☁️ Sandip Wadje

Top 5 takeaways from #SecEthos25 ISC2 Pune Chapter Cyber security conclave on 6 Dec 2025. 1. Knowing vs doing: Knowing observstions and reporting to right stakeholders is only 50% work. Real risk mitigation is when timely and correct closure of the observations happens. 2. Focus on basics: While we talk about AI and all enhancements in Cyber, most of attacks are still because we lack the basics like 2FA, WAF configuration. 3. Data Privacy: It is all about common sense. The sooner organizations start taking serious action points, better it is. 4. Privacy Paradox: Needs for AI and data privacy are mutually contradicting. Right balance is the key to success. 5. Role of CISO: It is is rather strategic than operational. CISOs need to speak business language and have right set of structures to get out of operational fatigue.

19

India’s Cyber Rulebook: What’s Coming & What to Do Now Q&A | Executive Cyber Brief Regulators are tightening expectations across markets, banking, incident reporting, supply chain, and AI. Compliance readiness is now a board-level discipline. Q: What cyber regulations should we be preparing for? A: • SEBI CSCRF (Cybersecurity & Cyber Resilience Framework): Consolidated framework for SEBI-regulated entities, mandates 24×7 monitoring, stronger change control, periodic Red Teaming, and board-level oversight. • RBI on critical systems & resilience: Reinforced requirements for resilience, third-party/outsourcing oversight, & recovery planning, with explicit focus on critical information systems. • CERT-In Directions: Six-hour incident reporting, 180-day log retention within India, time sync, and structured reporting templates. • SBOM & CBOM: Focus on Software & Cryptographic Bill of Materials and to manage supply-chain and crypto risk including algorithms, keys, certificates, and protocol details. • AI Governance (emerging): MeitY is working toward an AI framework, expect requirements on model risk, explainability, data lineage, human-in-loop, and deepfake safeguards. • Digital India Act (proposed): Will replace the IT Act, 2000. Expect refreshed obligations around digital platforms, cyber safety, accountability, and liabilities. (DPDP Act, 2023 is law, rules under consultation in 2025). Q: Why is this a leadership issue? A: Regulators are tying operational resilience to executive accountability. Leadership must be able to show they asked the right questions, got tested answers, and acted on gaps. Q: What should senior leadership do now? A: The role of leadership is not to memorize regulation — but to ask the right oversight questions and demand evidence-backed answers. Leadership should focus on: • Preparedness: “Can we demonstrate compliance today — and not just on paper?” Expect tested playbooks, logs, and evidence of resilience drills. • Speed: “If an incident occurs, can we meet regulators’ timelines (6-hour reporting, board attestation, critical system recovery)?” Expect rehearsed reporting and disclosure protocols. • Accountability: “Who owns each obligation — and how does the board get visibility?” Expect clear lines of responsibility, with regular reporting of gaps and remediation. • Future readiness: “How are we preparing for AI and the Digital India Act?”Expect registries, risk frameworks, and board updates on evolving obligations. Bottom Line: Senior leaders don’t need the technical manual — they need confidence that management has one, has tested it, and can prove it. Asking sharper questions ensures the board stays ahead of regulators, not behind them. Your Turn: Are there other regulations you believe Senior Leadership should keep on their radar? And what’s the one action you think they should take today to stay ahead? #CyberSecurity #DigitalTrust #WhatsInIt4Me #UmaRamani

91

5 Comments