RBI Cybersecurity Framework 2026 — Compliance Guide for Indian Banks & NBFCs

India’s financial sector is the single largest target for cyber attacks in the country. Banks, NBFCs, payment aggregators, and fintech platforms collectively handle hundreds of millions of transactions daily, making them high-value targets for ransomware operators, state-sponsored threat actors, and financially motivated criminal groups. The Reserve Bank of India (RBI) has responded with a progressively strengthening cybersecurity regulatory framework — one that continues to evolve in 2026 with new directives, stricter examination standards, and more granular technical requirements.

For compliance officers, CISOs, and IT heads at RBI-regulated entities, this guide provides a comprehensive, actionable overview of the RBI Cybersecurity Framework: what it requires, how to implement it, and how to demonstrate compliance during RBI examinations.

Overview of the RBI Cybersecurity Framework

The RBI Cybersecurity Framework for Banks was first issued in June 2016 as a circular requiring all scheduled commercial banks to implement a Board-approved cybersecurity policy and meet specific minimum baseline controls. Since 2016, RBI has significantly expanded the framework through additional master directions, circulars, and examination guidelines:

2016: Initial Cybersecurity Framework for Banks — policy, governance, and baseline controls
2018: Cyber Security Framework for Urban Cooperative Banks (UCBs) — scaled requirements for smaller entities
2019: Cybersecurity baseline standards for payment systems operators and payment system participants
2021: Master Direction on Information Technology Framework for NBFCs — applying IT and cybersecurity governance requirements to NBFCs
2023: Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices — comprehensive update covering all RBI-regulated entities
2024–2025: Integration of CERT-In 2022 Directions requirements, DPDP Act obligations, and enhanced requirements for cloud and third-party technology risk

Which Entities Must Comply?

RBI’s cybersecurity requirements apply across a broad spectrum of regulated entities:

All scheduled commercial banks (public sector, private sector, small finance banks, payment banks, foreign banks with Indian operations)
Urban Cooperative Banks (UCBs) — tiered requirements based on asset size
Non-Banking Financial Companies (NBFCs) — particularly those with asset size above ₹1,000 crore and those in the upper layer under RBI’s scale-based regulation
Payment Aggregators and Payment Gateways
White-label ATM operators
Prepaid payment instrument issuers
Account aggregators
Credit information companies

The depth of requirements varies by entity type and scale. Large banks face the most comprehensive requirements; small UCBs have scaled-down baseline requirements. However, all regulated entities in 2026 must demonstrate meaningful cybersecurity governance, not mere paper compliance.

The Five Pillars of RBI’s Cybersecurity Framework

Pillar 1: IT Governance and Board Oversight

The RBI framework places cybersecurity governance firmly at Board level. Requirements include:

Board-approved cybersecurity policy: Updated annually, reviewed by the Board or Board-level IT/Risk Committee
Chief Information Security Officer (CISO): Dedicated CISO appointment mandatory for large banks and top-layer NBFCs. The CISO must have direct access to the Board or Board IT Committee and must not report to the CIO (to avoid conflict of interest)
Cyber Crisis Management Plan (CCMP): Board-approved plan for managing major cyber incidents, including communication protocols, business continuity, and recovery procedures
IT Strategy Committee: Board-level committee responsible for overseeing IT and cybersecurity strategy
Annual cybersecurity report to Board: Summary of cyber incidents, control effectiveness, and risk posture

Pillar 2: Vulnerability Management and Penetration Testing

The RBI framework is explicit and prescriptive about technical vulnerability management:

Vulnerability Assessment and Penetration Testing (VAPT): Mandatory minimum annually for all internet-facing systems and critical internal systems. RBI examiners will ask to see VAPT reports and remediation evidence during IT examinations.
VAPT conducted by CERT-In empanelled organisations: RBI expects VAPT to be conducted by qualified, third-party organisations — not solely internal teams. CERT-In empanelled firms are the accepted standard.
Patch management: Critical patches must be applied within defined timelines — RBI guidance suggests critical vulnerability patches within 15 days, high severity within 30 days.
Configuration management: Baseline security configurations for all systems, with deviation management and periodic configuration compliance checks.
Application security testing: New applications and major changes to existing applications must undergo security testing before production deployment.

Pillar 3: Security Operations and Monitoring (SOC)

The RBI framework requires continuous security monitoring — implicitly requiring a SOC function, whether in-house or managed:

24×7 security monitoring: Continuous monitoring of security events across networks, endpoints, servers, and applications
SIEM implementation: Log aggregation and correlation across the IT estate
Anomaly detection: Behavioural analytics to detect deviations from normal patterns — particularly important for insider threat detection and account takeover detection in banking systems
Network traffic analysis: Deep packet inspection and flow analysis at network boundaries and between security zones
Privileged access monitoring: Logging and alerting on all privileged account activity — database administrators, system administrators, application support teams
Log retention: Security logs must be retained for a minimum of 180 days (extended to 1 year for some log types per CERT-In 2022 Directions)

Pillar 4: Incident Response and CERT-In Reporting

RBI-regulated entities operate under a dual incident reporting obligation:

CERT-In reporting (6-hour window): CERT-In’s 2022 Directions require reporting of notifiable cyber incidents within six hours of detection. For banking entities, notifiable incidents include unauthorised access to banking systems, ransomware attacks, DDoS attacks affecting availability, data breaches involving customer financial data, and ATM/POS compromise events.

RBI reporting: The RBI Cybersecurity Framework requires banks to report “unusual cyber security incidents” to RBI’s IT Examination Group and CSITE (Cybersecurity and IT Examination cell). The reporting timeline is within two to six hours for critical incidents, with a detailed post-incident report within 48 hours.

Additional incident response requirements:

Documented Cyber Incident Response Policy and procedures
Defined incident classification tiers (P1 critical to P4 informational)
Designated Incident Response Team with clear roles and escalation paths
Digital forensics capability — either in-house or through a retainer with a forensics firm
Annual tabletop exercises or full red team simulations testing the IR plan
Post-incident reviews (PIR) with root cause analysis and documented lessons learned

Pillar 5: Data Security and Network Segmentation

Network segmentation: Critical banking systems (core banking, payment systems, customer data repositories) must be isolated in dedicated network segments with strict access controls and firewall rules
Encryption: Data in transit encrypted using TLS 1.2 or higher. Data at rest in critical systems encrypted using AES-256 or equivalent
Data Loss Prevention (DLP): Controls to prevent unauthorised exfiltration of customer financial data
Database Activity Monitoring (DAM): Real-time monitoring of database access and queries, particularly for bulk data extraction
End-to-end encryption for payment transactions: All payment data encrypted from origination to settlement
Third-party and vendor risk management: Security assessment of technology vendors, cloud providers, and outsourced service providers who have access to customer data or banking systems

CERT-In 6-Hour Reporting — Practical Implementation for Banks

The 6-hour CERT-In reporting window is one of the most demanding operational requirements for RBI-regulated entities. Meeting this requirement demands:

Detection capability: You cannot report what you cannot detect. SIEM with automated alerting on critical incident indicators is essential. Mean Time to Detect (MTTD) must be measured in minutes for critical incidents, not hours.
Incident triage speed: The first 90 minutes after detection must include alert validation, initial scope assessment, and incident commander designation.
Notification workflow automation: Pre-built notification templates for CERT-In (via cert-in.org.in incident reporting portal) and RBI’s CSITE cell, with named individuals responsible for submission
Legal hold procedures: Concurrent with notification, evidence preservation must begin to avoid destroying forensic artefacts needed for investigation
Board/senior management notification: Internal escalation to CISO, CEO, and Board IT Committee within the same window

RBI IT Examination — What Examiners Look For

RBI conducts periodic IT examinations of regulated entities, during which CSITE examiners review cybersecurity controls. Common areas of examiner focus in 2026:

Board-approved cybersecurity policy — current, comprehensive, and actually implemented
VAPT reports from CERT-In empanelled firms — covering internet-facing systems and critical internal systems
Remediation evidence — proof that VAPT findings have been remediated, not just documented
SIEM implementation and monitoring coverage — examiners test monitoring coverage by reviewing alert statistics and asking about recent incident detections
Patch management records — evidence of timely patching with documented exceptions
Third-party risk management — vendor security assessments and contractual security obligations
Access review records — quarterly or semi-annual reviews of privileged and user access
Incident log — record of all security incidents and near-misses with status and resolution
Business continuity and disaster recovery testing records

Entities that present only documentation without operational evidence — where monitoring systems exist but alerts are not being reviewed, or where VAPT reports show critical findings with no remediation — face adverse examination outcomes and potential corrective action directions from RBI.

Integration with the DPDP Act 2023

Banks and NBFCs are simultaneously subject to RBI cybersecurity requirements and the DPDP Act 2023. These frameworks are complementary but distinct:

RBI focuses primarily on system security and operational resilience for the financial system
DPDP Act focuses on individual privacy rights and personal data protection
Both require breach notification (RBI: 6 hours to CERT-In and RBI; DPDP Act: 72 hours to the Data Protection Board)
Both require “reasonable security safeguards” — satisfied by ISO 27001 implementation and regular VAPT
A unified compliance programme addressing both frameworks is more efficient than treating them separately

Penalties for Non-Compliance

RBI has progressively strengthened its enforcement posture. Penalties for cybersecurity non-compliance can be imposed under:

Section 47A of the Banking Regulation Act — up to ₹1 crore per violation for banks
Directions under the Payment and Settlement Systems Act — for payment system operators
Reputational penalties — adverse examination ratings that affect RBI’s supervisory stance, including restrictions on business activities
CERT-In Act penalties — for failure to report incidents within 6 hours

Beyond statutory penalties, inadequate cybersecurity has led RBI to impose operational restrictions on banks (e.g., temporary suspension of digital channels, restrictions on onboarding new customers) — penalties that far exceed any statutory fine in business impact terms.

RBI Compliance Implementation Roadmap

Phase 1: Governance and Policy (Month 1–2)

Appoint or designate CISO with direct Board reporting line
Draft or update Board-approved Cybersecurity Policy
Establish IT Strategy / Risk Committee at Board level
Develop Cyber Crisis Management Plan

Phase 2: Technical Assessment (Month 2–4)

Commission VAPT by a CERT-In empanelled firm covering all internet-facing systems and critical internal systems
Conduct network architecture review to identify segmentation gaps
Review patch management posture and identify critical unpatched vulnerabilities
Assess SIEM coverage and logging completeness

Phase 3: Control Implementation (Month 3–8)

Remediate critical and high VAPT findings
Implement or upgrade SIEM with coverage across critical systems
Deploy privileged access monitoring (PAM)
Implement network segmentation for critical banking systems
Deploy DLP and database activity monitoring for customer data environments

Phase 4: Process and People (Month 4–8)

Implement Incident Response Policy with 6-hour CERT-In reporting workflow
Conduct security awareness training for all staff
Implement vendor risk management framework
Conduct tabletop exercise for major cyber incident scenario

Phase 5: Continuous Compliance (Ongoing)

Annual VAPT and penetration testing
Quarterly access reviews
Monthly security operations reviews
Annual policy review and Board presentation
Annual DR/BCP testing

How MDIT Services Supports RBI Compliance

MDIT Services works with banks, NBFCs, payment aggregators, and fintech companies across India to achieve and maintain RBI cybersecurity framework compliance. Our services specifically designed for RBI-regulated entities include:

Annual VAPT by CERT-In empanelled team: Covering internet-facing systems, core banking infrastructure, payment systems, and APIs — with RBI examination-ready reporting
RBI Cybersecurity Gap Assessment: A structured assessment against all applicable RBI cybersecurity requirements, producing a gap report and prioritised remediation roadmap
Managed SOC for financial entities: 24×7 monitoring with CERT-In 6-hour incident reporting workflow built in
vCISO services: For NBFCs and smaller banks that need CISO-level expertise without full-time hiring
ISO 27001 and PCI DSS implementation: Providing the documented controls framework that satisfies RBI’s “reasonable security safeguards” standard
Incident Response retainer: On-call forensics and incident response support with guaranteed response times aligned to CERT-In’s 6-hour window

Get a Free RBI Compliance Readiness Assessment

Contact MDIT Services to schedule an RBI Cybersecurity Framework readiness assessment. Our team will evaluate your current posture against all applicable RBI requirements and provide a practical, examination-ready compliance roadmap.

Visit: mditservices.in/contact | Email: info@mditservices.in | Call: +91-11-XXXX-XXXX

RBI Cybersecurity Framework 2026 — Compliance Guide for Indian Banks & NBFCs