RBI’s Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions took effect on 31 July 2026, the day they were issued, with no transition period reported. Banks and NBFCs are already expected to comply, so the question for most teams is how much of the framework is evidenced today.
Why these directions matter now
RBI issued the Directions on 31 July 2026 as separate instruments for each entity type, for example RBI/DoS/2026-27/410 for commercial banks and RBI/DoS/2026-27/461 for NBFCs. They repeal the earlier cybersecurity and IT governance instructions for those entities, and they were issued alongside a companion set, the Digital Payment Security Controls Directions.
Three features change how the work is done:
- Accountability sits with the Board and risk, not only IT. The CISO reports to the executive overseeing risk management, not to the Head of IT, and the Board reviews cyber risk at least quarterly.
- The clock is short. Cyber incidents must reach RBI through the DAKSH platform within six hours of detection.
- Evidence is expected on a fixed cadence. Vulnerability assessment, penetration testing and disaster recovery drills each have a minimum frequency, and vendor contracts must carry audit and inspection rights.
This article walks through each requirement, what it means in daily work, and a 30-60-90 day plan. It is built from secondary summaries of the RBI instruments, so confirm paragraph references on rbi.org.in before quoting them in a policy or audit response.
Who is covered
Each entity type has its own instrument, so the first task is to confirm which one applies to you. The depth of the requirements also varies by NBFC scale layer.
| Entity | Instrument and scope | Points to check |
| Commercial banks | RBI/DoS/2026-27/410. Banking companies other than small finance banks, payments banks and local area banks, corresponding new banks, and SBI. | Foreign bank branches follow comply-or-explain for specified chapters, and “Board” means the head office. |
| NBFCs, all layers | RBI/DoS/2026-27/461. Chapter III covers the Base Layer below the asset threshold and Core Investment Companies. Chapter IV covers the larger Base Layer. Chapter V covers Middle, Upper and Top Layer NBFCs, excluding CICs. | Sources disagree on the Base Layer split (₹2,500 crore in one, ₹500 crore in another). Check para 3 of the instrument. |
| Housing finance companies | Covered by the NBFC instrument. | Incident reporting goes to NHB instead of RBI. |
| Small finance banks, all-India financial institutions | Separate versions issued the same day. | Confirm the instrument and chapters on rbi.org.in. |
The obligations below follow the commercial bank and NBFC Chapter V text, which is the fullest set. Smaller NBFCs have a lighter version, mainly a Board-approved IT and information security policy and a designated senior executive in charge of IT.
Requirements 1 and 2: Board governance and the CISO
The Board owns cyber risk, and the CISO sits in the risk line rather than under IT.
What the Directions say
- The Board approves the IT, information security, cybersecurity and business continuity policies and reviews them at least annually. The cybersecurity policy is to be separate from the IT or information security policy.
- An IT Strategy Committee of the Board has at least three directors, an independent director as chair with at least seven years of substantial IT experience, and meets at least quarterly.
- An IT Steering Committee of senior management meets at least quarterly. An Information Security Committee, headed by someone from risk management, reviews cyber incidents and audit observations.
- The CISO is a senior executive, preferably General Manager level, with no reporting line to the Head of IT and no business targets. The CISO reports to the executive overseeing risk management and reviews cyber risk and preparedness with the Board, its risk committee or the ITSC at least quarterly.
- The Audit Committee of the Board oversees information systems audit, with a risk-based IS audit policy and a separate IS audit function.
What it changes in daily work
- Risk teams take on a regular cyber risk reporting line and own the committee calendar with the CISO.
- Company secretaries check that the ITSC composition meets the independence and experience test.
- HR and the CISO office review the reporting line, targets and staffing of the CISO function.
Evidence to keep: Board-approved policy set with review dates, committee composition and charters, minutes showing quarterly CISO reviews, and the CISO’s reporting line on the organisation chart.
Requirements 3 and 4: Security operations and the testing calendar
Monitoring runs around the clock, and testing runs to a fixed calendar that can be audited.
Cyber Security Operations Centre (CSOC). The commercial bank text requires continuous monitoring with log collection, correlation in a SIEM, threat intelligence, and incident response and forensic capability. Monitoring is tiered: Level 1 round-the-clock monitoring, Level 2 specialists in network, data and endpoint security, and Level 3 advanced analysts for forensics and malware analysis. In-house and managed service models are both reported as permitted, but the institution stays accountable. Forensics and DDoS mitigation support are to be on standby.
| Control | Minimum frequency | Scope |
| Vulnerability assessment | Every 6 months | Critical systems and internet-facing systems in the DMZ with a customer interface |
| Penetration testing | Every 12 months | Same systems as above |
| Non-critical systems | Risk-based | Frequency set by the institution’s own risk assessment |
| Disaster recovery drill | Every 6 months | Critical systems, running the DR site as primary for a full working day |
| VA and PT closure status | Every quarter | Reported to the IT Steering Committee and Information Security Committee |
| Business continuity plan test | Every 12 months and after major change | Reported for NBFCs; confirm for banks |
What it changes in daily work
- IT security teams keep a single testing calendar that shows the last and next date for each critical system, and who closed each finding.
- Testers must be trained and independent, so the vendor selected for penetration testing should not be the team that built or runs the system.
- Major issues found in a DR drill are fixed and re-tested before the next drill cycle, so the closure record matters as much as the drill report.
- Red teaming is described as discretionary.
Evidence to keep: the system inventory marking critical and customer-facing systems, test reports with dates, closure tracker, DR drill reports with RTO and RPO results, and the quarterly committee papers.
Requirement 5: Incident reporting within six hours
A cyber incident must be reported to RBI through the DAKSH platform within six hours of detection, and CERT-In must also be notified proactively. Housing finance companies report to NHB instead of RBI.
What the Directions say
- Institutions keep a documented incident response and recovery policy covering classification, roles (including outsourced staff), reporting channels, communication, containment and post-incident review.
- Banks hold a Board-approved Cyber Crisis Management Plan covering detection, containment, response and recovery, with documented strategies for ransomware, data destruction and DDoS.
- Incident handlers receive specialised training. Banks take part in CERT-In and IDRBT drills and share threat intelligence through IDRBT forums.
- One summary notes that the definition of a cyber incident includes IT incidents, not only security events. Check the definition in the instrument.
- CERT-In’s separate Directions of 28 April 2022 require reporting of specified incident types within six hours of noticing, 180-day log retention in India and clock synchronisation.
What it changes in daily work
The six-hour limit means the escalation path must work outside office hours. A workable sequence is:
- The SOC or the first person who notices an event logs the time of detection and raises it to the incident lead.
- The incident lead classifies it against the policy and decides within the first hour whether it is reportable.
- The CISO office files on DAKSH and notifies CERT-In, using a pre-approved template that needs no senior sign-off to send.
- Compliance, the Board risk committee chair and, where customers are affected, communications are informed in parallel.
- Updates and the post-incident review are logged against the same incident number.
Evidence to keep: the incident classification matrix, escalation contact list tested at least twice a year, timestamped incident records showing detection and filing times, and drill reports.
Common gap: vendors detect an incident first but the contract does not oblige them to notify the institution quickly enough for the six-hour window to be met.
Requirements 6 and 7: Technology vendors and digital payments
Third-party technology arrangements. The vendor paragraphs apply to IT and cybersecurity arrangements that fall outside RBI’s separate Outsourcing Directions, so teams need a clear rule for which vendors sit under which rulebook.
- Vendor risk assessment covers concentration risk, single points of failure, supply chain risk and conflicts of interest.
- Agreements include a right to audit for the institution and a right of inspection for RBI, including access to information resources the institution uses even when they are not on its premises.
- Infrastructure location and cross-border data movement follow the applicable requirements.
- Vendor personnel have background checks, non-disclosure agreements and agreements to follow the institution’s security policy.
- For ATM switch application service providers, contracts require timely notice of cyber incidents, sharing of VA and PT reports on request, PCI-DSS compliance and secure coding assurances.
- The NBFC text adds vendor code certification and source code escrow for critical applications, and states that the Board is ultimately responsible for outsourcing risk.
Digital payment security. The companion Digital Payment Security Controls Directions apply to any digital payment product or service, including non-financial uses such as balance enquiry, PIN set and change, mobile banking registration and OTP generation. Institutions adopt a Board-approved policy covering product parameters, risk management, regulatory compliance, customer experience and payment security. On the customer side, the bank text also requires customer education on credentials and OTPs, alerts for transactions above a value the customer sets, and risk-based transaction monitoring.
What it changes in daily work
- Vendor management and legal teams review every technology contract for audit rights, RBI inspection access, incident notice periods and data location clauses, starting with critical vendors.
- Procurement keeps a register that tags each vendor as covered by the Outsourcing Directions or by these Directions.
- Digital banking teams treat low-risk journeys such as PIN change and OTP generation as in scope for controls review.
Evidence to keep: vendor register with tags, contract clause checklist per critical vendor, vendor risk assessments, and the Board-approved digital payment policy.
What changes in daily work, by role
Each team owns a piece of the same framework, so the work is easiest to split by role.
| Role | What to do differently | Question to be able to answer |
| Board and company secretary | Schedule quarterly ITSC meetings, check the independent chair test, and put CISO reviews on the Board agenda. | When did the Board last review cyber risk, and what did it decide? |
| CISO and security team | Report to risk, own the testing calendar, run the SOC and file incidents on DAKSH. | How long from detection to filing in our last incident or drill? |
| Risk management | Add technology and cyber risk indicators to the risk framework and chair the Information Security Committee. | Which cyber risks are above appetite, and who owns each? |
| Compliance | Map each requirement to an owner, a policy and evidence, and track the instrument that applies to each entity. | Can we show evidence for every requirement within a day? |
| IT and infrastructure | Keep the asset and critical system inventory current, track end-of-support dates, and close VA and PT findings on time. | Which critical systems missed their last test date? |
| Internal audit | Build a risk-based IS audit plan against the Directions and test the evidence trail, not only the policy. | Does the audit plan cover each chapter of the Directions? |
| Procurement and vendor management | Tag vendors, review contract clauses and track concentration risk. | Which critical vendors lack audit rights or incident notice terms? |
| Digital banking and payments | Review journeys under the Digital Payment Security Controls Directions and the Board-approved payment policy. | Which digital payment products are covered by the policy? |
A 30-60-90 day roadmap
The Directions are already in force, so the plan below starts with the items that carry a clock or a Board accountability, then builds the evidence trail. The sequence is a suggested way to organise the work, not a timetable set by RBI.
| Phase | Action | Owner | Output |
| Days 1 to 30 | Confirm the applicable instrument and chapters, and read the text against the entity’s layer. | Compliance | Applicability note signed by the CISO and compliance head |
| Days 1 to 30 | Run a gap assessment of every requirement, rated as met, partly met or not met. | Compliance with CISO | Gap register with owners |
| Days 1 to 30 | Test the six-hour reporting path with a tabletop exercise, including a night-time case. | CISO | Timed drill report and corrected contact list |
| Days 1 to 30 | Confirm the CISO reporting line and committee composition. | Company secretary | Board note on any change needed |
| Days 31 to 60 | Update the Board-approved policy set and keep the cybersecurity policy separate. | CISO and risk | Policies approved by the Board |
| Days 31 to 60 | Build the testing calendar for VA, PT and DR drills and clear overdue items. | IT security | Calendar and closure tracker |
| Days 31 to 60 | Review critical vendor contracts for audit rights, RBI inspection access, incident notice and data location. | Vendor management and legal | Clause checklist and amendment list |
| Days 31 to 60 | Review the SOC model, coverage hours and SIEM use cases. | CISO | SOC coverage statement |
| Days 61 to 90 | Start quarterly reporting to the ITSC and Board risk committee. | Risk | First quarterly cyber risk report |
| Days 61 to 90 | Complete a DR drill with the DR site running as primary for a full working day, if one is due. | IT and business continuity | Drill report with RTO and RPO results |
| Days 61 to 90 | Agree the internal audit plan covering each chapter. | Internal audit | Risk-based IS audit plan |
| Days 61 to 90 | Brief the Board and senior management, and train staff and key vendors. | CISO and HR | Training record |
After day 90, the work becomes a recurring cycle: six-monthly VA and DR drills, annual penetration testing and policy review, and quarterly committee reporting.
Build the capability, Train Your Teams
The 31 July 2026 Directions turn cybersecurity into a Board, risk and audit responsibility with fixed clocks and fixed cadences. Institutions that meet them will be the ones whose risk, compliance, IT, audit and vendor teams understand the same rulebook and can show evidence for it on any given day.
RMAI launches Cybersecurity & Technology Risk Management in Banking Training Program: nominations are now open
What the Directions require:
- Board and committee oversight of IT, cybersecurity and business continuity, including a CISO who reports into risk management
- A 24×7 Cyber Security Operations Centre for continuous monitoring
- Reporting of cyber incidents to RBI within six hours of detection
- Vulnerability assessment at least every six months, penetration testing at least every 12 months and disaster recovery drills at least half-yearly for critical systems
- Audit rights for the institution and inspection access for RBI in technology vendor arrangements
The program takes participants through the Directions in full, with a breakdown of each requirement and what it means for banks and NBFCs.
Program modules:
- Module 1: Technology Risk Landscape & Governance Responsibility
- Module 2: Vendor, Cloud & API Risk Oversight
- Module 3: Access Control & Data Privacy Governance
- Module 4: Incident Response & Escalation Governance Model
- Module 5: Board Reporting & Cyber Risk Transparency
Fee and certification:
- Training fee: ₹3,500 per person
- Dual certification: one from RMAI and one from BFSI SSC under NSDC
Risk, compliance, IT governance, internal audit and digital banking teams can enrol now. Fill the nomination form to register yourself or your cybersecurity and cyber risk teams: https://forms.gle/K3VwxeXpRcxEk3mr5
