RBI Cyber Security and IT Governance Directions, 2026: Who Is Covered and What They Require

Which RBI instruments cover cyber security and IT governance now?

RBI's Master Directions page (opened 24 October 2026) lists these Directions for seven categories: commercial banks, small finance banks, payments banks, urban co-operative banks, all-India financial institutions, non-banking financial companies (NBFCs) and credit information companies. The commercial banks version is RBI/DoS/2026-27/410 (DoS.CO.CSITEG.4/31.01.015/2026-27), shown as "Updated as on October 01, 2026".

Two separate instruments are not covered here: the Digital Payment Security Controls Directions, 2026 (listed for five of the seven categories) and the 2024 Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (RBI/DPSS/2024-25/123, 30 July 2024).

What happened to the 2016 Cyber Security Framework circular and the 2023 IT Governance Master Direction?

RBI's withdrawn-circulars list names both documents. Circular DoS.CO.PPG.66/11.01.005/2026-27 (RBI/DoS/2026-27/221), dated 31 July 2026, says the 628 circulars listed in its Annex "are hereby repealed by the Reserve Bank with immediate effect". The Annex itself could not be read for this page. RBI's "Circulars Withdrawn" page, which gives no withdrawal date, lists 628 Department of Supervision circulars, including:

• Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/2023-24/107, 7 November 2023, effective 1 April 2024); and
• Cyber Security Framework in Banks (DBS.CO/CSITE/BC.11/33.01.001/2015-16, 2 June 2016).

Who do the 2026 Directions apply to?

Each version applies to the category in its title. The commercial banks version covers banking companies (other than small finance banks, payments banks and local area banks), corresponding new banks and the State Bank of India. Foreign banks operating through branches read "Board" as their head office and follow "comply or explain" for specified parts.

The NBFC and urban co-operative bank versions apply in tiers. For NBFCs, Chapter III covers Base Layer NBFCs with assets below ₹500 crore and Core Investment Companies, Chapter IV covers Base Layer NBFCs at ₹500 crore and above, and Chapter V covers Top, Upper and Middle Layer NBFCs (excluding Core Investment Companies). For urban co-operative banks, four levels depend on digital services and payment-system links.

What do the commercial banks Directions require on governance?

Among other things:

• Board. Approves IT, information asset, business continuity, information security and cybersecurity strategies and policies, reviewed at least annually.
• IT Strategy Committee. A Board-level committee of at least three directors, chaired by an independent director with "substantial IT expertise" (at least seven years' experience), meeting at least quarterly.
• Other committees. An IT Steering Committee meeting at least quarterly, and an Information Security Committee headed from the risk management vertical.
• CISO. No direct reporting line to the Head of IT Function and no business targets. The CISO reports to the executive overseeing risk management and reviews cyber risks and preparedness before the Board or its committees at least quarterly.
• Policies. A Board-approved Cybersecurity Policy "distinct and separate" from the IT and information security policy.
• IS audit. The Audit Committee of the Board oversees information systems audit and approves and annually reviews the IS Audit Policy.

What baseline controls do the Directions set?

Chapter V, "Baseline Cybersecurity and Resilience Requirements", runs from asset inventory to forensics. Paragraph numbers below are from the commercial banks version.

• Testing. Vulnerability assessment at least once every six months and penetration testing at least once every 12 months for critical systems and DMZ systems with a customer interface (para 151).
• Access. Mandatory multi-factor authentication for privileged users of critical information systems and critical activities (para 110).
• Email and phishing. DMARC for email domains, and anti-phishing and anti-rogue-app services (paras 120, 148).
• Resilience. Disaster recovery drills at least half-yearly for critical systems, with DR tests running the DR site as primary for at least a full working day (paras 165, 167).
• Monitoring. A Cyber Security Operations Centre with round-the-clock Level 1 monitoring (paras 143, 221).
• Vendors. Where RBI's separate outsourcing Directions do not apply, vendor agreements must give the bank a right to audit and let RBI inspect (paras 132, 133).

How quickly must a cyber incident be reported to RBI?

Within six hours of detection. Each of the seven versions opened says to report cyber incidents on RBI's DAKSH platform (its Advanced Supervisory Monitoring System) within six hours of detection, and each also tells the entity to notify CERT-In.

The commercial banks version (para 182) says the bank shall "pro-actively notify CERT-In". It also requires an incident response and recovery policy (para 175) and a Cyber Crisis Management Plan covering detection, containment, response and recovery (paras 192, 193).

Can a GRC platform or advisory service help with requirements like these?

It can help a team organise policies, controls, risks and audit actions in one place, but the duties sit with the regulated entity, its Board and its CISO. Neither a platform nor an adviser makes an organisation compliant.

Purplecop GRC's page describes "75+ frameworks mapped once and reused everywhere" and "One control library. Test a control once, satisfy every framework mapped to it." See Purplecop GRC. Purplecop Security's GRC & Compliance Advisory page describes a "Gap assessment against your target framework, with a prioritised remediation plan" and invites you to "Tell us the obligation you are trying to meet and who is asking for it."

These are general statements. Neither page lists RBI's Directions by name, so confirm with Purplecop Security what it covers before relying on either.

Is the RBI Cyber Security Framework in Banks (2016) still in force?

This page cannot confirm that from RBI text it could read. RBI's withdrawn-circulars list includes Cyber Security Framework in Banks (2 June 2016), and circular DoS.CO.PPG.66 of 31 July 2026 repeals the circulars listed in its Annex, which could not be read for this page. The 2026 Directions now set the requirements for each category.

Is the 2023 IT Governance Master Direction still in force?

This page cannot confirm that from RBI text it could read. RBI's withdrawn-circulars list includes the Master Direction (listed as DoS.CO.CSITEG/SEC.7/31.01.015/2023-24, 7 November 2023), and the commercial banks Directions say that existing instructions on Cybersecurity Framework and IT Governance for commercial banks "stand repealed".

How quickly must cyber incidents be reported to RBI?

Within six hours of detection, on RBI's DAKSH platform, according to each of the seven versions opened. The entity must also notify CERT-In.

How often must banks test for vulnerabilities?

For critical systems and DMZ systems with a customer interface, the commercial banks version requires vulnerability assessment at least once every six months and penetration testing at least once every 12 months.

Can Purplecop make my organisation compliant with RBI's Directions?

No product or service can do that on its own, because the Directions place the duties on the regulated entity. Purplecop's product and service pages do not list RBI's Directions by name.