At the BRICS Finance Ministers and Central Bank Governors meeting held in Mumbai on September 10, 2026, member countries commended the third iteration of the BRICS Cyber Exercise and Drills, conducted under the theme Resilience and Cooperation for Cyber Defence. More significantly, BRICS members agreed that these Cyber Exercises and Drills should now be conducted on an annual basis, underscoring collective and coordinated approaches, mutual learning, and practical cooperation in strengthening cyber resilience in the financial sector.
For banks, insurers, NBFCs, and the risk, technology, and CISO functions that support them, this is a notable shift. Cyber resilience discussions at the BRICS level have moved from broad policy statements towards an operational commitment, a recurring, tested exercise cycle, rather than a one-time or occasional initiative.
What Was Actually Agreed
The joint statement from BRICS Finance Ministers and Central Bank Governors sets out several specific commitments relevant to financial sector cybersecurity.
- BRICS Cyber Exercises and Drills are to be conducted annually going forward, formalising what has so far been a periodic initiative
- The third iteration of these exercises, held under the theme Resilience and Cooperation for Cyber Defence, was explicitly commended in the joint statement
- Member countries recognised the importance of collective and coordinated approaches, mutual learning, and practical cooperation as the guiding principles behind these exercises
- BRICS members were encouraged to have greater exchange of information on cyber incidents, extending cooperation beyond joint exercises into ongoing intelligence sharing
- The commitment sits alongside continued work by the BRICS Rapid Information Security Channel and the BRICS Fintech Working Group, which are adopting an EMDE-centric approach to assess opportunities and risks from AI and emerging technologies such as quantum computing in the financial sector
- Separate reporting also points to discussion of a BRICS Central Bank Hub intended to build capacity and support the conduct of these annual cybersecurity exercises
Why This Matters for Financial Institutions
Cyber resilience is no longer being treated purely as an individual institution’s information security responsibility. Financial systems have become interconnected through payment networks, cloud service providers, APIs, fintech platforms, market infrastructure, and third-party technology providers, meaning operational disruption at one institution can propagate quickly across institutions and jurisdictions.
- Annual, coordinated cyber exercises give institutions and regulators a structured opportunity to test incident detection, escalation, and response capabilities under realistic, cross-border scenarios rather than isolated internal drills
- The emphasis on mutual learning signals that regulators expect institutions to benchmark their preparedness against peers, not simply meet a minimum internal standard
- Greater information exchange on cyber incidents means institutions should expect faster, more structured intelligence sharing about emerging threats relevant to the BRICS financial ecosystem
- For banks and financial institutions, resilience increasingly depends not only on preventing attacks but on maintaining critical services when prevention fails, a distinction that annual drills are specifically designed to test
Read Now: BRICS 2026 and the Emerging Risk & Resilience Agenda for BFSI
What Annual Cyber Exercises Typically Test
Based on the stated objectives behind this commitment, institutions should expect these exercises to focus on several core capability areas.
- Incident detection and internal escalation timelines under simulated stress conditions
- Cross-border and cross-institution communication and coordination during a significant cyber event
- The effectiveness of business continuity and recovery arrangements when critical systems are disrupted
- Crisis decision-making and governance, including how quickly senior management and boards are looped into a live incident
- The resilience of third-party and vendor dependent systems, given how much of the financial ecosystem now runs through shared technology infrastructure
What This Means for Indian Banks, Insurers, and NBFCs
For institutions operating in India, this BRICS commitment reinforces a direction that domestic regulation has already been moving in, given RBI’s own board level cybersecurity governance requirements and SEBI’s parallel push toward measurable, tested resilience for market infrastructure. Institutions should treat this as a signal to strengthen their own internal exercise cadence now, rather than waiting for a formal domestic mandate tied directly to the BRICS commitment.
- Risk, technology, and CISO teams should review whether internal cyber drills are conducted with the frequency and realism this kind of international benchmark implies
- Institutions with cross-border operations or BRICS-linked payment and correspondent banking relationships should pay particular attention to information-sharing protocols as they develop
- Boards should expect cyber resilience testing outcomes to become a more visible, benchmarked topic in future regulatory and industry discussions, not just an internal technical exercise
Read Now: RBI Cybersecurity Directions 2026: Board Level Cyber Risk Governance Training
Conclusion
BRICS moving from periodic cyber cooperation toward a formal, annual exercise commitment reflects a broader global pattern of treating financial sector cyber resilience as something that must be tested repeatedly, not just documented. Financial institutions that build a genuine internal drill cadence now will be far better positioned as this kind of cross-border benchmarking becomes a more visible part of the regulatory and industry conversation.
Build This Capability with RMAI
The Online Course on Cyber Security and Technology Risk Management in Banking builds the practical incident response and technology risk capability this kind of exercise cycle demands. The Online Certificate Course in Operational Risk Management helps professionals design and test the resilience and recovery processes that annual cyber drills are meant to validate.
