What Is the RBI Cybersecurity Framework for Financial Institutions? Who Must Comply?

What Is the RBI Cybersecurity Framework for Financial Institutions?

The RBI cybersecurity framework is the set of binding directions that defines how covered RBI-regulated entities must govern, protect, monitor and recover their technology and information assets. The framework covers IT governance, cybersecurity controls, information systems audit, business continuity and third-party technology risk.

Its current form includes the Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, issued separately for different categories of regulated entities.

For banks seeking practical guidance, Ampcus Cyber’s RBI Cybersecurity Framework for Banks explains how cybersecurity assessments and control implementation can support regulatory readiness.

How Has the RBI Cybersecurity Framework Changed in 2026?

The 2026 Directions establish entity-specific requirements for covered financial institutions. The original Cyber Security Framework in Banks, issued on 2 June 2016, set expectations for board-approved cybersecurity policies, a cyber crisis management plan and security operations capabilities.

RBI subsequently issued the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices on 7 November 2023, effective from 1 April 2024.

On 31 July 2026, RBI issued new Directions for covered entity classes and repealed specified earlier instructions. Actions taken under repealed instructions remain valid where the new Directions provide for their continuation. You can consult the applicable instruments through the RBI Master Directions portal.

RBI also issued separate Digital Payment Security Controls Directions, 2026 on the same day to address security requirements for digital payment products and services.

Who Must Comply With the RBI Cybersecurity Directions 2026?

The seven entity-specific Directions cover the following classes of financial institutions:

Commercial banks, including the State Bank of India and corresponding new banks.
Small finance banks.
Payments banks.
Urban co-operative banks (UCBs).
Non-banking financial companies (NBFCs).
All India Financial Institutions, namely EXIM Bank, NABARD, NaBFID, NHB and SIDBI.
Credit information companies.

The applicable obligations vary according to the regulated entity’s category, regulatory layer, asset size and digital exposure. Institutions should identify the specific Direction applicable to them rather than assume every requirement applies uniformly.

Capital market intermediaries are generally subject to the SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) for their SEBI-regulated activities.

NBFC applicability by layer

NBFC category	Applicable chapter	Depth of obligations
Base Layer with assets below ₹500 crore, and Core Investment Companies	Chapter III	Baseline cyber hygiene controls.
Base Layer with assets of ₹500 crore and above	Chapter IV	Governance, security, IS audit, BCP/DR and applicable incident-reporting requirements.
Middle, Upper and Top Layers, excluding Core Investment Companies	Chapter V	Broader framework requirements, including ITSC, CISO and IS audit, as applicable.

UCB levels by digital depth

UCB level	Digital criteria	Chapters applied
Level I	All UCBs	Chapters II and III
Level II	Sub-members of centralised payment systems (CPS) that offer internet banking or a mobile banking app, or that are direct members of CTS, IMPS or UPI	Adds Chapter IV
Level III	Direct CPS members, or banks running their own ATM switch or SWIFT interface	Adds Chapter V
Level IV	CPS members with both their own ATM switch and a SWIFT interface, or banks that host a data centre or provide software support to other banks	Adds Chapter VI and additional controls, including a C-SOC

Each UCB level carries the obligations of the levels below it. From Level II onward, UCBs must identify an official responsible for cybersecurity. The Directions clarify that this official does not necessarily have to be formally designated as the Chief Information Security Officer (CISO). A Cyber Security Operations Centre (C-SOC) is required at Level IV.

Technology vendors are also affected because regulated entities must address security, audit and incident-related obligations through structured third-party risk management and appropriate contractual provisions.

What Are the Key Requirements of the RBI Cybersecurity Framework?

Key requirements include board-led governance, appropriate CISO independence where prescribed, security monitoring, periodic security testing and recovery preparedness. Other entity classes follow requirements calibrated to their applicable Direction, category, layer or level.

IT Strategy Committee: The board must form a committee of at least three directors, chaired by an independent director with at least seven years of relevant experience, where this requirement applies.
Independent CISO: Under the relevant commercial-bank requirements, the CISO should preferably hold General Manager rank and must carry no business targets. The CISO must not report directly to the Head of IT and reports directly to the Executive Director, or equivalent, who oversees risk management. The CISO is a permanent invitee to the IT Strategy Committee and reviews cyber risk with the board, its risk committee or the ITSC every quarter, as prescribed by the applicable requirements.
Cyber Security Operations Centre: Banks subject to the C-SOC requirements must provide round-the-clock monitoring, with staffing across Level 1, Level 2 and Level 3 analysts. Entities can build this capability in-house or use a managed SOC service that provides 24×7 coverage and forensic support, subject to applicable regulatory requirements. Learn more about the role of a Security Operations Centre.
Third-party technology risk: Entities must assess vendor concentration, supply-chain exposure and data-handling risks. Applicable outsourcing arrangements must also comply with RBI’s separate Master Direction on Outsourcing of Information Technology Services, issued on 10 April 2023, where relevant. Organisations can strengthen these processes through structured third-party risk management.

Testing, Recovery And Reporting Cadence: Commercial-bank Baseline

The following table summarises requirements in the commercial-bank Direction. Other entity classes should follow their own applicable Directions and chapter-specific provisions.

Requirement	Frequency or deadline	Scope and conditions
Vulnerability assessment	At least every 6 months	Critical systems and customer-facing DMZ systems
Penetration testing	At least every 12 months	Applicable systems, with testing by independent experts
Vulnerability closure review	Every quarter	Closure status reported to the ITSC and Information Security Committee, as prescribed
Disaster recovery drill	At least every 6 months	Critical systems, with the DR site running as primary for one full working day
Incident report to RBI	Within 6 hours of detection	Through DAKSH where the applicable Direction requires it; housing finance companies report to NHB under the relevant provisions
Incident report to CERT-In	Within 6 hours for specified reportable incident categories	Separate reporting under Section 70B(6) of the IT Act

Data centre and disaster recovery configurations, including security patches, must meet the consistency requirements prescribed by the applicable Direction.

When Must Cyber Incidents Be Reported to RBI and CERT-In?

Covered entities must follow the incident-reporting requirements in their applicable RBI Direction. Where the six-hour requirement applies, cyber incidents must be reported to RBI within six hours of detection through DAKSH, RBI’s supervisory monitoring platform. Under the NBFC Directions, housing finance companies continue to report cyber incidents to NHB.

Entities must also meet their separate CERT-In reporting obligations under the Directions issued pursuant to Section 70B(6) of the Information Technology Act in April 2022. CERT-In’s six-hour reporting window applies to the specific reportable incident categories listed in those Directions, not indiscriminately to every security alert.

Organisations should maintain reporting procedures that identify the applicable reporting trigger, authority, deadline and escalation owner. A defined severity matrix and clear escalation responsibilities help teams determine when an event meets the relevant reporting threshold.

Organisations can also review their incident response processes to improve readiness, escalation and recovery coordination.

Why Does RBI Cybersecurity Compliance Matter for Boards and CISOs?

RBI cybersecurity compliance matters because the Directions establish responsibilities for boards and senior management in overseeing technology risk and resilience. Supervisors review cyber posture during inspections, and RBI may exercise applicable enforcement powers, including monetary penalties where authorised under the relevant legislation.

A KPMG analysis of the July 2026 Directions, published on 1 September 2026, highlights active oversight by boards, risk functions and security teams as a central expectation.

Financial institutions should map these governance responsibilities to the specific Direction applicable to their entity and retain evidence that demonstrates how the prescribed controls operate.

How Can Financial Institutions Prepare for RBI Cybersecurity Compliance?

Financial institutions can prepare by mapping current controls to the applicable paragraphs, closing structural gaps and building evidence that inspectors can verify:

Confirm the exact Direction and chapter that apply to your entity class, layer or level.
Run a gap assessment that maps existing policies and controls to the 2026 paragraphs.
Review CISO reporting lines and committee calendars against the applicable requirements.
Validate C-SOC coverage, log sources and the relevant incident-reporting workflow.
Recalibrate VAPT and disaster recovery drill schedules against regulatory requirements, critical-system risks and approved recovery objectives.
Update vendor contracts with applicable audit rights, incident notification and exit clauses.

A readiness assessment should examine whether cybersecurity responsibilities are independent of IT operations where required, whether recovery tests validate approved recovery objectives, and whether vendor contracts contain appropriate incident notification provisions.

Mid-sized NBFCs and UCBs can also assess whether a virtual CISO service would help address applicable governance and security leadership requirements.

Map Your Controls to RBI Requirements with Ampcus Cyber

Assess your RBI compliance gaps, strengthen cyber defences and access expert virtual CISO guidance. Book Your RBI Cybersecurity Gap Assessment.