What is the RBI cyber security framework now?
On 31 July 2026 the Reserve Bank of India replaced its older cybersecurity instruments with a set of Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, one version for each kind of regulated entity: commercial banks, small finance banks, payments banks, co-operative banks, NBFCs and others. For commercial banks, they repealed the 2016 Cyber Security Framework circular and the 2023 Master Direction on IT governance, risk, controls and assurance practices.
So if your policies still cite the 2016 framework or the 2023 Master Direction, they need updating. The NBFC version is tiered by NBFC layer and size, and several requirements in every version scale with the entity's own risk assessment.
Key requirements (commercial bank directions)
| Area | What the directions require |
|---|---|
| Governance | An IT Strategy Committee of the Board, a Chief Information Security Officer, and an Information Security Committee headed from the risk management vertical. |
| Policies | An information security policy and a Board-approved cybersecurity policy. |
| Risk management | Periodic review and assessment of IT and information security risks. |
| Security operations | A Cyber Security Operations Centre suited to the bank's risk profile. |
| VA and PT | For critical systems and customer-facing systems in the DMZ: vulnerability assessment at least every six months and penetration testing at least every 12 months. For other systems, frequency is risk-based. Findings must be fixed in a time-bound way, by appropriately trained and independent testers. |
| Access | Multi-factor authentication, mandatory for privileged users of critical information systems and critical activities. |
| Third parties | The bank stays accountable for security in outsourced and partner arrangements, with due diligence and oversight of vendors (commercial banks also follow RBI's 2025 outsourcing directions). |
| Disaster recovery | DR drills for critical systems at least half-yearly, with major issues fixed and retested before the next drill. |
| Incident reporting | Cyber incidents reported to RBI within six hours of detection on the DAKSH platform, and to CERT-In. |
| Payment data | Under RBI's April 2018 circular, all payment system data must be stored only in India. |
NBFCs and co-operative banks
NBFCs follow their own 2026 directions, which set different requirements for different NBFC layers and sizes, replacing the earlier IT framework for NBFCs. Co-operative banks likewise have their own version. The themes are the same: governance, risk assessment, VAPT, monitoring, incident reporting and resilience. The frequencies and the amount of structure required differ, so check the version for your entity.
One incident, several reports
| Report to | When | Under |
|---|---|---|
| RBI (DAKSH) | Within 6 hours of detection | RBI's 2026 directions |
| CERT-In | Within 6 hours of noticing | CERT-In Directions, 2022 |
| Data Protection Board and affected people | Without delay; detailed report to the Board within 72 hours | DPDP Rules, 2025, from 13 May 2027, if personal data is involved |
A single runbook that triggers all three from one decision point is easier to get right under pressure. Our CERT-In reporting clock works out the deadlines.
How to use the scorecard above
The scorecard checks ten expectations drawn from the commercial-bank directions and the 2018 payment data circular. A "Yes" means the control exists. It cannot tell you whether it meets the required frequency or depth, so use the gaps as a starting list, not as an audit result.
FAQ
Is the 2016 RBI Cyber Security Framework still in force?
Not for commercial banks: RBI repealed it on 31 July 2026, when the new directions took over. Other entity types moved to their own 2026 versions on the same date.
How often must a bank run penetration tests?
At least every 12 months for critical systems and customer-facing systems in the DMZ, with vulnerability assessments at least every six months. Other systems follow a risk-based frequency.
How fast must a cyber incident reach RBI?
Within six hours of detection, through the DAKSH platform, and CERT-In must be informed as well.
We run the VA and PT cycle, set up monitoring and the incident runbook, and prepare the evidence your auditors and RBI inspections ask for. See VAPT services and banks and financial services.
Sources
- RBI (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (updated 1 October 2026)
- RBI repeal circular, 31 July 2026
- RBI circular on storage of payment system data, 6 April 2018
Facts checked against the sources above on 22 October 2026. General information, not legal advice.