Regulatory Patchwork: How Exemptions and Selective Reporting Undermine Corporate Cybersecurity

The Compliance Mirage: When Regulatory Status Obscures Cyber Risk

In the intricate dance between corporations and regulators, compliance has become both shield and theater. Recent disclosures from Indian publicly traded companies reveal a troubling pattern: a regulatory landscape where exemptions, selective reporting, and leadership certifications coexist, creating a mirage of security that often fails to reflect underlying cyber resilience. For security leaders assessing third-party risk, this patchwork compliance environment represents one of the most significant—and overlooked—threats to organizational security.

The case of Sattrix Information Security Limited stands as a particularly stark illustration. The company, which operates in the cybersecurity sector itself, recently announced an exemption from compliance with SEBI Regulation 24A. This regulation, governing substantial acquisitions of shares and takeovers, includes important disclosure requirements that contribute to corporate transparency. While exemptions may be granted for legitimate structural or operational reasons, a security firm operating outside standard compliance frameworks raises immediate questions for partners and clients. If a cybersecurity provider isn't subject to the same transparency requirements as other entities, how can organizations properly assess their security posture or the risks they might introduce into a supply chain?

Meanwhile, other companies demonstrate more conventional compliance behaviors. GCM Securities Limited submitted its Annual Secretarial Compliance Report for FY26, while JNK India Limited filed its Quarterly Confirmation Certificate for the March 2026 quarter. These routine filings represent the baseline of regulatory engagement—companies meeting established requirements without seeking special status. Yet even this 'normal' compliance tells security professionals little about actual cyber defenses, incident response capabilities, or data protection practices.

The contrast becomes more pronounced when examining NTPC Limited, which achieved an ESG (Environmental, Social, and Governance) rating of 74.3, placing it in the 'Leadership' category as assessed by CARE ESG Ratings. High ESG scores typically indicate strong governance practices, which theoretically should correlate with robust cybersecurity governance. However, research increasingly shows that ESG ratings and cybersecurity maturity don't always align. A company can score highly on governance metrics while maintaining inadequate cyber controls, particularly if cybersecurity isn't sufficiently weighted in the rating methodology.

At the other end of the spectrum, Bharat Parenterals Limited found itself responding to a Bombay Stock Exchange (BSE) clarification regarding unusual stock price movement. Such regulatory inquiries often trigger additional scrutiny and disclosure requirements, potentially revealing vulnerabilities or operational issues that weren't previously apparent. For cybersecurity teams, these moments of regulatory attention can serve as early warning indicators of potential instability or undisclosed incidents within partner organizations.

The Cybersecurity Implications of Regulatory Arbitrage

This uneven compliance landscape creates three distinct challenges for cybersecurity professionals:

1. Third-Party Risk Assessment Blind Spots: Traditional vendor risk assessments often rely heavily on compliance certifications. When companies operate under exemptions or report selectively, these assessments become unreliable. A security firm like Sattrix, operating under exemption, might pass a checklist audit while maintaining security practices that wouldn't withstand standard regulatory scrutiny.

1. Supply Chain Contagion Risk: In interconnected business ecosystems, one company's regulatory exemption or minimal compliance can create vulnerabilities that cascade through networks. A partner with reduced transparency requirements might experience a breach that goes unreported or under-reported, leaving connected organizations exposed without their knowledge.

1. The False Comfort of Leadership Ratings: High ESG or other governance ratings can create a false sense of security. Procurement teams might select vendors based on these scores without conducting proper technical security assessments. The NTPC example demonstrates how leadership in one governance area doesn't guarantee leadership in cybersecurity specifically.

Beyond the Checkbox: A New Approach to Compliance Intelligence

Forward-thinking security organizations are moving beyond compliance-based risk assessment toward more nuanced approaches:

• Behavioral Compliance Analysis: Instead of just checking compliance status, analysts examine how companies engage with regulators. Do they seek exemptions routinely? Do they report only when compelled? This behavioral pattern often reveals more about risk culture than any certification.

• Regulatory Engagement Mapping: Security teams are beginning to map their third-party ecosystem against regulatory engagement patterns, identifying which partners operate under exemptions, which maintain perfect compliance records, and which frequently draw regulatory inquiries.

• Compensating Control Requirements: For partners operating under regulatory exemptions, organizations are implementing additional security requirements and audit rights to compensate for the reduced regulatory oversight.

The Indian corporate examples reflect a global phenomenon. From GDPR exemptions in Europe to sector-specific exclusions in U.S. financial regulations, companies worldwide navigate complex regulatory landscapes with varying degrees of transparency. The cybersecurity industry must develop frameworks to assess risk in this environment that don't rely solely on compliance status.

Toward Genuine Transparency

The solution lies not in eliminating regulatory exemptions—which sometimes serve legitimate purposes—but in developing more sophisticated approaches to risk assessment. Cybersecurity frameworks need to evolve to account for regulatory status as just one factor among many, rather than a primary indicator of security posture.

Organizations should:

1. Demand technical security assessments regardless of compliance status
2. Develop contractual requirements for security transparency that exceed regulatory minimums
3. Create internal alert systems for changes in partners' regulatory status
4. Participate in industry efforts to standardize security disclosure beyond compliance requirements

The 'compliance chameleons'—companies that adapt their reporting to minimize regulatory burden—will continue to exist. The cybersecurity community's task is to develop the tools and practices to see through their camouflage, recognizing that in today's interconnected business world, one company's regulatory exemption can become everyone's security vulnerability.