RBI cyber security directions

What are the RBI cyber security directions?

The Reserve Bank of India regulates banks and many other financial institutions in India. It has issued a series of instruments on technology and cyber risk. The most important today is the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (November 2023). It consolidated earlier guidance and has applied since 1 April 2024. It sits alongside the 2016 Cyber Security Framework for banks and specific directions, for example on digital payment security controls and on outsourcing of IT services.

Who does it apply to?

Scheduled commercial banks (excluding regional rural banks), small finance and payments banks, larger NBFCs in the upper and middle layers, credit information companies and all-India financial institutions. Urban co-operative banks and other entities follow related, graded frameworks.

Key duties

• Governance: a board-approved IT strategy, a Board IT Strategy Committee, an IT Steering Committee and a senior Head of IT Function. A CISO with clear independence and reporting lines.
• IT and cyber risk management: an information security policy, a cyber crisis management plan, a security operations capability and regular vulnerability assessment and penetration testing.
• Controls: change and patch management, access control, data security, cryptographic controls, logging and monitoring.
• Business continuity and DR: tested recovery capabilities with defined RTO and RPO.
• Assurance: information systems audits and regular reviews of control effectiveness.
• Incident reporting: report cyber incidents to RBI as its directions require, and to CERT-In under its 2022 Directions.

How does it relate to other frameworks?

RBI expectations map closely to ISO/IEC 27001, ISO 22301 and NIST CSF. IT outsourcing, including cloud, has its own RBI Master Direction, which matters for third-party risk management.