RBI cyber security for banks and regulated entities in India
RBI cyber security: from the 2016 framework to the 2026 Directions
What the 2016 Cyber Security Framework asked of banks, what the July 2026 Directions changed, who they apply to, how incident reporting to RBI and CERT-In works, and how to evidence your programme.
In short
RBI regulates cyber security and technology risk for the banks and financial institutions it supervises. For a decade the reference point was the Cyber Security Framework in Banks, a June 2016 circular that required a board-approved cyber security policy, a cyber crisis management plan, a security operations centre and fast reporting of unusual incidents. On 31 July 2026 RBI issued a new set of Directions on cybersecurity, technology risk, resilience and assurance, written separately for each type of regulated entity. They take the place of the 2016 framework and the 2023 IT Governance Master Direction for the entities they cover.
Three generations of RBI cyber rules
Most bank security programmes in India were built on the 2016 framework, then extended for the 2023 IT Governance Master Direction. The 2026 Directions consolidate that history into one rulebook per entity type. It helps to know the history, because your policies, evidence and audit findings probably still refer to the older documents.
| Instrument | Issued | What it did |
|---|---|---|
| Cyber Security Framework in Banks (RBI/2015-16/418) | 2 June 2016 | Required banks to adopt a board-approved cyber security policy, a cyber crisis management plan, a SOC and baseline controls, and to report unusual incidents quickly |
| Master Direction on IT Governance, Risk, Controls and Assurance Practices | 7 November 2023, effective 1 April 2024 | Consolidated earlier guidance on IT governance, risk, controls, assurance and business continuity for banks, NBFCs, credit information companies and all India financial institutions |
| Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 | 31 July 2026, in effect on issue | Entity-specific Directions covering technology governance, cyber security, operational resilience, third parties and audit; they replace the two instruments above for the entities they cover |
RBI's notice states that the Directions come into effect on issue. Summaries of the commercial-bank version report that its repeal paragraph withdraws the earlier cyber security and IT governance instructions for commercial banks. Read the version written for your entity type, including any saving provisions for actions taken under the earlier instruments.
What the 2016 framework required
The June 2016 circular was addressed to scheduled commercial banks, excluding regional rural banks. It built on RBI's 2011 guidance on information security and electronic banking, and it set out a few structural requirements that most bank programmes still reflect.
- A board-approved cyber security policy. Distinct from the broader IT or IS security policy, setting an approach to cyber threats suited to the bank's complexity and risk appetite.
- A cyber crisis management plan. How the bank detects, responds to, recovers from and contains a cyber incident.
- A security operations centre. Continuous surveillance of the environment, with periodic vulnerability testing.
- Baseline controls. A set of baseline cyber security and resilience controls, covering areas such as asset inventory, access control, secure configuration, patching, payment channels, vendor risk and audit logging.
- Incident reporting. Reporting of unusual cyber security incidents, successful or attempted, to RBI within two to six hours.
What changed with the 2026 Directions
Instead of one framework for banks and a separate master direction for everyone, RBI now issues a set of Directions for each type of regulated entity: commercial banks, small finance banks, payments banks, urban co-operative banks, NBFCs, credit information companies and all India financial institutions. The commercial bank version is RBI/DoS/2026-27/410.
The Directions bring technology governance, cyber security, operational resilience, third-party arrangements and audit into one document. Board and committee oversight and the role of the Chief Information Security Officer sit alongside IT risk management, incident response and business continuity.
Reporting a cyber incident to RBI and CERT-In
Reporting runs on two tracks. RBI expects regulated entities to report cyber incidents to it under the Directions; summaries of the commercial bank, NBFC and urban co-operative bank versions report a requirement to report on RBI's DAKSH platform within six hours of detection. Check the window in the version that applies to you.
Separately, CERT-In's Directions of April 2022, issued under section 70B of the IT Act, require body corporates and other covered entities to report cyber incidents to CERT-In within six hours of becoming aware of them. One report does not discharge the other.
| Recipient | Basis | Window |
|---|---|---|
| RBI (DAKSH) | RBI cybersecurity Directions, 2026 | Within 6 hours of detection, as summarised for the commercial bank, NBFC and urban co-operative bank versions; confirm for your entity type |
| CERT-In | CERT-In Directions, 28 April 2022 (in effect from 27 June 2022) | Within 6 hours of becoming aware |
Two six-hour windows can start from the same event. Agree in advance how incidents are classified, who makes that call, and how each report reaches RBI and CERT-In.
How RBI requirements relate to ISO 27001, PCI DSS and DPDP
RBI's Directions are supervisory requirements for its regulated entities. ISO 27001 is an international management system standard, PCI DSS applies wherever card data is handled, and NIST CSF 2.0 is a voluntary framework. Many Indian banks run several of these together, and much of the technical evidence (access reviews, patching, logging, vendor assessments) serves more than one.
The Digital Personal Data Protection Act 2023 adds a separate privacy regime with its own breach reporting to the Data Protection Board, phasing in from May 2027. A single cyber incident can therefore trigger RBI, CERT-In and DPDP obligations at once.
Moving a programme onto the 2026 Directions
Most programmes already have the 2016 structure in place. The work is to map it to the Directions for your entity type and close what is new.
-
01
Identify your version
Confirm which set of Directions applies to your licence and note any saving provisions for earlier actions.
Your compliance and legal teams
-
02
Map existing controls
Map the controls, policies and evidence built for the 2016 framework and the 2023 Master Direction to the new Directions.
Your compliance team, in Certifyi
-
03
Close the gaps
Record what the Directions add for your entity type, assign owners and track remediation against the risk register.
Your CISO and risk owners, in Certifyi
-
04
Prepare the reporting routes
Agree incident classification, the decision-maker, and the RBI and CERT-In reporting routes and windows.
Your incident response and compliance teams
-
05
Report to the board
Give the board and its committees a regular view of cyber risk, incidents, audit findings and remediation.
Your CISO, in Certifyi
Who does what
RBI supervises and inspects. The regulated entity owns its cyber security. Certifyi is software and does not report to RBI, DAKSH or CERT-In on your behalf.
| Task | Your team | Certifyi | RBI |
|---|---|---|---|
| Governance and policy | Board-approved policies and oversight | Holds policies, the risk register and board papers | Reviews during supervision and inspection |
| Incident reporting | Report to RBI and CERT-In within the required windows | Records incidents and response tasks | Receives reports |
| Third-party arrangements | Due diligence and oversight of technology vendors | Records vendor intake and risk assessments | Reviews arrangements |
| Resilience | Crisis management and continuity plans, tested | Holds continuity plans and test records as evidence | Reviews during inspection |
| Audit | Independent assurance over controls | Gives auditors scoped, read-only access to evidence | Considers audit results |
How Certifyi helps
Keep the RBI programme on one control set
Certifyi does not make you compliant with RBI requirements. Its catalogue framework is built on the 2016 circular. You map it to the Directions for your entity type and keep the evidence, incidents and vendor records in one place.
-
RBI framework in the catalogue
The catalogue includes the RBI Cyber Security Framework, built on the 2016 circular: 53 controls in 15 sections, from governance and asset inventory to payment channel security, SOC, incident reporting and the cyber crisis management plan.
-
One control set across frameworks
Map a control once to ISO 27001, PCI DSS and NIST CSF 2.0 in the unified frameworks module, and reuse the mapping across frameworks.
-
Vulnerabilities matched to assets
The vulnerability register matches your assets against the NVD and records each vulnerability as a risk.
-
Technology vendors
Run vendor intake and risk assessments in third-party risk. Vendors answer through their own portal rather than by email.
-
Auditor access
Give auditors scoped, read-only access to the evidence for their engagement. Every action on that evidence is written to a tamper-evident activity log.
Questions
RBI cyber security, answered
What is the RBI cyber security framework?
Usually the Cyber Security Framework in Banks, an RBI circular of 2 June 2016 that required banks to adopt a board-approved cyber security policy, a cyber crisis management plan, a security operations centre and baseline controls. In July 2026 RBI replaced it with entity-specific Directions on cybersecurity, technology risk, resilience and assurance.
Is the 2016 RBI cyber security framework still applicable?
For the entities covered by the July 2026 Directions, the 2016 framework and the 2023 IT Governance Master Direction are reported as replaced by the Directions' repeal provisions. Many controls carry over, so existing programmes are a starting point, but obligations now come from the Directions for your entity type.
Which entities do the RBI 2026 cybersecurity directions apply to?
RBI issued separate Directions for commercial banks, small finance banks, payments banks, urban co-operative banks, NBFCs, credit information companies and all India financial institutions. Read the version written for your licence.
What is the RBI cyber incident reporting timeline?
The 2016 framework asked banks to report unusual incidents within two to six hours. Under the 2026 Directions, summaries of the commercial bank, NBFC and urban co-operative bank versions report a six-hour window from detection, on RBI's DAKSH platform; check the window in your entity's version.
Does RBI reporting replace CERT-In reporting?
No. CERT-In's Directions of April 2022 separately require cyber incidents to be reported to CERT-In within six hours of becoming aware of them. Both reports are needed.
What is a Cyber Crisis Management Plan?
The plan RBI asked banks to keep for detecting, responding to, recovering from and containing a cyber incident. It works alongside business continuity and incident response arrangements, and it should be tested.
Is there an RBI cyber security certification?
No. RBI supervises and inspects regulated entities. Independent audit and assurance over controls are part of the requirements, but there is no RBI certificate.
Does Certifyi make us compliant with RBI requirements?
No. Compliance depends on your governance, controls and reporting. Certifyi is where you map, evidence and track them. Its RBI catalogue framework is built on the 2016 circular.
Map your RBI programme in a 30-minute call.
Bring your current cyber security policy or last inspection findings. We will show how the RBI controls, your evidence and your incident records fit together in Certifyi.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them