IFSCA NISM Cyber Certification: NISM-IFSCA-02A and 02B Guide [2026]

The IFSCA NISM cyber certification is now a mandatory qualification for key staff at regulated entities in India’s International Financial Services Centres. IFSCA Circular No. IFSCA-CSD/MSC/4/2026-DCS, dated 27 October 2026, requires designated officers and specified employees to pass NISM exams on cyber security and cyber resilience. The Basic exam, NISM-IFSCA-02A, goes live on 18 November 2026. The Advanced exam, NISM-IFSCA-02B, goes live on 30 December 2026. Staff who must certify have six months from go-live, or six months from appointment, whichever is later.

NISM-IFSCA-02A and 02B: what the two exams are

The IFSCA NISM cyber certification has two levels. Basic (02A) goes live 18 November 2026 and Advanced (02B) on 30 December 2026. Designated officers and market infrastructure CISOs must hold both. Compliance and IT staff must hold Basic. Basic is due 18 May 2027 and Advanced 30 June 2027.

The two certifications set a common knowledge benchmark for cyber security across the IFSC ecosystem. NISM developed them in collaboration with IFSCA.

The circular builds on IFSCA’s Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs. Those guidelines were first issued on 10 March 2025 and amended on 10 March 2026. A separate set of guidelines for Market Infrastructure Institutions followed on 20 April 2026. The new rule turns the training expectations in those guidelines into a testable, recordable qualification. It also applies to all regulated entities in the IFSCs, from banks and brokers to fund managers and insurers.

IFSCA NISM cyber certification: who must take which exam

The rule turns on the role, not the job title. Check the table against the actual responsibilities of each person.

Role at the regulated entity	Basic (02A)	Advanced (02B)
Designated Officer of the regulated entity, and the CISO of a Market Infrastructure Institution	Mandatory	Mandatory
Compliance Officer	Mandatory	Encouraged
Employees responsible for IT operations or information security, or with privileged access to critical systems	Mandatory	Encouraged
All other employees	Encouraged	Encouraged

Paragraph 6 of the IFSCA cyber security guidelines defines the Designated Officer. For a Market Infrastructure Institution, the equivalent person is the Chief Information Security Officer. That officer is appointed under paragraph 7 of Annexure A to the MII guidelines.

IFSCA NISM cyber certification deadlines with worked examples

The deadline is the later of two dates. The first is six months from the date the relevant exam goes live. The second is six months from appointment to the role. Role-holders must also hold a valid certification at all times while in the role. As a result, renewal matters as much as passing the first time.

Certification	Exam goes live	Deadline for current role-holders
Basic (02A)	18 November 2026	18 May 2027
Advanced (02B)	30 December 2026	30 June 2027

For example, a designated officer already in the role on 18 November 2026 must hold Basic by 18 May 2027 and Advanced by 30 June 2027. A compliance officer appointed on 1 March 2027 must hold Basic by 1 September 2027. Six months from appointment is later than six months from go-live in that case. An IT manager appointed on 1 February 2027 must hold Basic by 1 August 2027, for the same reason. Entities must keep records of these certifications and produce them to IFSCA when asked.

To renew, you must reappear and pass the exam before the existing certificate expires. The circular does not state a penalty for missing the deadline.

Exam pattern, fee and validity

The IFSCA NISM cyber certification exam details below come from the official NISM course pages. The circular itself prescribes no fee and no exam format.

Detail	Basic (02A)	Advanced (02B)
Exam goes live	18 November 2026	30 December 2026
Questions	50 multiple choice questions, 1 mark each	80 multiple choice questions plus 3 case sets of 4 questions each
Total marks	50	100
Duration	60 minutes	120 minutes
Passing score	50% (25 out of 50 marks)	60% (60 out of 100 marks)
Negative marking	None	25% of the marks assigned to the question
Exam fee	Rs 1,180, including taxes, plus gateway charges	Rs 2,950, including taxes, plus gateway charges
Certificate validity	2 years	3 years

The Advanced total is 100 marks: 80 from the multiple choice questions and 20 from the case sets. Two sets have four 2-mark questions each, and one set has four 1-mark questions.

The Basic exam is a short test with no penalty for a wrong answer. The Advanced exam is longer, with case-based sets and 25% negative marking. Guessing therefore carries a cost, and the pass mark is higher at 60%. Fees are Rs 1,180 for Basic and Rs 2,950 for Advanced.

Both exams are internet-based and remotely proctored. After registration, candidates select Online as the test center, plus a date and time slot. The passing certificate is issued 72 hours after the exam, provided the profile is approved. It is issued only to candidates who have provided or updated their Permanent Account Number (PAN) in their registration details.

What the syllabus covers

The Basic syllabus runs to 13 chapters:

1. Fundamentals of Cyber Security
2. Cyber Security Governance and Risk Management
3. Cyber Security Design and Architecture
4. Asset Management
5. Access Management and Physical Security
6. Third-Party Risk Management (TPRM)
7. Application Security
8. Data Security
9. Vulnerability Management
10. Security Awareness and Training (Cyber Hygiene)
11. Incident Response and Cyber Resilience
12. Regulatory Requirements (IFSCA)
13. Emerging Challenges in Cyber Security

The heaviest chapters carry 5 marks each: Design and Architecture, Access Management and Physical Security, Data Security, and Incident Response and Cyber Resilience.

The Advanced syllabus goes deeper across 14 chapters. Incident response and cyber resilience carries the highest weight at 20%. In addition, 13 of the 14 chapters end with a case study. The cases test judgment rather than recall. A candidate works through a scenario such as a KYC phishing and account takeover or a deepfake-enabled payment fraud. Then the candidate chooses the response a responsible officer would take. The workbook and study material are free when you enroll.

No other certification satisfies this rule. The circular names only the two NISM certifications. A CISA or a CISM therefore does not substitute for them. However, our CISA Domain 1 notes on the IS audit process refresh audit and control thinking. Our CISM exam changes 2026 guide explains the management-level outline. Neither replaces the NISM workbook.

How to register for the IFSCA NISM cyber certification

Registration for the IFSCA NISM cyber certification runs through the NISM certification portal at cert.nism.ac.in:

1. Create an account and activate it with the OTP sent to the registered email address.
2. Complete the profile before enrolling. Keep a scanned PAN, a recent photograph, proof of address, and employment details ready.
3. Select NISM-IFSCA-02A for Basic or NISM-IFSCA-02B for Advanced. Then choose Online as the test center, plus a date and a time slot.
4. Pay the exam fee online. Basic costs Rs 1,180 and Advanced costs Rs 2,950, inclusive of taxes, plus payment gateway charges.
5. Download the free workbook and study material. Enrollment closes 48 hours before the exam date.

IFSCA NISM cyber certification and GIFT City careers

The mandate changes hiring at GIFT City in a practical way. A designated officer or CISO appointment now carries a certification condition. A candidate who already holds both levels is a simpler hire. As a result, expect job descriptions for compliance, IT operations and information security roles at GIFT IFSC entities to list NISM-IFSCA-02A as a requirement and 02B as preferred.

Outside the IFSC, Basic costs Rs 1,180 and takes one hour. Yet it signals to a recruiter that the candidate understands the IFSC regulatory environment. If you are still choosing between security qualifications, our cybersecurity certification selector compares the main options. Browse current openings on our Jobs hub.

What to do this week

This week is for preparation, not waiting:

1. List every person in the mandatory groups at your entity. Mark who needs Basic only and who needs both levels.
2. Put the two deadlines in the compliance calendar: 18 May 2027 for Basic and 30 June 2027 for Advanced.
3. Register on cert.nism.ac.in, confirm the PAN on record, and download the free workbook.
4. Book the Basic exam for the earliest workable date after 18 November 2026.
5. Set up the certification records file now, so the evidence is ready when IFSCA asks.
6. If you are a job seeker, take Basic first. Add it to your resume before applying to GIFT City roles.

IFSCA NISM cyber certification FAQs

Who must hold both the Basic and the Advanced certification?
The Designated Officer of a regulated entity and the Chief Information Security Officer of a Market Infrastructure Institution must hold both. Everyone else in the mandatory groups needs Basic, with Advanced encouraged.

What is the last date to get certified?
Six months from the exam go-live date, or six months from appointment, whichever is later. For current role-holders that means 18 May 2027 for Basic and 30 June 2027 for Advanced.

How much does the exam cost?
Basic costs Rs 1,180 and Advanced costs Rs 2,950. Both are inclusive of taxes, with gateway charges extra, as published by NISM.

Does the certification expire?
Yes. Basic lasts two years and Advanced three years. Role-holders must hold a valid certification at all times while in the role.

Where do I register?
Register on the NISM certification portal at cert.nism.ac.in. The passing certificate is issued only if the PAN in the registration details is provided and current.

Sources

IFSCA Circular No. IFSCA-CSD/MSC/4/2026-DCS dated 27 October 2026, issued under Sections 12 and 13 of the IFSCA Act, 2019, available on ifsca.gov.in. Course details, exam pattern, fees and registration: NISM IFSCA certification course page, nism.ac.in.