Most breaches still begin with a person: a phishing click, a reused password or a convincing call from someone pretending to be the CEO. Frameworks such as ISO 27001, CERT-In guidelines and the SEBI and RBI cyber security frameworks all expect regular security awareness training.
We offer the course in three formats: a full course, a short version for busy teams and an annual refresher. The articles below cover the threats employees face now, including AI voice clones and deepfake social engineering.
Quick answer
Indian law requires organisations to keep reasonable security practices (IT Act s.43A, DPDP Act s.8(5)) and to report listed cyber incidents to CERT-In within 6 hours. There is no general statutory training mandate, but SEBI's CSCRF requires an annual cybersecurity training programme and RBI expects a security awareness culture in banks and NBFCs.
Cyber Security Awareness Training courses
Information Security Awareness
Phishing, data handling, password hygiene, device security, and incident reporting best practices for all employees.
Information Security Awareness Short Version
Core security risks and essential practices for employees to stay safe and compliant in a shorter format.
Information Security Awareness Refresher
Annual refresher covering new threat vectors, updated security policies, and reinforcement of core information security practices.
What the law requires
Information Technology Act, 2000: sections 43A, 72A and 70B
Section 43A of the Information Technology Act, 2000 makes a body corporate that possesses, deals with or handles sensitive personal data or information in a computer resource liable to pay compensation if it is negligent in implementing and maintaining "reasonable security practices and procedures" and that causes wrongful loss or gain to any person. Section 44(2)(a) of the Digital Personal Data Protection Act, 2023 omits section 43A once that provision is brought into force.
Section 72A makes it an offence for a person, including an intermediary, who has accessed personal information while providing services under a lawful contract to disclose it without consent or in breach of the contract, with intent to cause or knowing it is likely to cause wrongful loss or gain.
Section 70B establishes the Indian Computer Emergency Response Team (CERT-In) as the national agency for cyber incident response. Under section 70B(6), CERT-In may call for information and give directions to service providers, intermediaries, data centres, body corporates and any other person.
CERT-In Directions of 28 April 2022 (section 70B(6))
The CERT-In Directions of 28 April 2022 apply to service providers, intermediaries, data centres, body corporates and Government organisations. They require these entities to report the cyber incidents listed in Annexure I (which include phishing, unauthorised access, ransomware and other malicious code, data breaches and data leaks) to CERT-In within 6 hours of noticing them or being told about them.
The Directions also require all ICT system clocks to be synchronised to NIC or NPL time servers (or sources traceable to them), a designated Point of Contact for CERT-In, and logs of all ICT systems to be kept securely for a rolling 180 days within Indian jurisdiction and provided to CERT-In on incident reporting or on request. The Directions took effect 60 days after issue.
RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices (2023)
The RBI Master Direction dated 7 November 2023, in effect from 1 April 2024, applies to commercial banks (excluding Regional Rural Banks), Top, Upper and Middle Layer NBFCs, Credit Information Companies and the All India Financial Institutions. Paragraph 7(a) requires senior management to create "a culture of IT risk awareness and cyber hygiene practices", and paragraph 24(b) gives the Information Security Committee responsibility for approving and monitoring security awareness initiatives.
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), 2024
SEBI's CSCRF circular of 20 August 2024 (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113) applies to SEBI regulated entities. Its Awareness and Training standard (PR.AT) requires mandatory cybersecurity, cyber resilience and system hygiene awareness programmes for employees, updated as new threats emerge, with a dedicated programme for Board members. The framework's periodicity table sets the cybersecurity training programme (PR.AT.S1) as annual for all regulated entities, and its guidelines call for phishing awareness and, where possible, extending training to outsourced staff and third-party service providers.
Digital Personal Data Protection Act, 2023: section 8(5)
Section 8(5) of the DPDP Act requires every Data Fiduciary to protect personal data, including data processed by its Data Processors, by taking reasonable security safeguards to prevent a personal data breach. Rule 6 of the DPDP Rules 2025 lists the minimum safeguards, including "appropriate technical and organisational measures", and applies from 13 May 2027. See our DPDP Act training guide for detail.
Who must be trained and how often
The IT Act and the CERT-In Directions do not prescribe staff training or its frequency. They set outcomes, such as reasonable security practices and incident reporting within 6 hours, that depend on employees recognising and escalating incidents quickly.
Sector rules go further. SEBI regulated entities must run a cybersecurity training programme annually under CSCRF, with a separate programme for Board members. RBI regulated entities must build a culture of IT risk awareness and have their Information Security Committee oversee awareness initiatives, but the Master Direction does not fix a frequency. Outside these sectors, common practice is training at induction and an annual refresher for everyone with system access, plus phishing simulations during the year.
| Organisation type | Source | Training expectation |
|---|---|---|
| SEBI regulated entities | CSCRF 2024, PR.AT | Mandatory awareness programmes; annual cybersecurity training programme; dedicated Board programme |
| Banks, larger NBFCs, CICs, AIFIs | RBI IT Governance Master Direction 2023, paras 7 and 24 | Culture of IT risk awareness and cyber hygiene; ISC monitors awareness initiatives (no frequency set) |
| All body corporates | IT Act s.43A, CERT-In Directions, DPDP Act s.8(5) | No training mandate; common practice is induction plus annual refresher |
Penalties and consequences
| Breach | Provision | Consequence |
|---|---|---|
| Negligence in reasonable security practices causing wrongful loss or gain (sensitive personal data) | IT Act s.43A | Liability to pay damages by way of compensation to the person affected |
| Disclosing personal information obtained under a lawful contract without consent or in breach of contract | IT Act s.72A | Imprisonment up to 3 years, or fine up to ₹5 lakh, or both |
| Failing to provide information to CERT-In or comply with its directions (including the 6-hour reporting and 180-day log retention) | IT Act s.70B(7) | Imprisonment up to 1 year, or fine up to ₹1 lakh, or both |
| Failing to take reasonable security safeguards to prevent a personal data breach | DPDP Act s.8(5), Schedule item 1 | Penalty up to ₹250 crore |
RBI and SEBI can also take supervisory action against their regulated entities for non-compliance with their directions and circulars.
What good Cyber Security Awareness training covers
- Recognising phishing, spear-phishing, smishing and voice or deepfake impersonation, including CEO and vendor payment fraud
- Reporting a suspected incident internally at once, and why: CERT-In's 6-hour reporting window starts when the incident is noticed
- Password hygiene, multi-factor authentication and never sharing one-time passwords
- Classifying and handling data, especially personal and sensitive personal data under the IT Act and DPDP Act
- Safe use of email, cloud storage, removable media and file sharing, including shadow IT and unapproved AI tools
- Device security for laptops and mobiles, remote and hybrid work, and public Wi-Fi
- Not disabling logging, time synchronisation or security tools that support the 180-day log requirement
- Contractor and vendor responsibilities, including confidentiality under s.72A
- Role-specific content for privileged users, IT administrators and senior management
- An annual refresher on new threats and policy changes, with a separate Board briefing where CSCRF applies
Our courses for this topic
| Course | Audience | Duration | Language | Format |
|---|---|---|---|---|
| Information Security Awareness | All Staff | 70 min | English | SCORM eLearning |
| Information Security Awareness Short Version | All Staff | 30 min | English | SCORM eLearning |
| Information Security Awareness Refresher | All Staff | 25 min | English | SCORM eLearning |
Laws & standards covered
- ISO 27001:2022
- CERT-In Guidelines
- IT Act 2000 and IT (Amendment) Act 2008
- SEBI Cyber Security Framework
- ISO 27001 Annual Review Requirements
- CERT-In Cyber Hygiene Guidelines
- RBI/SEBI Cybersecurity Frameworks
Who it's for
- All employees
- Remote and hybrid workers
- Contractors with system access
- New joiners
- All employees who completed the primary Information Security course
- IT and security teams
Guides & insights
Frequently asked questions
Is cyber security awareness training mandatory in India?
There is no general statutory mandate for all companies. SEBI regulated entities must run an annual cybersecurity training programme under CSCRF, and RBI expects banks and larger NBFCs to build a culture of IT risk awareness. For other companies, training is how they show "reasonable security practices" under IT Act s.43A and DPDP Act s.8(5).
Does the 6-hour CERT-In reporting rule apply to ordinary companies?
Yes. The CERT-In Directions apply to "body corporate" as well as service providers, intermediaries, data centres and Government organisations, so a typical private company is covered for the incident types listed in Annexure I.
How does CERT-In reporting interact with DPDP breach reporting?
They are separate duties. A data breach is a reportable incident to CERT-In within 6 hours under the 2022 Directions, and from 13 May 2027 a personal data breach must also be intimated to the Data Protection Board and affected individuals under Rule 7 of the DPDP Rules, with a detailed report within 72 hours.
Should contractors and outsourced staff take the course?
CSCRF guidelines say training should be extended to outsourced staff and third-party service providers wherever possible, and the DPDP Act keeps the Data Fiduciary responsible for its Data Processors. Many organisations therefore include contractors with system access.
Which format should we use: full, short or refresher?
Use the [full course](/courses/information-security-awareness) for new joiners and higher-risk roles, the [short version](/courses/information-security-awareness-short) where time is limited, and the [refresher](/courses/information-security-refresher) each year for staff who completed the full course.
Can training records help in a regulatory inspection?
Records of who completed training, when and on what content are common evidence that awareness programmes exist and are monitored, which RBI and SEBI frameworks expect. The law does not prescribe a specific record format.
Which Cyber Security Awareness Training courses does Compliance at Workplace offer?
Information Security Awareness (70 min, for All Staff); Information Security Awareness Short Version (30 min, for All Staff); Information Security Awareness Refresher (25 min, for All Staff).
Which laws and standards does Cyber Security Awareness Training cover?
ISO 27001:2022; CERT-In Guidelines; IT Act 2000 and IT (Amendment) Act 2008; SEBI Cyber Security Framework; ISO 27001 Annual Review Requirements; CERT-In Cyber Hygiene Guidelines; RBI/SEBI Cybersecurity Frameworks.
Who should take Cyber Security Awareness Training?
All employees, Remote and hybrid workers, Contractors with system access, New joiners, All employees who completed the primary Information Security course, IT and security teams.
Can the Cyber Security Awareness Training be customised to our organisation?
Yes. Every course can be customised to your policies, branding and industry scenarios, and delivered on your LMS as SCORM or on our Compliance Central platform.
Sources
- Information Technology Act, 2000 (updated text, India Code)
- CERT-In Directions under section 70B(6) of the IT Act, 28 April 2022
- RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 7 November 2023
- SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) circular, 20 August 2024
- Digital Personal Data Protection Act, 2023 (MeitY)
Last updated by the Compliance at Workplace Editorial Team.