Is a CBOM mandatory in India?

No single Indian rule mandates a CBOM by that name. Two sectoral regulators bind their entities to maintain a cryptographic asset inventory, which is the same substance under a different label: SEBI's CSCRF for securities-market entities and IRDAI's 2026 guidelines for insurers. Neither uses the term CBOM and neither specifies a format.

What does SEBI's CSCRF require on post-quantum cryptography?

Box Item 7 of the CSCRF circular states that regulated entities 'shall maintain an inventory of cryptographic assets, prioritizing critical assets for Post Quantum Cryptography (PQC) migration.' The circular, SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 of 20 August 2024, is issued under section 11(1) of the SEBI Act 1992 and binds entities across some twenty categories. Compliance timelines were extended to 31 August 2025, a date that has passed.

Does RBI require a cryptographic inventory?

Not yet. RBI has taken a dated, real step without publishing a policy: on 25 May 2026 it constituted an eight-member expert committee called Q-SAFE, convened by Dr. Anil Prabhakar of IIT Madras. A bank reading RBI's own instruments today finds no CBOM or PQC requirement. Banks regulated by RBI but also operating in securities markets may still be caught by SEBI's CSCRF.

Which Indian authority specifies what goes in a cryptographic inventory?

CERT-In, in Technical Guidelines v2.0 of 9 July 2025, and it is the only one. SEBI and IRDAI require the inventory without saying what an entry must contain. CERT-In's tables specify fields per asset type for algorithms, keys, protocols and certificates. The gap worth noting is that CERT-In's document is not binding, so the detailed specification and the binding obligation sit in different instruments.

Are there dated PQC migration deadlines in India?

Only in DST's National Quantum Mission roadmap, which is not itself binding. It sets full PQC adoption for critical infrastructure by 31 December 2029 and for regular enterprises by 31 December 2033, with preparatory and high-priority migration milestones before each. The roadmap is written to be adopted by sectoral regulators rather than enforced by DST.

Has NPCI issued anything on post-quantum cryptography?

No. NPCI's only connection is its MD and CEO's membership of RBI's Q-SAFE committee, which is participation in someone else's process rather than an NPCI instrument. The same is true of NCIIPC, which appears in DST's roadmap as an ecosystem participant but has issued nothing of its own.

If I comply with CERT-In's guidelines, am I compliant with SEBI and IRDAI?

Probably in substance, but that is an inference rather than a stated equivalence. Neither SEBI nor IRDAI names CERT-In's guidelines or any format, so no regulator has said that following them discharges the obligation. CERT-In's tables are the most detailed Indian specification available to fill a gap the binding rules leave open, which is a weaker claim than compliance.

sbomcbomindiasebirbiirdaicert-incompliance

Who Actually Requires a Cryptographic Inventory in India: SEBI, IRDAI, RBI, CERT-In and TEC Compared

Four Indian authorities have published something on cryptographic inventory and one has not. Only two of them bind anyone, neither of those two specifies a format, and the one with the detailed format specification is not binding. Here is the map, with the circular numbers.

PQC Security EditorialOctober 1, 20266 min read

"Does India require a CBOM?" has no clean answer, because the authority with the detailed specification is not the authority that binds you, and the ones that bind you do not say what to produce.

Four Indian bodies have published something relevant. Two of them create obligations. Neither of those two tells you what the artefact should contain. Here is the map.

The two that bind

SEBI is the clearest. Circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, the Cybersecurity and Cyber Resilience Framework, dated 20 August 2024, is issued under section 11(1) of the SEBI Act 1992 and binds regulated entities across roughly twenty categories. Box Item 7 states that REs "shall maintain an inventory of cryptographic assets, prioritizing critical assets for Post Quantum Cryptography (PQC) migration."

Two caveats sit on that sentence. The box introduces its contents as "indicative measures," which softens the clause relative to the numbered Standards elsewhere in the framework. And compliance timelines were extended to 31 August 2025 for most entities, so for a securities-market entity this is a date that has already passed rather than one to plan toward.

IRDAI arrived later and, in one respect, harder. Its Information and Cyber Security Guidelines 2026, issued 6 April 2026, add Control 110 under Asset Management: "Does the organization maintain an up-to-date inventory of its cryptographic assets to ensure preparedness for transition to postquantum cryptographic environments?"

The detail that matters is where that control sits. It appears in the auditors' report annexure, which makes it externally audited rather than self-attested, and the covering circular directs that insurers, intermediaries, TPAs and repositories "shall strictly adhere" with no de-minimis carve-out. A small intermediary is inside the scope on the same terms as a large insurer.

Neither regulator uses the word CBOM. Neither names a format.

The one that specifies, and does not bind

CERT-In's Technical Guidelines v2.0 of 9 July 2025 is the only Indian document that says what a cryptographic inventory entry should actually contain, field by field, and it goes further than most national equivalents: separate requirements for algorithms, keys, protocols and certificates, each with its own attribute list. We have set those out in full, along with the separate tables for SBOM, AIBOM and HBOM.

It is also the document with no legal basis. It cites no section of the IT Act, makes no cross-reference to CERT-In's binding 2022 Directions, and is addressed to government, public sector, essential services and the software export industry rather than to regulated financial entities.

So the specification and the obligation live in different instruments, issued by different authorities, to overlapping but not identical audiences. That is the structural problem anyone building for Indian compliance runs into, and no amount of reading will resolve it, because it is a feature of how the rules were written rather than an ambiguity in any one of them.

The one still deciding

RBI has done something real and dated without publishing a policy. On 25 May 2026 it constituted an eight-member expert committee, Q-SAFE (Quantum Secure and Adaptive Financial Ecosystem), convened by Dr. Anil Prabhakar of IIT Madras, with Suvendu Pati of RBI's FinTech Department as Member-Secretary and members drawn from DST, SBI, NPCI, MeitY, DSCI and industry.

A bank reading RBI's own instruments today finds no CBOM requirement and no PQC deadline. That is the correct reading of the current position. It is also a reasonable basis for expecting one, given that constituting a committee with that membership is not a neutral act.

Worth noting for banks specifically: an entity regulated by RBI may still be caught by SEBI's CSCRF if it operates in securities markets. The absence of an RBI requirement is not the absence of a requirement.

The one that recommends

TEC, the Telecommunication Engineering Centre under the Department of Telecommunications, published TEC 910018:2025, "Technical Report: Migration to Post Quantum Cryptography," in January 2025. It describes CBOM tooling as producing "a standardized bill of cryptographic materials (i.e. the crypto inventory) so that they can be shared with technology vendors and partners," and recommends inventorying cryptographic assets.

A technical report from a standards body is the weakest instrument on this page, but it is evidence of direction, and telecom licensees should read it as such.

Deadlines, and who owns them

The only dated PQC milestones in India sit in DST's National Quantum Mission roadmap: for critical infrastructure, preparatory work by 31 December 2027, high-priority migration by 31 December 2028, and full adoption by 31 December 2029. For regular enterprises the sequence runs 2028, 2030, and 31 December 2033.

The roadmap also dates the procurement side, with organisations to begin requesting CBOMs from FY 2026-27.

None of this is binding. DST is a science ministry, not a regulator, and the roadmap is written to be adopted by sectoral regulators rather than enforced directly. Read it as the timeline SEBI, RBI and IRDAI are most likely to converge on, not as one you are currently held to.

The two that have published nothing

Two bodies routinely named in Indian PQC discussion have issued no instrument of their own.

NPCI's only connection is its MD and CEO's membership of RBI's Q-SAFE committee. That is participation in someone else's process.

NCIIPC appears in DST's roadmap as an ecosystem participant and has published nothing on post-quantum cryptography, cryptographic inventory or CBOM. For operators of critical information infrastructure, that absence is the finding: the obligation, if it comes, will arrive from a sectoral regulator or from NCIIPC later, not from anything in force today.

We state these explicitly rather than leaving them off the list, because "we checked and found nothing" is a different answer from "we did not check."

What this means in practice

If you are a securities-market entity, you have a binding inventory requirement whose compliance date has passed, and no format.

If you are an insurer, you have an audited control effective from the current financial year, and no format.

If you are a bank, you have no RBI requirement today, a committee that suggests one is coming, and possible exposure through SEBI if you operate in securities markets.

In all three cases the question "what should the inventory contain" has one credible Indian answer, and it comes from a document that does not bind you. Using CERT-In's field lists is the defensible choice. Claiming they constitute compliance with SEBI or IRDAI is not, because neither regulator has said so.

The India country page tracks each of these instruments with its primary source, and is updated as positions change.

Frequently asked questions

Is a CBOM mandatory in India?: No single Indian rule mandates a CBOM by that name. Two sectoral regulators bind their entities to maintain a cryptographic asset inventory, which is the same substance under a different label: SEBI's CSCRF for securities-market entities and IRDAI's 2026 guidelines for insurers. Neither uses the term CBOM and neither specifies a format.
What does SEBI's CSCRF require on post-quantum cryptography?: Box Item 7 of the CSCRF circular states that regulated entities 'shall maintain an inventory of cryptographic assets, prioritizing critical assets for Post Quantum Cryptography (PQC) migration.' The circular, SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 of 20 August 2024, is issued under section 11(1) of the SEBI Act 1992 and binds entities across some twenty categories. Compliance timelines were extended to 31 August 2025, a date that has passed.
Does RBI require a cryptographic inventory?: Not yet. RBI has taken a dated, real step without publishing a policy: on 25 May 2026 it constituted an eight-member expert committee called Q-SAFE, convened by Dr. Anil Prabhakar of IIT Madras. A bank reading RBI's own instruments today finds no CBOM or PQC requirement. Banks regulated by RBI but also operating in securities markets may still be caught by SEBI's CSCRF.
What is IRDAI Control 110?: A new control under Asset Management in IRDAI's Information and Cyber Security Guidelines 2026, issued 6 April 2026. It asks: 'Does the organization maintain an up-to-date inventory of its cryptographic assets to ensure preparedness for transition to postquantum cryptographic environments?' It applies to insurers, intermediaries, TPAs and repositories with no de-minimis carve-out, and appears in the auditors' report annexure, which makes it externally audited rather than self-assessed.
Which Indian authority specifies what goes in a cryptographic inventory?: CERT-In, in Technical Guidelines v2.0 of 9 July 2025, and it is the only one. SEBI and IRDAI require the inventory without saying what an entry must contain. CERT-In's tables specify fields per asset type for algorithms, keys, protocols and certificates. The gap worth noting is that CERT-In's document is not binding, so the detailed specification and the binding obligation sit in different instruments.
Are there dated PQC migration deadlines in India?: Only in DST's National Quantum Mission roadmap, which is not itself binding. It sets full PQC adoption for critical infrastructure by 31 December 2029 and for regular enterprises by 31 December 2033, with preparatory and high-priority migration milestones before each. The roadmap is written to be adopted by sectoral regulators rather than enforced by DST.
Has NPCI issued anything on post-quantum cryptography?: No. NPCI's only connection is its MD and CEO's membership of RBI's Q-SAFE committee, which is participation in someone else's process rather than an NPCI instrument. The same is true of NCIIPC, which appears in DST's roadmap as an ecosystem participant but has issued nothing of its own.
If I comply with CERT-In's guidelines, am I compliant with SEBI and IRDAI?: Probably in substance, but that is an inference rather than a stated equivalence. Neither SEBI nor IRDAI names CERT-In's guidelines or any format, so no regulator has said that following them discharges the obligation. CERT-In's tables are the most detailed Indian specification available to fill a gap the binding rules leave open, which is a weaker claim than compliance.