RBI IT Governance and Cybersecurity Directions 2026 for Banks and NBFCs

RBI IT governance requirements tell banks, NBFCs and other entities regulated by the Reserve Bank of India how to govern technology, manage cyber risk and stay resilient. On 31 July 2026, RBI issued entity-wise Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, with immediate effect. They consolidate and replace the November 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices and older cyber security instructions for each type of entity.

For fintech companies, software vendors and IT service providers in India, these directions matter because regulated entities must apply them to their own systems and to the technology they buy. This guide explains who is covered, the governance structure, key security and resilience requirements, incident reporting, IS audit, third-party oversight and how vendors can prepare. It uses the NBFC directions for detailed examples; banks and other entities have their own versions with similar structure.

What are the RBI technology directions?

RBI regulates banks, NBFCs, payment system operators and other financial entities in India. Over the years it issued many circulars on IT and cyber security, including the 2016 Cyber Security Framework for banks and the 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices, which took effect on 1 April 2024. As part of a wider effort to consolidate regulations entity by entity, RBI issued the 2026 Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions on 31 July 2026, together with Digital Payment Security Controls Directions.

The NBFC version, for example, states that it comes into force with immediate effect, and that existing directions, instructions and guidelines relating to the IT framework and IT governance for NBFCs stand repealed. Separate versions apply to commercial banks, small finance banks, credit information companies and all-India financial institutions.

Who must comply?

• Commercial banks and small finance banks, under their own versions.
• NBFCs, with requirements scaled by layer and size under RBI's scale-based regulation.
• Credit information companies.
• All-India financial institutions such as EXIM Bank, NABARD, SIDBI, NHB and NaBFID.

The NBFC directions use three tiers:

NBFC tier	Requirements
Base layer with assets below Rs 500 crore, and core investment companies	Baseline cybersecurity and resilience requirements.
Base layer with assets of Rs 500 crore and above	IT governance, IT policy, information and cybersecurity, IT operations, IS audit, BCP and DR, and IT services outsourcing.
Middle layer and above (excluding core investment companies)	Full IT governance including a board IT Strategy Committee, IT and information security risk management, cybersecurity and resilience controls, and IS audit.

Technology vendors are not regulated directly but must support their clients' compliance through contracts, audit rights, security controls and incident reporting.

Is it mandatory or voluntary?

Mandatory for regulated entities in scope. RBI supervises compliance through on-site inspections, off-site monitoring and supervisory reporting, and can impose monetary penalties and business restrictions. There is no certification, though regulated entities often use ISO/IEC 27001, ISO 22301 and PCI DSS to structure and evidence controls.

Governance structure

For NBFCs in the middle layer and above, the directions require:

• Board responsibility for approving IT strategy and policies, including information security, cybersecurity, business continuity and incident response, reviewed at least annually.
• IT Strategy Committee (ITSC) of the board, with at least three directors, chaired by an independent director with substantial IT expertise, with technically competent members, meeting at least quarterly. It oversees IT strategy, governance, risk, capacity and access standards.
• IT Steering Committee at senior management level with IT and business representation, meeting quarterly, to assist the ITSC with planning, performance, business continuity and architecture.
• Information Security Committee under the ITSC, headed from the risk management function and including the CISO, to develop security policies, oversee projects and review incidents and audit findings.
• Head of IT Function, a senior and technically competent official responsible for executing IT strategy and controls.
• Chief Information Security Officer (CISO), a senior executive, preferably at General Manager level, with no direct reporting line to the Head of IT and no business targets, appointed for a reasonable minimum term and adequately staffed.

Information security and cybersecurity controls

The directions require board-approved information security and cybersecurity policies and a range of controls, including:

• Asset inventory and classification of information systems by criticality.
• Identity and access management with least privilege, periodic access reviews and controls on privileged access.
• Network security, segmentation and secure configuration baselines.
• Patch and vulnerability management with defined timelines.
• Security of applications, including secure development, testing before deployment, and audit trails.
• Data security, including encryption and data leak prevention.
• Security monitoring through a security operations centre or equivalent, with log retention.
• Protection against fraud techniques such as phishing, vishing and SIM swap, and customer awareness.
• Cyber crisis management plans aligned with CERT-In guidance.

Vulnerability assessment and penetration testing

For critical information systems and systems in the demilitarised zone with customer interfaces, the NBFC directions require vulnerability assessment at least once every six months and penetration testing at least once every 12 months, plus testing before and after implementation and after changes, including for cloud-hosted systems. Testing must be done by appropriately trained teams independent of those who build and run the systems, with a documented approach covering scope, coverage and a vulnerability scoring method such as CVSS. Findings must be tracked to closure.

Awareness, training and culture

The directions treat people as part of the control system. The board and senior management must have a fair understanding of cyber threats, supported by familiarisation programmes. Staff need regular security awareness training tailored to their roles, with extra training for IT, security and privileged users. Entities are also expected to promote cyber awareness among customers, vendors and service providers, for example by warning customers about phishing and social engineering, and by including vendors in awareness and incident exercises. For fintech vendors, this often means attending client security briefings and running their own training that clients can review.

Cloud-hosted systems

Many regulated entities now run core and customer-facing systems on public or community cloud. The directions apply the same expectations whatever the hosting model: cloud-hosted systems are included in VAPT, DR drills, access control and monitoring, and cloud providers are third parties subject to due diligence, contracts and monitoring. Entities must understand the shared responsibility model, keep control of encryption keys and administrative access where possible, ensure data location requirements are met, and make sure RBI's audit rights extend to the arrangement. Infrastructure as code, configuration scanning and centralised logging help demonstrate control in cloud environments.

Business continuity and disaster recovery

• A BCP and DR policy following best practices such as ISO 22301, updated after major changes.
• Recovery time objectives (RTO) approved by the ITSC and near-zero recovery point objectives (RPO) for critical systems, with a documented data reconciliation method when RPO is not zero.
• DR drills for critical systems at least half-yearly, involving switching to the DR site and running it as primary for a sufficient period. Major issues must be fixed and retested before the next cycle.
• Regular backup testing and protection of backup integrity.
• Configurations and patches at DR kept consistent with production.

Cyber incident reporting

Regulated entities must report cyber incidents to RBI within six hours of detection through DAKSH, RBI's supervisory monitoring platform, and proactively notify CERT-In, which separately requires reporting within six hours under the CERT-In Directions. Housing finance companies continue to report to the National Housing Bank. Entities must also analyse incidents for severity, impact and root cause and take corrective action.

Information systems audit

Entities must have an IS audit function or engage qualified external auditors, under oversight of the board's audit committee, using a risk-based audit plan that covers IT governance, security, operations, BCP and outsourced services. The directions encourage continuous auditing approaches for critical systems.

IT services outsourcing and third parties

RBI treats outsourcing of IT services as a regulated activity. Entities must assess risks before outsourcing, perform due diligence, sign contracts with security, confidentiality, audit and termination clauses, ensure RBI's access to records and premises, monitor service providers, and keep exit plans. The NBFC directions include IT services outsourcing requirements for larger base layer NBFCs, while RBI's outsourcing directions remain a separate regime for other entities. The cybersecurity directions also cover third-party technology arrangements that fall outside outsourcing rules, such as some software licences and cloud tools.

Vendors should expect clauses requiring compliance with the entity's security policies, data localisation where applicable, incident reporting within short timelines, VAPT of delivered systems, source code escrow or access in some cases, and audits by the entity, its auditors and RBI.

Digital Payment Security Controls Directions

Issued on the same day and building on RBI's 2021 Master Direction on digital payment security controls, the Digital Payment Security Controls Directions require a board-approved policy for digital payment products, including mobile and internet banking, cards, UPI and wallets, and controls such as multi-factor authentication, transaction limits and alerts, device binding, fraud monitoring, secure application development, and controls over related non-financial transactions like PIN changes and OTP generation. Fintech vendors building these products for banks must design them to these controls.

How regulated entities comply, step by step

1. Identify the applicable version and tier for the entity.
2. Map existing controls from the 2023 Master Direction and cyber framework to the 2026 directions, noting changes.
3. Constitute committees and confirm the CISO's independence.
4. Update board-approved policies for IT, information security, cybersecurity, BCP, DR and outsourcing.
5. Classify critical systems and schedule VAPT and DR drills.
6. Set up six-hour incident reporting to RBI and CERT-In.
7. Review vendor contracts for required clauses.
8. Plan risk-based IS audits.

How vendors and fintechs can prepare

• Maintain ISO/IEC 27001 certification or a SOC 2 report as baseline evidence.
• Deliver applications with security testing evidence and support independent VAPT.
• Provide audit trails, role-based access and admin activity logs in products.
• Commit to incident notification within a few hours so clients can meet the six-hour deadline.
• Host and process data in India where clients require it, and document data flows.
• Support DR drills with documented runbooks and tested failover.
• Accept audit clauses and respond to questionnaires quickly.

Documentation you will need

• Board-approved IT strategy and policies.
• Committee charters and minutes.
• CISO appointment and reporting structure.
• Asset inventory and criticality classification.
• VAPT reports and remediation tracking.
• BCP and DR plans, drill reports and RTO and RPO approvals.
• Incident reports to RBI and CERT-In.
• IS audit plans and reports.
• Outsourcing and third-party risk assessments and contracts.

Common mistakes

• Still referencing repealed circulars in policies after July 2026.
• CISO reporting to the CIO or carrying business targets.
• DR drills that never switch production to the DR site.
• VAPT only on the main app, missing APIs and admin portals.
• Vendor contracts without incident timelines or audit rights.
• No reconciliation method when RPO is not zero.

Best practices, tools and technologies

• Use a GRC tool to map controls to each paragraph of the applicable directions.
• Automate vulnerability scanning in CI/CD and schedule independent penetration tests.
• Run a SOC with SIEM correlation and playbooks for six-hour reporting.
• Use infrastructure as code so DR environments match production.
• Adopt privileged access management for admins and vendors.

We build banking and lending software with audit trails, role-based access, secure APIs and tested recovery through our web application, API integration and maintenance and support services.

How it relates to other frameworks

Framework	Relationship
RBI payment data localisation	Requires payment system data to be stored only in India.
CERT-In Directions	National six-hour incident reporting and log retention rules.
SEBI CSCRF	Equivalent framework for securities market entities.
DPDP Act	Personal data protection duties alongside RBI rules.
ISO/IEC 27001	Common way to structure and evidence security controls.

Real-world example

A middle layer NBFC offering digital personal loans uses a Bengaluru fintech vendor for its loan origination platform. After July 2026, it updates policies to reference the new directions, classifies the platform as critical, and requires the vendor to support half-yearly vulnerability assessments, annual penetration tests and half-yearly DR drills that switch traffic to the DR region. The contract requires the vendor to report incidents within two hours, keep data in India, maintain audit logs for admin actions, and allow audits by the NBFC, its IS auditors and RBI.

Next steps

1. Confirm the applicable 2026 direction and tier.
2. Gap-assess against the new text.
3. Update governance, policies and contracts.
4. Schedule VAPT, DR drills and IS audits.
5. Test six-hour incident reporting.

Frequently asked questions

Is the 2023 RBI IT Governance Master Direction still in force?

For the entities covered by the 2026 directions, the earlier IT governance instructions were repealed and replaced on 31 July 2026.

Who must follow the 2026 directions?

Commercial banks, small finance banks, NBFCs, credit information companies and all-India financial institutions, each under its own version.

How quickly must cyber incidents be reported to RBI?

Within six hours of detection, through the DAKSH platform, with proactive notification to CERT-In.

Does every NBFC need an IT Strategy Committee?

Middle layer and above NBFCs need a board-level ITSC; smaller NBFCs have lighter requirements.

How often is penetration testing required?

For critical and customer-facing DMZ systems, at least every 12 months, with vulnerability assessments every six months.

How often must DR drills be held?

At least half-yearly for critical information systems.

Can the CISO report to the CIO?

No. The CISO must not report directly to the Head of IT and must not have business targets.

Do these directions apply to fintech vendors?

Not directly, but regulated entities must pass requirements to vendors through contracts and oversight.

Did RBI give a transition period?

The directions came into force immediately on 31 July 2026; entities should update policies and references promptly.

What are the Digital Payment Security Controls Directions?

Companion directions issued the same day setting security controls for digital payment products and related transactions.

Is there certification for RBI compliance?

No. RBI supervises compliance; entities use frameworks such as ISO/IEC 27001 as supporting evidence.