, Asia Pacific CERT Community

Document Control

• Version: 1.0
• Author: Singahi, ISO 27001 Implementation Experts
• Review Cycle: Quarterly (for regulatory changes) + Annual (complete)
• Next Review: June 2027
• Classification: TLP:CLEAR, Public Information