On July 31, 2026, the RBI issued a set of new directions under the title Cybersecurity, Technology Risk, Resilience and Assurance Framework, one each for commercial banks, small finance banks, payments banks, urban co-operative banks, all India financial institutions, NBFCs, and credit information companies. Together, these directions replace a patchwork of earlier circulars with a single, consolidated rulebook, and they do something that earlier frameworks never fully did, they turn cybersecurity from a technology function into an explicit, non delegable board level governance responsibility.
For risk professionals, compliance heads, and board members across banks and NBFCs, this is not a routine update to file away for the IT department to handle. Boards are now expected to own cyber risk with the same seriousness they apply to credit risk, market risk, and operational risk, and regulators will expect to see evidence of that ownership at the boardroom level, not just in technical audit reports.
What the RBI Cybersecurity Directions 2026 Actually Require
The commercial banks directions apply immediately to banking companies, corresponding new banks, and the State Bank of India, with the framework covering IT governance, information security, and cybersecurity policies that must be board approved rather than simply endorsed by senior management. A dedicated IT Strategy Committee and a separate Information Security Committee are now required at board level, alongside a Chief Information Security Officer whose independence from IT operations is explicitly protected under the framework. The Audit Committee is given a defined role in overseeing information systems audits, closing a gap where audit oversight of technology risk had often been informal.
On the operational side, the directions mandate vulnerability assessments every six months, annual penetration testing for critical internet facing systems, and half yearly disaster recovery drills. Cyber incidents must be reported through the DAKSH platform within six hours of detection, a materially tighter timeline than many institutions have historically worked to. The framework also extends into areas that were previously addressed only loosely across scattered circulars, including data governance, cryptography standards, secure software development practices, vendor and third party risk tied to IT and cybersecurity arrangements, source code escrow, IPv6 readiness, and teleworking security.
Perhaps most significantly for boards specifically, the directions introduce a requirement for continuous board training on cybersecurity, moving away from the assumption that a single onboarding briefing is sufficient for directors to discharge their oversight duties on an ongoing basis.
Why This Is a Governance Shift, Not Just a Technology Update
Historically, when a cyber incident occurred at a bank, scrutiny landed almost entirely on the technology team. Under the 2026 framework, that scrutiny now extends directly into the boardroom. Regulators will look for evidence that the board understood the institution’s cyber risk posture, approved the relevant policies with genuine comprehension rather than procedural sign off, and actively questioned management on resilience gaps, rather than simply receiving a summary slide once a quarter.
This shift creates a real and immediate capability gap in many institutions. Compliance heads need to translate a dense, legally binding regulatory text into a workable governance structure. Risk professionals need to build reporting formats that give the board meaningful, decision useful visibility into cyber exposure. And board members themselves, many of whom come from non technical backgrounds, need enough working fluency in cyber risk concepts to ask the right questions and exercise genuine oversight rather than passive approval.
Building Board Level Cyber Risk Governance Capability
Meeting this requirement well means moving beyond a one time compliance briefing. Institutions need governance structures that clearly define what the IT Strategy Committee and Information Security Committee are responsible for, how the CISO’s independence is protected in practice, and how cyber risk reporting reaches the board in a form that supports real oversight rather than box ticking. They need documented escalation paths for incidents that must be reported within the six hour DAKSH window, and they need evidence, through minutes, training records, and policy review cycles, that the board is engaging with cyber risk on an ongoing basis rather than annually.
This is precisely the gap that structured, focused training is designed to close, and it is the reason RMAI has built a dedicated programme around this framework specifically for the audiences who now carry direct accountability under it.
RMAI’s Training on Cyber Risk Management and Boardroom Risk Governance
RMAI is conducting specialised training on cyber risk management and boardroom risk governance, built specifically around the requirements introduced under the RBI Cybersecurity Directions 2026. The programme is designed for risk professionals, compliance heads, and board members who need to translate this framework into working governance practice within their institutions.
Two formats are available to suit different institutional needs. The online, pre-recorded format allows individual professionals or teams to build this capability at their own pace, making it well suited for compliance and risk teams that need to onboard staff quickly or refresh knowledge across a distributed workforce. For banks that want a more immersive, discussion driven session, RMAI also offers live, onsite training delivered directly at the institution, allowing board members and senior risk leaders to work through the governance requirements, discuss institution specific gaps, and build a shared understanding in a structured, facilitated setting.
Both formats are built to help participants move from reading the regulatory text to genuinely understanding what board level cyber risk ownership looks like in practice, covering governance structure, CISO independence, incident reporting obligations, vendor and third party risk, and the kind of board level questioning that regulators now expect to see evidenced.
Related RMAI Courses to Build This Capability
Alongside the dedicated boardroom training programme, professionals can build supporting capability through RMAI’s existing certificate courses. The Online Course on Cyber Security and Technology Risk Management in Banking covers core banking vulnerabilities, vendor and cloud risk exposure, API risk, access control governance, and data privacy oversight, all directly relevant to the operational provisions of the new directions.
For compliance heads and risk leaders responsible for translating this framework into board level policy and oversight structures, the Online Certificate Course on Governance, Risk and Compliance (GRC) builds the governance fluency needed to operate alongside a dedicated IT Strategy Committee and Information Security Committee.
Since the directions bring vendor and third party arrangements tied to IT and cybersecurity squarely into scope, the Online Certificate Course in Third Party and Vendor Risk Management helps professionals build the due diligence, contract governance, and monitoring skills the framework now expects.
For teams responsible for the internal controls, incident escalation, and audit readiness that sit behind six hour DAKSH reporting timelines, the Online Certificate Course in Operational Risk Management rounds out the practical skill set needed to operationalise this framework well.
To explore the full range of programmes covering credit, market, operational, cyber, and enterprise risk, visit RMAI’s complete suite of risk management courses or the risk management courses page for a programme matched to your team’s needs.
Conclusion
The RBI Cybersecurity Directions 2026 mark a definitive shift in how cyber risk is governed across Indian banks and NBFCs, moving accountability squarely into the boardroom and demanding continuous, informed engagement rather than periodic technical updates. Institutions that treat this as a genuine governance transformation, supported by proper training for risk professionals, compliance heads, and board members alike, will be far better positioned to meet regulatory expectations and build real cyber resilience, rather than institutions that treat it as a document to file and forget.
Connect with RMAI to know more about the cyber risk management and boardroom risk governance training programme, available in both online pre-recorded and live onsite formats for banks.
