RBI Cybersecurity Framework for NBFCs and Banks: 2026 Directions Guide

RBI IT governance framework implementation guide — GRC RADAR

RBI IT Governance — GRC RADAR

Published: 30 May 2026 · Updated: 17 Oct 2026 · 19 min read · Category: RBI IT Governance

Introduction

On 31 July 2026 the Reserve Bank of India replaced its IT and cyber rulebook for regulated entities. In one release, RBI’s Department of Supervision issued 64 consolidated Directions and repealed 628 older circulars “with immediate effect” (RBI/DoS/2026-27/221). Three of the repealed instruments were the documents most Indian compliance teams worked from: the 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices, the 2016 Cyber Security Framework in Banks, and the 2017 IT Framework for the NBFC Sector.

In their place sit seven entity-class Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 — one each for commercial banks, small finance banks, payments banks, urban co-operative banks, All India Financial Institutions, NBFCs and credit information companies. All seven came into force immediately, with no grace period.

RBI calls the exercise a consolidation of its existing instructions, done “as is”. For NBFCs, the practical result is one text where there used to be two. The RBI cybersecurity framework NBFC obligations now sit in a single Direction for every NBFC registered with RBI. Base Layer NBFCs were under the 2017 IT Framework (the repealed 2023 Master Direction covered only the Middle Layer and above); the new Direction sets out their requirements chapter by chapter, scaled by layer and size. The 2026 texts also state RBI’s six-hour incident-reporting clock in RBI’s own words.

This guide is for the people who implement the rules: compliance officers, CISOs, IT heads and founders at NBFCs and smaller banks. It ends with a checklist and a realistic plan.

What Was Repealed — and What Replaced It

RBI’s withdrawn-circulars page lists the 628 repealed circulars in its Department of Supervision table. The three you are most likely to have on file are all there:

Instrument (as RBI lists it)	Date	Status from 31 Jul 2026	Replaced by
Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/2023-24/107; DoS.CO.CSITEG/SEC.7/31.01.015/2023-24)	7 Nov 2023	Repealed	The 2026 Directions for each class it covered (banks, All India Financial Institutions, credit information companies, NBFCs in the Middle Layer and above)
Cyber Security Framework in Banks (DBS.CO/CSITE/BC.11/33.01.001/2015-16)	2 Jun 2016	Repealed	Commercial Banks Directions (RBI/DoS/2026-27/410) and the other bank classes
Master Direction – Information Technology Framework for the NBFC Sector (DNBS.PPD.No.04/66.15.001/2016-17)	8 Jun 2017	Repealed	NBFC Directions (RBI/DoS/2026-27/461)

Each new Direction repeats the repeal in its closing chapter. The NBFC text says the existing instructions “relating to Information Technology Framework and IT Governance as applicable to Non-Banking Financial Companies stand repealed” (para 155); the Commercial Banks text uses the same formula (para 230). Actions already taken under the old instruments stay valid.

Two consequences follow. Any policy, audit programme or board note that cites the repealed 2023 Master Direction needs a new citation. And a Base Layer NBFC whose gap assessment still points to the repealed 2017 IT Framework must re-map it to Chapter III or IV of the new NBFC Direction.

Who Must Comply — Seven Directions, One Pattern

The core of RBI IT governance framework compliance is now the Direction for your entity class. All seven are dated 31 July 2026:

Entity class	Reference	Notes
Commercial banks (banking companies other than SFBs, payments banks and local area banks; corresponding new banks; SBI)	RBI/DoS/2026-27/410	Foreign banks in branch mode follow a “comply or explain” approach for named chapters and paragraphs (para 4)
Small finance banks	RBI/DoS/2026-27/419	Mirrors the commercial-bank text
Payments banks	RBI/DoS/2026-27/428	Mirrors the commercial-bank text
Urban co-operative banks	RBI/DoS/2026-27/437	A lighter text; keeps the six-hour DAKSH clock and the CERT-In notice
All India Financial Institutions	RBI/DoS/2026-27/456	Mirrors the commercial-bank text
NBFCs (all layers, including Core Investment Companies)	RBI/DoS/2026-27/461	Proportionate by layer and size — see the next section
Credit information companies (credit bureaus)	RBI/DoS/2026-27/470	Mirrors the commercial-bank text

The bank-class texts (commercial, small finance and payments banks) now show “Updated as on October 01, 2026”. The update changed one paragraph: the Board “may delegate the review” of IT and cyber strategies and policies to its IT Strategy Committee, approves material amendments itself, and the review stays at least annual (para 8 for commercial banks; para 7 for small finance and payments banks). RBI made the change after its Governance Amendment Directions.

Local area banks, regional rural banks and rural co-operative banks are not among the seven classes.

One naming trap: “CIC” means two different things here. Core Investment Companies are NBFCs and sit in Chapter III of the NBFC Directions. Credit information companies (the credit bureaus) have their own Directions (RBI/DoS/2026-27/470).

NBFCs: Three Chapters, Three Levels of Obligation

The NBFC Directions apply “to all Non-Banking Financial Companies … registered with RBI” (para 3). The board of every NBFC approves its technology and cybersecurity strategies and policies and reviews them at least annually (para 6). After that, the obligations depend on where you sit:

Chapter III — Base Layer NBFCs below ₹500 crore in assets, and Core Investment Companies. A short baseline (paras 7–9). The NBFC “shall prioritise the implementation of basic IT systems to digitise and secure its primary business databases” and adopt a Board-approved IT / IS policy. The policy covers access controls and passwords, defined user roles, maker-checker controls, “robust information security and cybersecurity controls”, digital signature, mobile and social-media requirements, management information reports, regulatory returns, a business continuity policy with at least annual board oversight, and tested data backups. IT must scale up as operations grow.

Chapter IV — Base Layer NBFCs at ₹500 crore and above. A full IT governance chapter without the heaviest bank-style machinery. The NBFC forms an IT Strategy Committee chaired by an independent director, with the CIO and CTO as members. No more than six months may pass between two meetings (para 15). Cyber incidents go to RBI’s DAKSH platform within six hours of detection (para 28). IS audit “may be conducted at least once in a year” (para 56). The chapter also covers IT policy, information security, IT operations, business continuity and IT services outsourcing.

Chapter V — Middle Layer and above, excluding Core Investment Companies. The full framework:

A board-level IT Strategy Committee of at least three directors. Its chair is an independent director with at least seven years’ experience managing information systems or leading technology or cybersecurity initiatives. It meets at least quarterly (paras 71–72).
An Information Security Committee under the ITSC’s oversight, headed from the risk management vertical (para 77).
A CISO with an independent reporting line (paras 81–82; see below).
Source code for critical applications, or an escrow arrangement where the vendor will not hand it over (para 105).
Vulnerability assessment at least every six months and penetration testing at least every 12 months for critical systems and those in the DMZ with a customer interface (para 121). Cloud-hosted systems are in scope (para 126).
Disaster recovery drills at least half-yearly for critical systems (para 129), run on the DR site for at least a full working day (para 131).
Six-hour incident reporting on DAKSH plus a proactive notice to CERT-In (para 141).
IS audit under the Audit Committee of the Board, which approves the IS audit policy and reviews it at least annually (paras 149–150).

Proportionality is not an exemption. A Base Layer NBFC that grows past ₹500 crore moves from Chapter III to Chapter IV when it crosses the line, so plan the jump before it arrives.

Banks: The Fuller Framework

The commercial-bank Directions came into effect “immediately upon issuance” (para 2). Small finance banks, payments banks, All India Financial Institutions and credit information companies follow the same architecture with near-identical numbers. The paragraph numbers below are the commercial-bank ones; the other texts are a few paragraphs off. The main pieces:

Board committees. An ITSC of at least three directors, chaired by an independent director with at least seven years of IT or cybersecurity leadership experience, meeting at least quarterly (paras 16–18). An Information Security Committee headed from the risk vertical (para 23).
CISO. Designated, independent and reporting to the risk executive — the same rules as Chapter V for NBFCs (paras 27–28).
Assurance. Vulnerability assessment every six months and penetration testing every 12 months for critical systems and those in the DMZ with a customer interface (para 151), including cloud-hosted systems (para 154). Red-teaming is permitted, not mandated: the bank “may conduct” it (para 162).
Resilience. Half-yearly DR drills for critical systems (para 165).
Detection. A framework for a Cyber Security Operations Centre, sized to the bank’s risk profile (Chapter VI, from para 212).
Vendors. Source code or escrow for critical applications (para 90). A vendor-risk regime for IT and cyber third parties that fall outside the outsourcing Directions (paras 126–135).
Audit. IS audit under the Audit Committee of the Board, with a policy it approves and reviews at least annually (paras 224–225).

Urban co-operative banks have a shorter text, built in four levels. It still requires the six-hour DAKSH report and a CERT-In notice (paras 87–88). Every UCB names an official responsible for cybersecurity, “not necessarily designated as CISO” (para 104); a designated CISO is required only at Level IV (para 175).

The CISO Role — Independence by Design

The RBI CISO appointment requirement is the most prescriptive officer-level rule in the 2026 Directions. For commercial, small finance and payments banks, All India Financial Institutions, credit information companies and NBFCs in the Middle Layer and above, it has five parts:

Seniority. A senior-level executive, “preferably in the rank of a General Manager or an equivalent position”.
No IT reporting line. No direct reporting relationship with the Head of IT.
No business targets. This rules out a CISO who also carries a product P&L.
Reporting line. The CISO reports directly to the Executive Director, or equivalent executive, overseeing the risk management function.
Board visibility. At least quarterly, the CISO places a review of cybersecurity risks, arrangements and preparedness before the Board, its Risk Management Committee or the ITSC.

The CISO is also a permanent invitee to the ITSC and the IT Steering Committee, and the CISO’s office manages the security operations centre.

An “IT head who is also the CISO”, or a CISO inside the CTO’s organisation, fails these rules. Plan a clean re-appointment, not a re-labelling. Level IV urban co-operative banks follow a shorter rule: a sufficiently senior CISO who reports to the top executive overseeing risk or, failing that, to the MD and CEO (para 175).

Chapter IV NBFCs (Base Layer, ₹500 crore and above) have no named CISO paragraph. They must still resource the information security function adequately and segregate duties such as system and database administration. Appointing a CISO early is the cheapest way to prepare for the move to the Middle Layer.

Cyber Incident Reporting — RBI’s Own Six-Hour Clock

The headline in the RBI incident reporting guidelines cyber is that the 2026 texts state RBI’s six-hour clock in RBI’s own words. The NBFC text reads: “The NBFC shall report cyber incidents to RBI within six hours of detection on DAKSH platform … The NBFC shall also pro-actively notify Indian Computer Emergency Response Team (CERT-In) regarding cyber incidents” (para 141). The commercial-bank wording is the same (para 182). Housing finance companies keep reporting to the National Housing Bank, not RBI.

That gives most regulated entities two parallel duties:

RBI: within six hours of detection, on DAKSH (Reserve Bank’s Advanced Supervisory Monitoring System).
CERT-In: within six hours of noticing the incident, under CERT-In’s Directions of 28 April 2022 issued under Section 70B(6) of the IT Act. These bind every body corporate in India, whatever its regulator.

The older advice — “RBI’s text says ‘promptly’; the hard six-hour clock is CERT-In’s” — is now wrong for every entity under these Directions except Chapter III NBFCs (see below).

One gap is worth knowing. The Chapter III baseline (Base Layer below ₹500 crore and Core Investment Companies) does not itself state the DAKSH clock, but CERT-In’s six-hour rule still applies. Build one runbook that meets both clocks.

Making six hours real takes an on-call rota, a written trigger for classifying an incident, a pre-filled initial report covering the DAKSH and CERT-In fields, a named escalation path to the CISO and the Information Security Committee, and a log that proves when detection happened. Without that log, you cannot show the clock was met. Analyse every incident for severity, impact and root cause, and record the corrective actions (para 140 for NBFCs).

Business Continuity and Disaster Recovery — Tested, Not Promised

The RBI business continuity plan NBFC requirement rises with your layer:

Chapter III needs a board-approved BCP policy with at least annual board oversight, plus tested backups.
Chapter IV adds a full business continuity and DR section.
Chapter V and the commercial, small finance and payments bank texts add hard numbers. DR drills must run at least half-yearly for critical systems. Other systems follow your risk assessment (NBFC para 129; bank para 165).

Three requirements matter most in practice.

The drill must be real. DR testing means “switching over to the DR / alternate site and thus using it as the primary site” for at least a full working day, from beginning of day to end of day (para 131). A failover that ran for twenty minutes on a Sunday does not meet this.

Findings must close before the next cycle. Major issues from a DR drill must be fixed and re-tested before the next drill (para 130).

Backups must be restorable. The NBFC must back up data and periodically restore it to prove it is usable (para 133). The BCP and DR policy should follow recognised practice such as ISO 22301 (para 127).

Cloud does not change any of this. A provider’s multi-region SLA is evidence for your BCP, not a substitute for it. The RTOs, RPOs, drill reports and board review must be your own.

Information Systems Audit

The RBI IT audit NBFC requirements sit in two places:

Chapter IV NBFCs: IS audit “may be conducted at least once in a year”, ideally before the statutory audit so its findings feed in (para 56).
Chapter V NBFCs and the bank texts: the Audit Committee of the Board owns IS audit oversight and approves an IS audit policy. That policy defines the mandate, the audit universe and the periodicity (NBFC paras 149–150; bank paras 224–225). The committee reviews the policy at least annually (NBFC para 150; bank para 225).

For Chapter IV NBFCs, IS auditors “shall act independently of NBFCs’ Management both in attitude and appearance” (para 55). Chapter V NBFCs and banks need a separate IS audit function within Internal Audit, and the responsibility stays with the entity when outside auditors do the work (NBFC para 152; bank para 227). The common failure is an outsourced audit with no internal owner for scope, follow-up and closure. Track every finding to closure and show the Audit Committee the closure evidence.

Outsourcing and Third Parties

First, the April 2023 Master Direction on Outsourcing of Information Technology Services has been withdrawn — it is on RBI’s withdrawn-circulars list (Department of Regulation table). Outsourcing now sits in the entity-class “Managing Risks in Outsourcing” Directions, 2025, dated 28 November 2025.

Second, the 2026 cyber Directions cover technology vendors that fall outside those outsourcing Directions. For NBFCs in the Middle Layer and above (para 117) and for banks (paras 126–135), the texts require a vendor-risk process proportionate to risk and materiality. The process must mitigate concentration risk and single points of failure and address conflicts of interest. Add the source-code and escrow rule for critical applications (Chapter V NBFCs and banks), and every critical software vendor relationship needs a documented answer to “what happens if this vendor fails?”

A practical vendor register records, for each IT vendor, the governing instrument, materiality, audit and breach-notification terms, data location, the exit plan and, for critical applications, the source-code or escrow arrangement.

Digital Payment Security

RBI issued separate Digital Payment Security Controls Directions, 2026 on the same day for commercial banks (RBI/DoS/2026-27/411), small finance banks (/420), payments banks (/429), urban co-operative banks (/438) and NBFCs (/462).

For banks and urban co-operative banks it applies to their digital payment products and services. For NBFCs it applies only to NBFCs that issue credit cards, for their digital payment products (para 3 of the NBFC text): if that is you, read it alongside the cyber Direction. It covers the governance of payment security risks, the application security life cycle, an authentication framework, fraud risk management, and specific controls for web applications, mobile applications and card payments.

If your NBFC or a group company is an authorised non-bank payment system operator — a prepaid payment instrument (wallet) issuer or a payment aggregator, for example — the Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (30 July 2024) still apply on top. They remain on RBI’s list of current Master Directions.

Customer Liability for Unauthorised Transactions (Banks, from 1 January 2027)

For banks, RBI has also rewritten the rules on unauthorised electronic banking transactions. The commercial-bank version is the Responsible Business Conduct Third Amendment Directions, 2026 (RBI/2026-27/167, 24 June 2026). Matching amendments exist for small finance banks, payments banks, local area banks, regional rural banks, urban co-operative banks and rural co-operative banks. The new rules apply to electronic banking transactions “on or after January 1, 2027”. Among the changes:

Instant SMS alerts are mandatory for every electronic transaction above ₹500.
For credit-card frauds, the bank must make a “shadow reversal” of the disputed amount within five calendar days of the customer’s notice.
A new small-value compensation scheme applies. An individual victim (including a sole proprietor) with a bona fide gross loss of up to ₹50,000 gets 85% of the net loss or ₹25,000, whichever is less. The scheme can be used once in a lifetime. The victim must have reported the fraud on the National Cyber Crime Reporting Portal or helpline 1930, and to the bank, within five calendar days. RBI bears most of the cost with the customer’s bank; for domestic frauds the beneficiary bank pays a share too.

NBFCs are not covered by this amendment. An NBFC partnering with a bank on cards or co-lending will still feel it through the partner’s contracts and fraud-handling processes.

The RBI Cybersecurity Compliance Checklist

A working RBI cybersecurity compliance checklist for an NBFC or smaller bank under the 2026 Directions. Items marked ★ apply in full to NBFCs in the Middle Layer and above and to banks. For other NBFCs, scale them to your chapter.

Correct Direction identified for your entity class and, for NBFCs, your chapter (III, IV or V). All citations to the 2023, 2016 and 2017 instruments removed from policies.
Board-approved technology and cybersecurity strategies and policies, reviewed at least annually.
IT Strategy Committee constituted to your chapter’s rules (★ three directors, an independent chair with at least seven years’ IT experience, quarterly meetings; Chapter IV: independent chair, CIO and CTO as members, no more than six months between meetings).
★ Information Security Committee, headed from the risk vertical.
★ CISO appointed: senior, no Head-of-IT reporting line, no business targets, reporting to the risk executive, quarterly cyber review to the Board, RMCB or ITSC.
Incident runbook that meets both six-hour clocks: DAKSH (RBI) and CERT-In. Chapter III NBFCs: CERT-In’s clock. Housing finance companies use NHB instead of RBI.
★ VA every six months and PT every 12 months for critical systems and those in the DMZ with a customer interface, cloud-hosted systems included.
BCP with RTOs and RPOs by system. ★ Half-yearly DR drills on the DR site for a full working day. Re-test before the next cycle. Prove that backups restore.
IS audit: “may be conducted at least once in a year” (Chapter IV), or under an IS audit policy the Audit Committee of the Board approves and reviews yearly (★).
Vendor register mapped to the outsourcing Directions or the cyber Directions’ third-party paragraphs. ★ Source code or escrow for every critical application.
Payment channels assessed against the Digital Payment Security Controls Directions (for NBFCs, only credit-card issuers are covered), and the PSO Master Directions if you are an authorised payment system operator.
Board and staff awareness programme on the RBI cyber security guidelines for NBFC and bank obligations, refreshed for the 2026 text.

If you hold evidence against every line — minutes, drill reports, audit closures, incident logs — you have the substance. If you hold documents without that evidence, you have only the form.

Penalties and Supervisory Consequences

The 2026 Directions set no fines of their own. They are issued under RBI’s statutory powers, and enforcement runs through the same laws: for banks, the Banking Regulation Act, 1949 (sections 27 and 35-A, read with section 56 for urban co-operative banks; the commercial-bank text also cites the RBI Act, 1934); for NBFCs and All India Financial Institutions, sections 45-L and 45-M of the RBI Act, 1934; for credit information companies, sections 10 and 11 of the Credit Information Companies (Regulation) Act, 2005. RBI’s penalty powers sit in those Acts, not in the Directions. In practice, IT-governance gaps surface through supervision first. The likeliest cost of weak IT governance is slower growth, not a headline fine.

A Realistic Implementation Plan

The Directions are already in force, so this is a gap-closure plan, not a run-up.

Weeks 0–4: map and re-cite.

Confirm your Direction and, for NBFCs, your chapter.
Re-cite every policy, board note and audit programme to the 2026 text.
Gap-assess committee composition and the CISO reporting line first. These take longest to fix.

Months 1–3: fix the structure.

Re-constitute the ITSC to your chapter’s rules.
Set up or re-charter the Information Security Committee.
Re-appoint the CISO cleanly if the reporting line or targets are wrong.
Rebuild the incident runbook around the two six-hour clocks and test it with a table-top exercise.

Months 3–6: prove the controls.

Run the first VA/PT cycle against the six-month and 12-month cadence, with cloud in scope.
Run a full-day DR drill.
Restore from backup.
Bring the vendor register and escrow arrangements up to date.
Align the IS audit plan and present the first quarterly CISO review.

Month 6 onwards: run the cycle — half-yearly DR drills, six-monthly VA, quarterly committee meetings, yearly policy reviews — and keep the evidence as you go. For a Base Layer NBFC approaching ₹500 crore, add one more step: write down how you will meet Chapter IV before you cross the threshold.

Closing — Substance Over Form

The 2026 Directions are built around named committees, officers, cycles and clocks. A supervisory review will look for both the document and the proof: the policy and the minutes, the BCP and the drill report, the runbook and the time-stamped DAKSH submission.

For Base Layer NBFCs, Chapters III and IV largely restate the now-repealed 2017 IT Framework; the visible addition is the six-hour DAKSH line in Chapter IV (para 28). Start with the right chapter. Then fix the committees and the CISO line. Then make the six-hour runbook real. Then collect the evidence. The order matters.

Download the free RBI Cyber & IT Compliance Roadmap to sequence the committee, CISO, incident-reporting and assurance build-out.

This content is general educational information only and does not constitute legal, compliance, or professional advice. Regulatory requirements vary by entity type and change over time — verify against current official sources before acting.