CERT-In, SEBI and IRDAI each require an incident to be reported within six hours. RBI requires prompt reporting too, and the DPDP Act adds breach obligations and penalties. In every case, the regulator wants the same answers: which systems were affected, who owns them, what you knew, and what you did about it.
Six hours is not enough time to work out which application a server belongs to, which business service it supports, or who is accountable for it. That map has to exist before the incident. Building it is what Klair Vu does every day.
Report cyber incidents from the time they are noticed. Keep ICT logs for 180 days, within India.
Regulated entities report cyber incidents to SEBI, in line with the CERT-In timeline.
Insurers report incidents to CERT-In and IRDAI. Logs are retained in India.
A detailed personal-data breach report to the Data Protection Board, after notifying affected people without delay.
Klair Vu is exposure management, not a SOC. It doesn't detect intrusions or file incident reports for you. What it does is build and maintain the context those reports depend on. It also closes the exposures that become incidents in the first place.
Scheduled commercial banks, urban co-operative banks (graded by level), NBFCs. Includes the 2016 framework for banks, the UCB framework, and the 2023 Master Direction on IT Governance, Risk, Controls and Assurance.
Service providers, intermediaries, data centres, body corporates and government organisations. In practice, almost every organisation operating in India.
SEBI-regulated entities, from market infrastructure institutions to mid-size and small intermediaries. Each category has graded obligations. The top 1,000 listed companies also carry risk-committee duties under LODR Regulation 21.
Insurers, and intermediaries within the guidelines' scope.
Every organisation that processes digital personal data in India. Under the DPDP Rules, 2025, most obligations take effect 18 months after notification, around May 2027.
Storing data in India is necessary, but it isn't the whole answer. A regulator, and a careful board, will also ask who can operate the system, who holds the keys, and whether anything leaves the country. Here is where we stand on each.
On-premise or air-gapped: on your hardware, in your data centre. SaaS hosted in India is on the roadmap.
On-premise, your team operates it. Licensing works offline, so the vendor has no access path into your deployment.
On-premise, you generate the key that encrypts connector credentials. We never see it. Bring-your-own-key for SaaS is on the roadmap.
Not by default. Correlation, scoring and dashboards never use AI. AI features only reach an external model if your administrator adds a key, and personal data and secrets are stripped from the text first. Threat-model AI can run on a local model you host. Local-model support for the AI assistant is on the roadmap.
Strict per-tenant data isolation. Every tenant's data is kept strictly separate, and the audit trail is tamper-evident. Both are tested on every release; architecture details are available under NDA.
Marked plainly. Anything marked available can be shown in a live console. Anything on the roadmap, we will tell you so before you ask.
| Framework or capability | Status |
|---|---|
| RBI cyber security framework for UCBs: control mapping | Available |
| ISO 27001, NIST CSF, SOC 2, PCI DSS, HIPAA: control mapping | Available |
| Asset → application → business unit → owner register | Available |
| Tamper-evident audit trail; strict per-tenant data isolation | Available |
| On-premise and air-gapped deployment | Available |
| AI features off by default; external model only with an admin-supplied key, with personal data and secrets stripped from the text | Available |
| Threat-model AI on a self-hosted model (Ollama or your own endpoint) | Available |
| Personal-data tagging of applications for DPDP | Partial |
| RBI commercial-bank framework and IT Governance Master Direction mapping | Roadmap |
| SEBI CSCRF, IRDAI, DPDP control mapping | Roadmap |
| AI assistant and Ask on a self-hosted model | Roadmap |
| CERT-In incident-report template | Roadmap |
| SaaS hosted in India; bring-your-own-key for SaaS | Roadmap |
Last reviewed 3 October 2026. This page summarises public regulatory texts to explain how our product relates to them. It is not legal advice, and regulations change. Always confirm your obligations against the current text and with your compliance team.
See your estate mapped to owners and business services, and where you stand against your regulator, in a 45-minute session.