RBI Cybersecurity Framework 2026: The Controls Banks and NBFCs Must Implement

TL;DR

• The 2016 Cyber Security Framework no longer exists- The RBI repealed it on 31 July 2026, along with the 2023 IT Governance Master Direction.

• Seven new Directions replaced it- one per entity class, effective the day they were issued. No transition period.

• NBFCs are directly in scope for the first time- Which chapter binds you depends on your layer and asset size.

• The CISO reporting line is now a regulated control- No reporting to the Head of IT, no business targets.

• SOC staffing tiers are written into the text- L1 round the clock, L2 root cause, L3 forensics.

• Two six-hour clocks- RBI via DAKSH, and CERT-In, both from detection.

• If your policies cite the 2016 circular, your documentation is already out of date.

What is the RBI cybersecurity framework in 2026?

Since 31 July 2026, it is seven consolidated Directions from the RBI's Department of Supervision, one per class of regulated entity. Each is titled "Cybersecurity, Technology: Risk, Resilience and Assurance Framework" and each took effect immediately on issuance.

They replaced the June 2016 Cyber Security Framework circular, the November 2023 Master Direction on IT Governance, outsourcing directions, digital payment security controls and a long tail of individual circulars, all repealed the same day.

Which RBI Direction applies to your institution?

All seven were issued on 31 July 2026. The commercial banks Direction runs to eight chapters and 233 paragraphs; the NBFC Direction to six chapters and 158 paragraphs.

Two scoping points:

• Small finance banks, payments banks and local area banks are carved out of the commercial banks instrument. The paragraph numbers your consultant is quoting may not apply to you.

• EXIM Bank, NABARD, SIDBI, NHB and NaBFID fall under the All India financial institutions Direction, not the banks one.

Foreign banks in branch mode may follow comply-or-explain for specified paragraphs.

Which chapter applies to an NBFC?

Three alternative obligation chapters. Exactly one binds you.

Housing finance companies are in scope, since the Direction binds NBFCs registered under the National Housing Bank Act, 1987 as well as the RBI Act, 1934 and the Factoring Regulation Act, 2011. HFCs report incidents to the NHB rather than the RBI.

A caution on the Base Layer threshold. Most published summaries state ₹500 crore. One reading of the text puts ₹2,500 crore in paragraph 3(3), with the chapter heading showing the lower figure. If your balance sheet sits between those numbers, confirm against the RBI text with legal sign-off rather than taking a blog's word for it, including ours. Chapter III and Chapter IV are materially different control sets.

What governance controls does RBI now require?

Structural requirements, not technical ones. No product fixes them.

• Board approval and annual review of IT strategy, information asset policy, business continuity, information security and cybersecurity policy.

• IT Strategy Committee: at least three directors, chaired by an independent director with at least seven years of substantial IT experience, meeting at least quarterly.

• IT Steering Committee: quarterly.

• Information Security Committee: under ITSC oversight, headed by someone from risk management, not IT.

• CISO: preferably General Manager level. Must not report to the Head of IT. Must not carry business targets. Reports to the executive director overseeing risk, presents a cyber risk review to the Board, RMC or ITSC at least quarterly, and is a permanent invitee to both committees.

If your CISO currently sits under your CIO, that is a finding waiting to be written up. It is a reporting change, not a project.

For many mid-sized NBFCs the hardest requirement is the independent director with genuine IT depth. That takes months to recruit.

What does RBI require from a Cyber Security Operations Centre?

Chapter VI of the commercial banks Direction, paragraphs 212 to 223.

• A CSOC with its own governance: policy, dashboards and oversight, not just a SIEM licence.

• Specified capabilities: log collection, SIEM correlation, alert generation, honeypot services and indicator-of-compromise collection.

• Three staffing tiers: Level 1 monitoring round the clock, Level 2 specialists for root cause analysis, Level 3 for advanced forensics and malware analysis.

Level 1 alone means three shifts, seven days, which is six to eight analysts once you account for leave and attrition. Add L2 and L3 and you are staffing a function, not filling a role.

The Directions allow a managed provider. What they do not allow is treating this as a licence purchase. The capability must exist, be evidenced and be governed.

NetNXT maps these requirements into a managed security operations service with the L1, L2 and L3 structure the text describes, run from India-located SOCs. Our 24×7 monitoring and response blueprint sets out the operating model in detail.

What are the RBI incident reporting timelines?

Two clocks, same incident, different destinations.

• RBI: report through the DAKSH platform within six hours of detection. DAKSH is the RBI's supervisory monitoring system, launched in October 2022. HFCs report to the NHB instead.

• CERT-In: proactive notification required, under CERT-In's own six-hour window from noticing a specified incident.

Three operational consequences:

1. Six hours from detection means detection has to happen. An incident found at 9 a.m. Monday that began Friday night has missed both windows by two days. This is a compliance argument for round-the-clock monitoring before it is a security one.

2. Somebody must be named and reachable. Not a mailbox. A person with DAKSH credentials, authority to file, and a deputy for leave.

3. Run the drill out of hours. A process only ever tested at 11 a.m. on a working day has not been tested.

The same accountability question applies here as to CERT-In-compliant providers generally: who is contractually responsible for filing.

The Directions also require incident response and recovery policies, escalation plans and a Cyber Crisis Management Plan.

What are the VA and penetration testing requirements?

• Vulnerability assessment at least every six months.

• Penetration testing at least every twelve months.

• Both apply to critical information systems and to DMZ systems carrying a customer interface.

• Non-critical systems follow a documented risk-based approach, so you need a defensible classification method.

• Testing must be by independent, trained experts. Your own team cannot test its own build.

• Closure status reported quarterly to the ITSC and the Information Security Committee.

That last point is where institutions fail inspections. Finding vulnerabilities is easy. Demonstrating a closed loop from finding to remediation to verification to committee sign-off, every quarter, with dates, is what the Direction asks for.

What are the business continuity and DR requirements?

• DR drills at least half-yearly for critical systems.

• DR tests must run production-equivalent operations for at least a full working day. Not a failover ping.

• DC and DR configurations and security patches must be identical. Drift is a finding.

• Backups must be restored and tested periodically. Having backups is not the control.

• DC and DR geographically separated, with near-zero RPO for critical systems and an RTO approved by the ITSC.

• For NBFCs, BCP policy should follow a recognised practice such as ISO 22301, tested at least annually.

What are the information systems audit requirements?

• The Audit Committee of the Board approves the IS audit policy and reviews it annually.

• A separate IS audit function within Internal Audit. Not a task someone picks up occasionally.

• Risk-based planning, with continuous auditing encouraged for critical systems where feasible.

• For NBFCs, IS audit at least annually, ideally before the statutory audit.

The problem here is evidence, not activity. An inspection asks for the policy, the Board approval date, the risk-based plan, scope coverage, findings, closure status and the minutes that reviewed them. Most institutions have all of it spread across four systems, and spend the first week of an inspection assembling it. Compliance automation turns that week into an export.

Is SAR reporting part of this framework?

No, and conflating the two is expensive.

• Different regime. The System Audit Report comes from the RBI circular on Storage of Payment System Data, 6 April 2018, under the Payment and Settlement Systems Act, 2007. It was not repealed by the 2026 Directions.

• Applies to system providers in connection with payment data localisation.

• The auditor must be CERT-In empanelled. Your internal or statutory auditor cannot sign it.

• Board approval is required before submission.

• It certifies operational facts, not policy. Per the RBI FAQ of 26 June 2019, it covers data storage, database maintenance, data backup restoration and data security.

• Originally one-time, on completion of localisation. Payment aggregators sit under a separate obligation, with the Master Direction of 15 September 2025 requiring an annual system audit including cyber security audit by CERT-In empanelled auditors.

If you operate a payment system, you have cyber obligations under the 2026 Directions and separate localisation audit obligations under the 2018 circular and your authorisation conditions. They are assessed separately. Read your own authorisation terms.

What happens to work already done under the old framework?

A savings clause preserves it. Action taken under the repealed instruments stays governed by them, and approvals already granted are deemed granted under the 2026 Directions.

Your completed audits, Board approvals and prior VA/PT cycles stand. The citations change. Four things to fix:

1. Policy references pointing to the 2016 circular or the 2023 Master Direction.

2. Control library, internal audit universe and RCSA mappings citing paragraph numbers that no longer exist.

3. Vendor contracts obliging suppliers to comply with the 2016 framework. New agreements need audit rights for you and the RBI.

4. Board papers. The next cyber risk review should state the transition and the gap position, because an inspection will look for evidence you noticed.

What does an RBI inspection check?

Enforcement follows a pattern: statutory inspection with reference to a given date, show-cause notice where non-compliance is found, then a published monetary penalty order.

The amounts are often modest. In July 2026 the RBI issued six penalty orders against NBFCs between 10 and 15 July, ranging from ₹2.70 lakh to ₹6.20 lakh. Those concerned KYC risk categorisation, asset classification, exposure limits and governance rather than cyber controls. For banks, the penalty power sits in Sections 46 and 47A of the Banking Regulation Act, 1949.

The fine is rarely the real cost. The published order, the supervisory attention that follows, and remediation on a regulator's timeline are.

Based on the structure of the Directions, expect an inspection to look for the CISO's reporting line on the organogram, ITSC composition and minutes, current VA/PT with quarterly closure reporting, half-yearly DR drill evidence covering a full working day, CSOC staffing across three tiers, and demonstrable DAKSH filing readiness.

How should banks and NBFCs close the gap?

The institutions that find inspections straightforward are not the ones with the most controls. They are the ones that produce evidence on request rather than assembling it under pressure. Access control is where this shows first: the Directions require ITSC-approved access control standards, and a Zero Trust access model produces that record as a by-product rather than a reporting exercise.

We rebuilt identity and access infrastructure for Arya ag ahead of its IPO-readiness programme, where auditable access control at scale was the driver.

Conclusion

Most of the technical controls were already expected. What changed is that governance structure, the CISO reporting line and SOC staffing tiers are now written requirements, effective immediately.

Fix governance first, because it is the finding you cannot close in a fortnight. Then make your evidence continuous.

Want your gaps mapped against the Direction that actually applies to you? Talk to NetNXT.

FAQs

1) Is the RBI Cyber Security Framework of 2016 still applicable?

No. The RBI repealed it on 31 July 2026, along with the November 2023 Master Direction on IT Governance and many related circulars. Seven entity-specific Directions replaced them, effective immediately. Work completed under the old instruments remains valid under a savings clause, but policies citing the 2016 circular now reference a repealed instrument.

2) Do the RBI cybersecurity directions apply to NBFCs?

Yes, directly. RBI/DoS/2026-27/461 binds NBFCs registered under the RBI Act, 1934, the Factoring Regulation Act, 2011 and the National Housing Bank Act, 1987, which includes housing finance companies. Three alternative chapters apply by layer and asset size, and exactly one binds a given firm. Core Investment Companies fall under the baseline chapter regardless of size.

3) What is the RBI incident reporting timeline?

Six hours from detection to the RBI through DAKSH, with proactive notification to CERT-In under its own six-hour window. HFCs report to the National Housing Bank instead. Both clocks run from detection, so the obligation depends on round-the-clock monitoring being in place.

4) How often does RBI require VA and penetration testing?

Vulnerability assessment at least every six months, penetration testing at least every twelve months, for critical systems and DMZ systems with a customer interface. Non-critical systems follow a documented risk-based approach. Testing must be independent, and closure status reported quarterly to the IT Strategy Committee and Information Security Committee.

5) Is SAR reporting part of the RBI cybersecurity framework?

No. The System Audit Report is a separate obligation under the RBI's 2018 circular on Storage of Payment System Data, issued under the Payment and Settlement Systems Act, 2007. It applies to system providers for payment data localisation, must be done by a CERT-In empanelled auditor, and needs Board approval before submission. It was not repealed by the 2026 Directions.