RBI Cyber Security Framework: A Guide for Banks and NBFCs

Two points to hold onto before the detail. First, the framework is proportional: the depth of what you must do scales with your entity type and size, so a large bank and a small NBFC do not carry identical burdens, but neither carries zero. Second, RBI supervision looks for evidence, not intention. An inspector wants to see that your controls operate and that you can prove it, which makes documentation and assurance as important as the technology itself.

The framework in brief#

RBI has been raising its cybersecurity expectations for regulated entities for well over a decade, building on the recommendations of the Gopalakrishna Working Group of 2011 and a series of framework circulars for banks and cooperative banks. The consolidation that matters most now is the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, issued in November 2023 and effective from 1 April 2024. It gathers and supersedes a range of earlier instructions into a single, board-anchored rulebook covering how a regulated entity governs technology, manages IT and cyber risk, runs day-to-day controls, and independently assures that all of it actually works.

The style of the framework is principle plus prescription. It sets clear accountability at the top, the board, and then cascades responsibility through committees and named roles, while also prescribing specific practices such as periodic testing and audit. The direction of travel across all of it is unmistakable: more board accountability, more documentation, and more proof that controls are effective rather than merely present.

Who the framework applies to#

The IT Governance Master Direction applies broadly across the regulated financial sector. It covers scheduled commercial banks (excluding regional rural banks), small finance banks and payments banks, NBFCs in the specified layers under Scale Based Regulation, credit information companies, and the all-India financial institutions such as EXIM Bank, NABARD, NHB and SIDBI. Alongside it sit related instructions, including cyber resilience and digital payment security controls for non-bank payment system operators, and the sector-wide CERT-In incident reporting directions that apply to every body corporate.

For NBFCs, proportionality is the key idea, and it follows the Scale Based Regulation layers. Base Layer NBFCs with a small book and no digital lending carry lighter obligations, but not zero: they still need a board-approved IT and security policy, incident reporting capability, and basic controls, and the CERT-In reporting and log-retention rules apply to them like everyone else. The moment an NBFC moves into the Middle or Upper Layer, or runs a digital lending application, the safe assumption is that the full 2024 IT Governance framework applies and should be built for accordingly. A common and costly mistake is to assume small means exempt.

Governance comes first, and it is where inspections bite#

If there is one theme an inspector returns to, it is governance, because it is where the most common gap appears: a framework that exists on a slide deck but not in the running of the business.

The Master Direction fixes accountability at board level and then distributes it. Larger entities are expected to operate an IT Strategy Committee of the board, an executive-level IT Steering Committee, and clearly defined senior roles including a Head of IT and a Chief Information Security Officer with genuine independence from IT operations. The board is expected to approve the IT and cybersecurity strategy, review cyber risk and its appetite periodically, and be able to show it exercised real oversight.

In practice this means a board-approved cybersecurity policy that is distinct from general IT policy, a defined committee cadence with minuted meetings, and evidence that cyber risk is discussed and acted on at the top of the organisation, not buried several layers down. When RBI reviews governance, it is looking for exactly this trail. Documented ownership, exercised in practice, is the foundation everything else rests on.

The controls the framework expects#

Beyond governance, the framework expects a substantial set of technical and operational controls, scaled to your entity. The core areas most entities need to plan for include the following.

• Access and identity. Strong access management and privileged access controls, with least-privilege as the operating principle and regular review of who can reach what.
• Network and data protection. Segmentation between corporate and core systems, endpoint protection on critical systems, data loss prevention, and encryption of sensitive and customer data both at rest and in transit.
• Secure operations. Patch management against a documented timeline, secure configuration baselines, and logging and monitoring that can actually detect anomalies rather than simply collect data no one reviews.
• Resilience. A cyber crisis management plan, and business continuity and disaster recovery arrangements that are tested through real drills rather than merely documented. RBI supervision has repeatedly focused on whether continuity arrangements were actually exercised, so an untested DR plan is a visible weakness.
• Third-party and outsourcing risk. Board-approved outsourcing policies and active oversight of service providers, because responsibility for a control does not transfer just because the work does. When a critical service provider fails, the regulated entity still answers for the outage.

Testing: VAPT and IS audit#

Testing is one of the sharper edges of the RBI framework, and the expectations have moved well beyond a light annual scan.

Vulnerability Assessment and Penetration Testing is central. The framework's periodic expectation for critical systems is broadly vulnerability assessment on a half-yearly basis and penetration testing at least annually, with additional testing after any significant change, and tighter obligations for entities in the payments space. Supervisory reviews have shifted the question from whether you ran a scan to whether you ran a genuine penetration test, whether the findings were remediated, and whether they were re-tested to confirm closure. Reports must be available to inspectors, and an unremediated critical finding sitting open is a straightforward problem.

Alongside VAPT sits the information systems audit. The Master Direction expects periodic, independent IS audits that assess whether your IT governance, controls and assurance actually function. This is the independent check that ties the whole framework together, and its findings, with management responses and remediation timelines, form part of the evidence RBI expects to see.

Incident reporting, and the clock you must know about#

Incident reporting is an area where financial entities carry duties from two directions at once, and both run on tight clocks.

Under the RBI framework, significant incidents must be reported to the Reserve Bank within tight timelines, with a fuller root cause analysis to follow, and RBI operates a centralised incident reporting system for regulated entities. Separately, and applying to every body corporate in India including banks and NBFCs, the CERT-In directions require covered cyber incidents to be reported within six hours of noticing them. That six-hour window is short enough that it cannot be met by improvising on the day, so the practical requirement is to have detection, internal escalation and a named owner in place well ahead of any incident.

Prepare in advance. Register on the relevant reporting systems before you need them, define what counts as a reportable incident so your team recognises one, and keep ready templates and a maintained log. During an incident is the wrong time to work out who reports what to whom.

How the framework came together#

A short history helps make sense of why the framework looks as it does, and why NBFCs are now in scope.

The foundations were laid by the Gopalakrishna Working Group in 2011 and a series of cybersecurity framework circulars for banks and, later, cooperative banks. For NBFCs, the baseline was the 2017 Master Direction on Information Technology Framework for the sector. The significant consolidation came with the November 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices, effective April 2024, which superseded much of what came before and, importantly, brought NBFCs into the same assurance-led regime as banks. On top of this sit the digital lending guidelines and, for anyone touching payments, dedicated cyber resilience and digital payment security controls.

The practical position today is that these obligations are in force and RBI is actively supervising against them, including through enforcement action where entities fall short. Because the RBI periodically issues new and updated directions, always confirm the current instructions that apply to your specific entity type and layer before you act, rather than assuming a fixed position.

How we get you audit-ready#

RBI compliance is not only about deploying controls, it is about proving governance, continuous monitoring, incident readiness, resilience and oversight of both internal and outsourced systems. Because inspectors look for verifiable evidence, the work is as much about documentation and assurance as it is about technology. This is where an independent readiness adviser earns its place, and it is worth being clear about the line we sit on. We prepare you for supervisory scrutiny. We do not perform your statutory audit, and keeping that separation is part of an honest process.

A practical RBI readiness path looks like this.

1. First, confirm scope. We help you establish exactly which instructions apply to your entity type and, for NBFCs, your regulatory layer, so your effort is proportionate and nothing critical is missed.
2. Second, run a gap assessment. We measure your governance, controls, testing, incident readiness and outsourcing oversight against those requirements, and produce a clear, prioritised list of what is missing.
3. Third, close the gaps. We help you put board-approved policies, governance structures and technical controls in place in a form your team can sustain, get your VAPT done and remediated and re-tested, and make sure your DR and continuity arrangements are actually drilled.
4. Fourth, assemble audit-ready evidence. We help you organise the policies, committee minutes, test reports, logs and incident records into the trail an inspection expects, so you can demonstrate compliance rather than merely assert it.

There is a strong efficiency available to many entities. If you already run an information security management system aligned to ISO 27001, a great deal of the governance, risk and control structure the RBI framework expects already exists and can be mapped across rather than rebuilt. We explain how that foundation works on our ISO 27001 consulting page, and our broader cyber security advisory is built to get regulated financial entities ready for supervisory scrutiny.

One connection worth making, because it affects most financial entities. The RBI framework sits alongside your obligations under India's Digital Personal Data Protection Act, and the two share a great deal of security ground. If you are addressing data protection at the same time, our DPDP Act compliance checklist walks through what the Act asks, so you can align both efforts and avoid duplicated work.

Frequently asked questions#

Conformite Assist is an independent compliance advisory, helping organisations across 13 regions and four continents get audit-ready since 2011. We help you build and maintain compliance. We are not a certification body.

This article is for general information only and does not constitute legal or regulatory advice. RBI directions evolve, and regulated entities should confirm the instructions that apply to their specific entity type and layer. Details are accurate to the best of our knowledge at the time of writing, September 2026.