On 31 July 2026, the Reserve Bank of India issued the Reserve Bank of India (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, replacing the existing patchwork of cybersecurity instructions with a single framework. This is not a routine update. It is a structural shift in how cybersecurity is expected to function inside Indian banks.
For nearly a decade, cybersecurity in Indian banking was largely treated as a technology function, owned by the CISO and IT teams, reported upward through periodic updates, and reviewed mainly during audits. RBI Cybersecurity Directions 2026 close that gap. The new regulations transform cybersecurity from a technical compliance function into a board driven governance and enterprise risk management responsibility. Boards are no longer expected to simply note cybersecurity updates, they are expected to own cyber risk the same way they own credit risk, market risk and operational risk.
For risk professionals, compliance heads and board members across banks and NBFCs, understanding what these directions require, and how to build the governance structure around them, is now business critical.
What the RBI Cybersecurity Directions 2026 Actually Require
The directions apply immediately to commercial banks, including banking companies, corresponding new banks and the State Bank of India, but exclude small finance banks, payments banks and local area banks. While the scope is defined precisely, the expectations set a benchmark that NBFCs and other regulated entities are likely to be measured against in due course.
At the heart of the framework is a governance overhaul. Banks are now required to establish formal IT governance structures, Board level oversight, dedicated IT Strategy and Information Security Committees, stronger CISO independence, and a comprehensive Information Systems Audit framework.
On the operational side, the directions are equally specific. Banks must now conduct vulnerability assessments every six months, annual penetration tests for critical internet facing systems, and half yearly disaster recovery drills under the new framework. Incident reporting timelines have also tightened considerably, with incident reporting within six hours through the DAKSH platform now mandated, alongside continuous board training on cyber risk.
The framework also extends into areas that were previously addressed only loosely, including data governance, cryptography, secure software development, vendor risk management, source code escrow, IPv6 readiness and teleworking security. Taken together, the 2026 Directions move from advisory guidance to legally binding requirements, making governance, accountability, cyber resilience, and operational assurance central pillars of India’s banking cybersecurity framework.
Why Boards Cannot Delegate This Away
The single biggest shift in RBI Cybersecurity Directions 2026 is accountability. Historically, when a cyber incident occurred, scrutiny landed on the technology team. Under the new framework, that scrutiny extends directly to the boardroom. A dedicated IT Strategy and Information Security Committee, stronger independence for the CISO role, and mandatory board training are all designed to ensure that directors understand cyber risk well enough to challenge management, approve risk appetite, and take responsibility for resilience outcomes.
This mirrors a pattern risk professionals will recognise from enterprise risk management more broadly. Just as credit risk and market risk moved from siloed departmental functions to board level risk appetite statements over the past two decades, cyber risk is now following the same trajectory. Boards that treat this as an IT compliance exercise, rather than an enterprise risk governance obligation, will find themselves exposed both operationally and reputationally.
Building a Board Level Cyber Risk Governance Framework: Key Components
Translating the RBI Cybersecurity Directions 2026 into a working governance structure requires several connected elements.
1. Formal Governance Architecture
Boards need a clearly defined structure, an IT Strategy Committee, an Information Security Committee, and reporting lines that give the CISO genuine independence from operational IT management. Without this separation, oversight becomes symbolic rather than substantive.
2. Risk Appetite for Cyber Risk
Just as institutions define appetite for credit and market risk, boards now need an explicit, quantified appetite statement for cyber and technology risk, covering acceptable downtime, data exposure thresholds, and third party risk tolerance.
3. Continuous Assurance, Not Periodic Audits
Six monthly vulnerability assessments, annual penetration testing and half yearly disaster recovery drills mean cyber assurance can no longer be an annual exercise. Boards need dashboards and reporting cadences that reflect this continuous rhythm.
4. Vendor and Third Party Risk Oversight
With vendor risk management and source code escrow now built into the framework, boards need visibility into the institution’s technology supply chain, not just its internal systems.
5. Incident Response Readiness
A six hour reporting window through DAKSH leaves little room for internal deliberation. Boards need to know, in advance, exactly how an incident moves from detection to board notification to regulatory disclosure.
6. Ongoing Board Capability Building
Mandatory continuous board training signals that RBI expects directors to have working fluency in cyber risk concepts, not just awareness. This is where structured learning becomes essential.
Building the Right Capability for Board Level Cyber Governance
Meeting these expectations requires risk professionals and board members who understand both the technical dimensions of cyber risk and the governance frameworks needed to oversee it effectively. This is exactly the gap RMAI’s course offerings are designed to close.
RMAI’s Cyber Risk Management course helps professionals build a practical understanding of cyber threats, controls and resilience planning aligned with evolving regulatory expectations. For those responsible for embedding cyber risk into broader governance structures, the Governance, Risk and Compliance course provides the frameworks needed to connect regulatory obligations with board level oversight. Since RBI Cybersecurity Directions 2026 sit firmly within enterprise wide risk management, the Enterprise Risk Management course is also directly relevant for professionals looking to integrate cyber risk appetite into overall organisational risk strategy.
You can explore RMAI’s complete course library, spanning enterprise risk, cyber risk, compliance and emerging risk areas, on the Risk Management Courses page.
Conclusion
RBI Cybersecurity Directions 2026 mark a decisive shift in how Indian banks are expected to govern cyber and technology risk. Cybersecurity is no longer a technical function reporting quietly to management, it is a board level governance responsibility with legally binding obligations, tight reporting timelines and continuous assurance requirements. Institutions that treat this as a compliance checklist will struggle to keep pace, while those that build genuine board level cyber risk governance, backed by clear structures, defined risk appetite and well trained directors, will be far better positioned to meet regulatory expectations and protect stakeholder trust. For risk professionals and board members alike, now is the time to build that capability.
