RBI Cyber Security Framework
cyber resilience expectations for India financial institutions
The Reserve Bank of India sets cyber security expectations across the regulated financial population through the 2016 Cyber Security Framework in Banks circular, the Master Direction on IT Governance, Risk, Controls and Assurance Practices effective 1 April 2024, and the Master Direction on Information Technology Governance and Information Risk Management for NBFCs. This page covers the tier classification, the cyber security policy, the Cyber Crisis Management Plan, VAPT cadence, CSITE examination, the CERT-In incident reporting timeline, and the evidence pack a workspace-driven programme keeps in one place.
No credit card required. Free plan available forever.
RBI cyber security in context: cyber resilience expectations for India financial institutions
The Reserve Bank of India sets cyber security expectations across the regulated financial population through three connected supervisory communications. The 2016 Cyber Security Framework in Banks circular (DBS.CO.CSITE.BC.NO.11/33.01.001/2015-16) issued 2 June 2016 anchors the foundational expectation for scheduled commercial banks. The Master Direction on IT Governance, Risk, Controls and Assurance Practices (DoS.CO.CSITEG.SEC.7/31.01.015/2023-24) issued 7 November 2023 and effective 1 April 2024 consolidates IT governance and information security expectations across scheduled commercial banks (excluding regional rural banks), small finance banks, payments banks, top-layer NBFCs, and credit information companies. The Master Direction on Information Technology Governance and Information Risk Management for NBFCs sets the equivalent expectation for top-layer and upper-layer non-banking financial companies. For an RBI-regulated institution, these documents are not optional reference material; they are the working framework the Department of Supervision Cyber Security and IT Examination Group (CSITE) examiner uses to read the cyber security programme.
RBI sits inside a wider international picture for financial-sector cyber security supervision. For European entities, the Digital Operational Resilience Act sets the comparable obligations, including threat-led penetration testing through the TIBER-EU framework. For UK entities, the CBEST scheme applies the intelligence-led approach under the Bank of England and the Financial Conduct Authority. For Hong Kong entities, the HKMA Cyber Resilience Assessment Framework runs an inherent risk, maturity, and iCAST sequence. For Singapore entities, the MAS Technology Risk Management Guidelines carry the equivalent obligation. For Australian entities, the APRA CPS 234 prudential standard applies. For US entities, the FFIEC IT Examination Handbook and the Cybersecurity Assessment Tool set the equivalent expectation. The RBI framework is the India equivalent, with the 2016 Cyber Security Framework in Banks circular and the Master Direction on IT Governance, Risk, Controls and Assurance Practices as the central references and CSITE as the examination function.
In-scope entities: who RBI cyber security expectations apply to
RBI cyber security expectations apply across the supervised population of the Reserve Bank of India. The depth of application is calibrated to the institution size, complexity, and risk profile rather than to a single threshold. The summary below is the working categorisation; the Reserve Bank of India and the RBI Department of Supervision remain the authoritative source for any specific scope question.
Scheduled Commercial Banks (SCBs)
Public sector banks, private sector banks, foreign banks operating in India, and the Indian operations of overseas-incorporated banks. The 2016 Cyber Security Framework in Banks circular and the Master Direction on IT Governance, Risk, Controls and Assurance Practices apply across the SCB population, with regional rural banks excluded from the Master Direction and supervised separately. The depth of application is calibrated to the institution tier rather than to a single threshold.
Small Finance Banks (SFBs) and Payments Banks
Small Finance Banks and Payments Banks licensed by the Reserve Bank of India fall inside the Master Direction on IT Governance, Risk, Controls and Assurance Practices. The framework scales with the size of the institution, the systemic relevance of its services, and the connectivity profile of its technology estate. Customer-facing digital channels, mobile banking, and the payment infrastructure carry tighter supervisory expectations because they drive most of the inherent risk profile that determines tier classification.
Urban Co-operative Banks (UCBs) and co-operative population
Urban Co-operative Banks operate under separate cyber security guidance calibrated to UCB scale, with a graduated framework that recognises the variation in size and complexity across the UCB population. The supervisory expectation propagates the principles of the 2016 Cyber Security Framework with proportionate application, including a board-approved cyber security policy, baseline cyber resilience requirements, VAPT on critical systems, and incident reporting on the same operational timeline.
Top-layer and upper-layer NBFCs
Non-Banking Financial Companies in the top and upper layers of the scale-based regulatory framework are supervised under the Master Direction on Information Technology Governance and Information Risk Management for NBFCs. The Master Direction calibrates governance, security, and resilience expectations to NBFC scale and operating model. Middle and base layer NBFCs operate under proportionate guidance issued separately, recognising that the inherent risk profile differs from banks and from systemically important NBFCs.
Credit information companies and ancillary regulated population
Credit information companies registered under the Credit Information Companies (Regulation) Act, and other ancillary regulated entities that operate critical IT estates supporting the financial system, are pulled into the cyber resilience expectation through related guidance even where the Master Direction mechanics are calibrated differently. The cyber resilience principles propagate across the RBI-regulated population through the Master Direction and adjacent supervisory communications.
Third-party service providers and cloud arrangements
Third-party service providers, cloud service providers, and managed service providers that operate or process information assets on behalf of an RBI-regulated institution sit inside the third-party arrangement controls and the cloud risk expectations of the Master Direction. The supervised institution remains accountable for the cyber and IT risk of services delivered through third parties, with the assessment evidence, the contract requirements, and the ongoing monitoring trail retained at the regulated entity level.
The 2016 Cyber Security Framework in Banks circular
The 2016 circular requires the bank board to approve a cyber security policy distinct from the broader IT policy, classify the institution into a tier based on inherent risk, evidence the baseline cyber security and resilience requirements per tier, operate a Cyber Crisis Management Plan, and report cyber incidents to the RBI cyber security and IT examination cell on the indicative timeline. The circular treats cyber security as a board-level obligation rather than as a delegated technology operations matter, with named accountable executives, explicit gap assessment, and a working programme that operationalises the policy in day-to-day controls.
Vulnerability scanning evidence, penetration test findings, and configuration assessment records sit at the centre of the baseline cyber security and resilience requirements. The penetration testing workflow keeps engagement, findings, and remediation tied to a single record. The scanner result triage workflow covers turning raw scanner output into assessor-ready findings without losing the audit trail. For the analytical view of how a finding ages into a remediation backlog, the aging pentest findings research covers why an open finding that lingers across cycles reads to a CSITE examiner as a programme weakness rather than as a delivery delay.
Tier classification and the baseline-by-tier model
The 2016 Cyber Security Framework in Banks circular requires the institution board to classify the bank into a tier on the basis of inherent risk drivers: the technology footprint, the number of internet-facing systems, the transaction volume, the digital and mobile channel exposure, the third-party connectivity, the customer base, and the systemic relevance of the institution to the wider financial system. The tier sets the baseline control expectations and the depth of supervisory dialogue. Higher-tier institutions evidence stronger detection, response, and recovery capabilities than lower-tier institutions and run a deeper testing programme, with the supervisory expectation calibrated to the inherent risk driver picture rather than to a single threshold.
The tier classification is the upstream decision: the tier sets the target operating capability for the cyber security programme, and the gap assessment against the tier baseline drives the prioritisation of remediation activity. Treating tier classification as a one-time exercise rather than as a recurring decision the inherent risk picture refreshes is a common structural mistake; the supervisory dialogue expects the tier classification to be reviewed on cadence and on material change.
The 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices
The Master Direction issued 7 November 2023 and effective 1 April 2024 consolidates IT governance and information security expectations across scheduled commercial banks (excluding regional rural banks), small finance banks, payments banks, top-layer NBFCs, and credit information companies. The Master Direction is structured across the IT governance framework, the IT risk management framework, the information security policy and operating model, IT services management and IT operations, information systems audit and assurance, and business continuity and disaster recovery. The Master Direction does not displace the 2016 Cyber Security Framework circular; the documents read together as the working supervisory expectation.
IT governance and board oversight
Board accountability for IT and cyber risk, the IT Strategy Committee at the board level, the IT Steering Committee at the executive level, the named Chief Information Security Officer reporting line, and the integration of IT and cyber risk into the enterprise risk framework. The supervisory dialogue tests whether the board has direct visibility into IT and cyber risk through routine reporting rather than only at incident time, and whether the named CISO has the authority commensurate with the accountability the policy claims.
IT risk management framework
A documented framework covering identification, assessment, treatment, monitoring, and reporting of IT and cyber risks. The framework defines policies, standards, and procedures across system development, change management, project management, vendor and third-party management, and the IT operating environment. Risks are tied back to the criticality of the affected systems and information assets, with a working risk register that is reviewed on cadence and on material change.
Information security policy and the cyber security operating model
A board-approved cyber security policy distinct from the broader IT policy, an information security policy framework, the named accountable executives across the cyber and IT risk operating model, and explicit gap assessment against the supervisory baseline. The policy is reviewed at least annually and on material change, and the supervisory dialogue tests whether the policy is operationalised in the day-to-day controls rather than only declared on paper.
IT services management and IT operations
Capacity planning, configuration management, change management, problem management, IT asset management, the IT services catalogue, and the operational targets for availability, reliability, and recoverability of critical systems. The Master Direction sets the operational discipline that supports the cyber security programme and the resilience expectation that the institution is examined against during the CSITE supervisory dialogue.
Information systems audit and assurance
Information systems audit function with explicit independence, audit charter, board reporting line, audit scope and frequency, and the integration of IT audit with the wider institution audit programme. The supervisory dialogue tests whether the IT audit programme covers cyber security controls at the depth the institution inherent risk warrants and whether audit findings are tracked through to closure rather than only logged.
Business continuity and disaster recovery
Business impact analysis, recovery time and recovery point objectives, the disaster recovery and business continuity programme, recovery testing, and the integration of cyber incident response with broader continuity planning. Cyber incident scenarios including ransomware, destructive attack, and prolonged outage sit explicitly inside the BCM scope, with the testing cadence and the post-exercise lessons-learned closure forming the working evidence the supervisor reads.
Baseline cyber security and resilience controls
The baseline control set sits across the 2016 Cyber Security Framework in Banks circular and the Master Direction on IT Governance, Risk, Controls and Assurance Practices. The controls below are the working catalogue the supervisory dialogue reads against; each control is examined for design, for operation, and for the evidence the control produces on a continuous basis rather than at examination time only.
Inventory management and asset classification
IT asset inventory across infrastructure, applications, databases, endpoints, network devices, and information assets, with classification by criticality, sensitivity, and the customer data the asset processes. The asset register is the working catalogue that drives every downstream control, and a stale register propagates as missed coverage in the protection and detection programmes and as gaps the CSITE examination surfaces directly.
Network management and security controls
Network segmentation, perimeter and internal traffic filtering, secure network architecture, encryption in transit, secure remote access for staff and third parties, and the protection of management interfaces. The supervisory expectation is defence-in-depth aligned to the institution tier, with stronger evidence for higher-tier institutions and proportionate application for lower-tier institutions.
Secure configuration and patch management
Configuration baselines for servers, endpoints, network devices, and applications; patching cadence aligned to risk; vulnerability remediation timelines tied to severity; and the change management discipline that protects the institution against configuration drift. The supervisory dialogue tests whether the patch and configuration programme operates against the asset inventory the institution has declared rather than against an undocumented subset.
Access management and authentication
Identity lifecycle management, role-based access, privileged access management, multi-factor authentication for sensitive systems and remote access, periodic access recertification, and the segregation of duties between development and production. Privileged accounts carry stronger evidence requirements: vault enrolment, session recording, just-in-time elevation, and removal of dormant privileged access on a documented cadence.
Application security and secure development
Secure software development lifecycle covering threat modelling, secure coding standards, static application security testing, dynamic application security testing, software composition analysis, peer review, and pre-production security testing. Application security testing produces actionable findings, and fixes are applied before production release rather than after a finding becomes an incident.
Data protection, encryption, and customer data confidentiality
Data classification, data loss prevention, encryption at rest and in transit, key management, and the controls that prevent unauthorised disclosure of customer information. The supervisory expectation reads against the Information Technology Act 2000 (and amendments), the Digital Personal Data Protection Act 2023, and the customer-data confidentiality obligations the regulated entity carries under the Banking Regulation Act 1949 and the Reserve Bank of India Act 1934.
Customer education and protection from cyber fraud
Customer awareness on phishing, malware, and digital banking fraud; the controls protecting digital banking, mobile banking, and payment channels from fraud; transaction risk monitoring; and the integration of fraud risk management with cyber risk management. The supervisory dialogue tests whether the institution treats customer-facing fraud and cyber risk as the same operational programme rather than two parallel reporting lines.
Vendor risk management and outsourcing controls
Third-party risk management for technology service providers, cloud service providers, and managed service providers. Vendor due diligence, contract requirements, ongoing monitoring, and exit planning calibrated to the criticality of the outsourced service. The institution remains accountable for the security of services it consumes, even where the third-party operates outside Indian jurisdiction.
Vulnerability Assessment and Penetration Testing under RBI
The supervisory expectation is for recurring vulnerability assessments and penetration testing on internet-facing systems, online banking and mobile banking platforms, payment gateways, ATM and card management systems, and any system that processes customer-sensitive data. The cadence is calibrated to the institution tier and the criticality of the system tested, with at least an annual VAPT cycle on critical systems and on material change as the working baseline. Larger institutions and institutions with significant digital transaction volume frequently run adversarial exercises (red team or scenario-led testing) on top of the recurring VAPT programme to evidence the detection and response capability against realistic threat actor behaviour.
The institution retains the test scope, the test report, the findings register with severity and remediation plan, and the retest evidence in the form CSITE can examine without reconstruction. The supervisory dialogue tests whether testing produces actionable findings and whether fixes are applied before a finding becomes an incident. Application security testing on customer-facing channels, mobile banking application testing, payment system testing, and configuration assessment of critical infrastructure all sit inside the institution evidence pack alongside the test reports.
For the workflow that runs adversarial exercises from scope to attestation on a single engagement record, the threat-led penetration testing workflow covers the cycle end to end. The red teaming workflow keeps timestamps, attack paths, and operator notes structured so the closure record is the working record rather than a rebuilt one. For the recurring VAPT cycle that tracks the supervisory cadence, the penetration testing workflow keeps the engagement record and the remediation backlog tied to a single defensible artefact, and the retesting workflow evidences the closure of findings the examiner expects to see verified rather than self-attested.
Cyber Crisis Management Plan and incident response
The Cyber Crisis Management Plan is a documented programme covering detection, containment, eradication, and recovery; cyber incident scenarios including ransomware, destructive attack, and prolonged outage; the integration with broader business continuity and disaster recovery; the named crisis management team; the communications plan; and the testing cadence that exercises the plan rather than only describing it. The supervisory dialogue tests whether the plan can be operated under pressure, whether the runbooks are current, whether the communication tree is up to date, and whether the lessons-learned cycle from the most recent exercise has been applied to the controls the exercise touched.
The CCMP exercise calendar runs against the realistic threat picture the institution operates in, with scenarios calibrated to the institution tier and the systems most critical to operations. Tabletop exercises walk the crisis management team through a scenario without operational disruption; live or simulated technical exercises stress the detection and response capability against scripted adversarial activity. Both exercise types feed into the CCMP record alongside the post-exercise lessons-learned closure.
Incident reporting to RBI and CERT-In
Cyber incident reporting operates on two parallel tracks. RBI cyber incident reporting goes to the cyber security and IT examination cell on the indicative timeline (typically 2 to 6 hours from detection of a material incident, depending on the institution category and the applicable supervisory communication). Parallel reporting to the Indian Computer Emergency Response Team (CERT-In) operates under the CERT-In Information Security Practices, Procedure, Prevention, Response and Reporting of Cyber Incidents directions. The CERT-In directions issued in April 2022 require reporting of specified cyber incidents within 6 hours of noticing such incidents or being brought to notice about such incidents.
The institution evidence pack records the detection time, the materiality determination time, the regulator notification trail (both the RBI submission and the CERT-In submission where applicable), the post-incident review, and the lessons-learned closure applied to the controls the incident touched. Customer notification of unauthorised access to customer information sits alongside the regulator notifications under the same incident reference, with the timing and content of the customer communication tracked in the same record. The supervisory expectation is that the response is grounded in the evidence pack rather than reconstructed from email and shared drives at the deadline moment.
CSITE supervision and the Cyber Security Operations Centre
The Department of Supervision Cyber Security and IT Examination Group (CSITE) operates the supervisory examination programme that reads the institution cyber security programme. The CSITE examination cycle reviews the cyber security policy, the tier classification, the baseline control set, the VAPT programme, the CCMP exercise record, the incident register, the third-party register, and the information systems audit reports. The dialogue is evidence-based: each examination question reads against the artefact the institution has retained, the policy reference, the control owner, and the supervisory communication thread.
Higher-tier institutions evidence a Cyber Security Operations Centre (C-SOC) capability, threat intelligence consumption, security monitoring across critical systems, log retention with tamper-evident properties, and alerting and triage workflows. The C-SOC operating record is examined for coverage (which assets are monitored), for fidelity (the alert-to-incident ratio), and for timeliness (the time from event to triage to escalation). The CSITE examination tests the operating effectiveness of the controls the cyber security policy claims to operate, and the institution evidences the operation rather than only the design.
RBI and adjacent frameworks: PCI DSS, ISO 27001, NIST CSF, SWIFT CSP
Most RBI-supervised institutions run more than one framework at the same time. The institution may operate the PCI DSS standard on the payment card environments, the ISO 27001 information security management system at the entity level, the SWIFT Customer Security Programme on the wholesale messaging infrastructure, the NIST Cybersecurity Framework as a control catalogue reference, and the OWASP Top 10 on the application security testing programme. The supervisory dialogue does not require running every adjacent framework; the institution evidences how the controls these frameworks operationalise feed back to the RBI baseline so the same evidence pack often satisfies more than one regime when the mapping is built into the workspace from the start rather than rebuilt at examination time.
For the wider operational context that an RBI-regulated institution may run alongside the framework, the banking and fintech security consultancies workspace covers how a service provider delivering RBI-aligned, PCI DSS, SWIFT CSP, and ISO 27001 work across multiple regulated clients keeps the evidence record consistent without writing the same finding three times.
Evidence the CSITE examiner (and your board) expect
CSITE examinations that go badly usually go badly because the artefacts are scattered across drives, secure email threads, and screenshots. Build the evidence pack as the work happens, retain raw evidence alongside the structured record, and tie every artefact back to the policy section, the baseline control area, and the owner who produced it. The CSITE examiner reads the way the underlying record reads.
- Board-approved cyber security policy distinct from the IT policy, with the version history, the review minutes, and the named accountable executive per section the policy operationalises
- Tier classification working notes, with the inherent risk drivers documented and the tier decision evidenced against the framework baseline
- Information asset register with classification by criticality and sensitivity, owner, and the controls applied per asset class, refreshed on a documented cadence and on material change
- Cyber Crisis Management Plan with the named crisis management team, the runbook library, the communications plan, the exercise calendar, and the closure record from the most recent exercise cycle
- VAPT programme record covering scope, methodology, findings, severity, remediation plans, and retest evidence per finding, attached to the asset register entries the testing covered, on a cadence calibrated to the institution tier
- Vulnerability scanning evidence across the asset register, with findings tied to the relevant assets, severity, remediation owners, and remediation SLA progress per finding
- Incident register with detection time, materiality determination time, RBI and CERT-In notification record, post-incident review, and lessons-learned closure applied to the controls the incident touched
- Third-party register with the vendor risk assessment of each technology service provider, the contract reference, the security expectations and SLA terms, the ongoing monitoring evidence, and the exit plan per provider
- Information systems audit reports covering design and operating effectiveness of cyber security controls, with reliance basis on third-party assurance documented per audit and audit findings tracked to closure
- C-SOC operating record (for institutions that operate a Cyber Security Operations Centre), with monitoring coverage, alert volumes, alert-to-incident ratio, and the threat intelligence sources the SOC consumes
- Customer notification trail where unauthorised access to customer data has occurred, retained alongside the regulator notification record under the same incident reference
- Board reporting record showing the cadence and content of cyber and IT updates to the board and the audit committee, with the escalation path operating before an incident rather than assembled during one
Where SecPortal fits in an RBI-aligned programme
SecPortal is the operating layer for the RBI programme, not a replacement for the Reserve Bank of India, the VAPT provider, or the threat intelligence partner. The platform handles scope, role records, findings, replay notes, attestation artefacts, and the closure pack so the work runs as a structured workflow rather than a long encrypted email thread. Compliance tracking maps the RBI evidence pack to ISO 27001, PCI DSS, NIST CSF, and SWIFT CSP for institutions that have to satisfy more than one regime from the same body of work.
- Engagement management dedicated to an RBI-aligned testing programme, with the in-scope asset class, the testing cadence, and the assessor or pentester record tracked on a single workspace
- Findings management with CVSS 3.1 scoring, MITRE ATT&CK tagging, and 300+ templates so each VAPT, vulnerability, or assessor finding ties to the affected system, the asset register, and the remediation owner
- Compliance tracking that maps RBI Master Direction control areas to the operationalised controls, alongside related frameworks (PCI DSS, ISO 27001, NIST CSF) the institution may already operate against
- AI report generation that turns assessment notes, vulnerability output, penetration test findings, and remediation actions into the audit-ready report and the board-ready narrative without manual rewriting
- External and authenticated scanning to feed the vulnerability management programme with continuous evidence rather than a single examination-time snapshot
- Continuous monitoring with scheduled scans so the asset register carries a coverage record across the year that internal audit, the IS audit function, and the CSITE supervisory team can read on request
- Findings audit trail with reasons and re-evaluation dates so suppressions, deviations, and risk acceptances are defensible at internal audit, at audit committee review, and at CSITE examination
RBI cyber security operates as a continuous programme rather than a single attestation. The asset register, the third-party register, the VAPT cadence, the CCMP exercise record, and the audit trail carry value across cycles when each iteration inherits the prior evidence pack rather than rebuilding from scratch. For consultants delivering RBI-aligned work to multiple India-regulated clients, the banking and fintech security consultancies workspace bundles the platform with branded client portals and AI report generation so the deliverable looks as polished as the work behind it.
For programmes that want continuous detection and trend evidence between CSITE examination cycles, the continuous monitoring capability and attack surface management capability produce the cadence and coverage record that examiners read most easily during the scoping conversation.
Scope and limitations
The 2016 Cyber Security Framework in Banks circular, the Master Direction on IT Governance, Risk, Controls and Assurance Practices, and the Master Direction on Information Technology Governance and Information Risk Management for NBFCs are operated by the Reserve Bank of India through the Department of Supervision and the CSITE group. The supervised institution evidences how its programme meets the supervisory expectations during examination. SecPortal is the workspace that holds the engagement, the testing programme, the findings, the remediation record, and the audit trail. Examination responses, regulator filings, and incident notifications remain actions the institution takes through the channels the Reserve Bank of India and CERT-In prescribe; SecPortal holds the supporting record so the response is grounded in the evidence pack rather than reconstructed from email and shared drives at the deadline moment.
This page describes the structure of RBI cyber security supervisory expectations and how a workspace-driven programme plays against them; the authoritative reference for the obligations remains the 2016 Cyber Security Framework in Banks circular, the Master Direction on IT Governance, Risk, Controls and Assurance Practices, the Master Direction on Information Technology Governance and Information Risk Management for NBFCs, the applicable cyber security guidance for Urban Co-operative Banks, the CERT-In Information Security Practices, Procedure, Prevention, Response and Reporting of Cyber Incidents directions, and the related supervisory communications the Reserve Bank of India issues through its Department of Supervision and Department of Regulation.
Key control areas
SecPortal helps you track and manage compliance across these domains.
2016 Cyber Security Framework in Banks circular
The original Cyber Security Framework in Banks circular (DBS.CO.CSITE.BC.NO.11/33.01.001/2015-16) issued 2 June 2016 sets the foundational cyber security expectations for scheduled commercial banks. The circular requires a board-approved cyber security policy distinct from the IT policy, an inherent-risk-based tier classification, baseline cyber security and resilience requirements per tier, a Cyber Crisis Management Plan, and incident reporting to the RBI cyber security and IT examination cell.
Master Direction on IT Governance, Risk, Controls and Assurance Practices
The Master Direction on IT Governance, Risk, Controls and Assurance Practices (DoS.CO.CSITEG.SEC.7/31.01.015/2023-24) issued 7 November 2023 and effective 1 April 2024 consolidates IT governance and information security expectations for scheduled commercial banks (excluding regional rural banks), small finance banks, payments banks, top-layer NBFCs, and credit information companies. The Master Direction sets the IT strategy committee, the IT steering committee, the Chief Information Security Officer accountability, the information security policy, and the third-party arrangement controls as the structural framework supervisors examine.
IT Governance and Information Risk Management for NBFCs
The Master Direction on Information Technology Governance and Information Risk Management for NBFCs (RBI/2023-24/107 DoS.CO.CSITEG/SEC.1/31.01.015/2023-24) sets cyber and IT risk expectations for top-layer and upper-layer NBFCs. The Master Direction calibrates governance, security, and resilience expectations to NBFC scale and operating model, with proportionate application across the middle and base layers under separate guidance.
Tier classification by inherent risk
The 2016 Cyber Security Framework requires the bank board to classify the institution into a tier based on inherent risk drivers (technology footprint, internet-facing systems, transaction volume, third-party connectivity, customer base, mobile and digital channel exposure). The tier sets the baseline control expectations and the depth of supervisory dialogue. Higher-tier institutions evidence stronger detection, response, and recovery capabilities than lower-tier institutions and run a deeper testing programme.
Cyber security policy and operating model
A board-approved cyber security policy distinct from the broader IT policy, with named accountable executives, a documented cyber security operating model, and explicit gap-assessment of the institution against the framework baseline. The policy is reviewed at least annually and on material change, and the supervisory dialogue tests whether the policy is operationalised in the day-to-day controls rather than only declared on paper.
Vulnerability Assessment and Penetration Testing (VAPT) cadence
Recurring vulnerability assessments and penetration testing on internet-facing systems, online banking and mobile banking platforms, payment gateways, ATM and card management systems, and any system that processes customer-sensitive data. The supervisory expectation is at least an annual VAPT cycle on critical systems and on material change, with the test scope, the findings register, the severity classification, the remediation plan, and the retest evidence retained as the institution evidence pack.
Cyber Crisis Management Plan (CCMP) and incident response
A documented Cyber Crisis Management Plan covering detection, containment, eradication, and recovery; cyber incident scenarios including ransomware, destructive attack, and prolonged outage; the integration with broader business continuity and disaster recovery; the named crisis management team; the communications plan; and the testing cadence that exercises the plan rather than only describing it. The CCMP is supervised through the supervisory dialogue and tested through scheduled exercises.
Incident reporting to RBI and CERT-In
Cyber incident reporting to the RBI cyber security and IT examination cell on the indicative timeline (typically 2 to 6 hours for material incidents), and parallel reporting to the Indian Computer Emergency Response Team (CERT-In) under the CERT-In Information Security Practices, Procedure, Prevention, Response and Reporting of Cyber Incidents directions. The supervised institution evidences the detection time, the materiality determination time, the regulator notification trail, and the post-incident review with lessons-learned closure.
CSITE supervision and Cyber Security Operations Centre (C-SOC)
The Department of Supervision Cyber Security and IT Examination Group (CSITE) operates the supervisory examination programme that reads the institution cyber security programme. Higher-tier institutions evidence a Cyber Security Operations Centre (C-SOC) capability, threat intelligence consumption, security monitoring across critical systems, log retention, and alerting and triage workflows. The CSITE examination tests the operating effectiveness of the controls the cyber security policy claims to operate.
Run an RBI-aligned programme on one defensible record
Hold the asset register, the VAPT programme, the CCMP exercise pack, the CSITE evidence record, and the CERT-In incident notification trail in one workspace. Start free.
No credit card required. Free plan available forever.