RBI cyber security compliance: what Indian boards must evidence

For most of the last decade, board-level cyber governance in India meant approving a policy, noting an annual audit, and recording that the matter had been considered. That is no longer sufficient — not because the language of the regulations is dramatically different, but because the expectation behind it has hardened. Regulators increasingly want to see that oversight is continuous and evidenced, not periodic and asserted.

The instruments that matter

RBI: the board is named, not implied

On 31 July 2026 the RBI issued not one instrument but seven, all carrying the same title — Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 — and all in force immediately. One binds each class of regulated entity:

• Commercial Banks — RBI/DoS/2026-27/410
• Small Finance Banks — RBI/DoS/2026-27/419
• Payments Banks — RBI/DoS/2026-27/428
• Urban Co-operative Banks — RBI/DoS/2026-27/437
• All India Financial Institutions — RBI/DoS/2026-27/456
• Non-Banking Financial Companies — RBI/DoS/2026-27/461
• Credit Information Companies — RBI/DoS/2026-27/470

Between them they replace a scattered body of circulars, and they repeal the earlier cybersecurity and IT-governance instructions for every class they cover — all seven through the same covering circular of that date, DoS.CO.PPG.66/11.01.005/2026-27.

Establishing which one binds you is the first job, and it is where most summaries go wrong. The commercial banks instrument defines itself as applying to banking companies other than small finance banks, payments banks and local area banks. The first two are excluded because each has its own Directions in this family; local area banks are excluded and have none, receiving a separate (Local Area Banks – Miscellaneous) Supervisory Directions, 2026 instead. Urban co-operative banks are not in the exclusion list at all — they are primary co-operative banks rather than banking companies, so they were never inside the definition, and they have their own Directions besides. Foreign banks operating through branches follow a comply-or-explain approach on selected provisions. Which of the seven applies to you sets out what each instrument covers, and how the obligations scale by NBFC layer and co-operative bank level. Citing the wrong instrument in a supervisory response is an avoidable own goal.

What changed for directors specifically

For most entity classes the Directions run to eight chapters, and in every one the second chapter is titled for the board. Its significance is that the obligations are now specified rather than implied:

• Board-approved strategies, reviewed at least annually — the strategies and policies for five frameworks, IT, information assets, business continuity, information security and cybersecurity, are reviewed every year, a recurring agenda item rather than a one-time adoption. Since 1 October 2026 a commercial, small finance or payments bank’s board may hand that review to its IT Strategy Committee, keeping approval of material amendments; for the other four classes it stays with the board.
• A qualified IT Strategy Committee of at least three directors, chaired by an independent director with substantial IT expertise, which the Directions define as a minimum of seven years managing information systems or leading technology or cybersecurity initiatives. That is a composition test a board either passes or does not.
• A senior CISO — preferably at General Manager rank or equivalent — reporting directly to the Executive Director or equivalent overseeing risk management. The reporting line is the point: it separates the person raising the risk from the person whose delivery timetable the risk inconveniences.
• A cybersecurity policy distinct from the IT policy. The Directions require the two to be separate documents rather than one policy with a security section.
• An Information Systems Audit function under Audit Committee oversight, planned on a risk basis, with continuous auditing of critical systems where practicable.

Every one of those is answerable yes or no from a document that already exists — an organisation chart, a board calendar, a policy index — which is what makes them the provisions a supervisor reaches for first. The board governance check puts them as eleven questions and returns the gaps against the clause each comes from, in whichever of the seven instruments binds your class.

The operational floor beneath the governance

Beneath the board chapter sits the machinery that has to exist for the board's assurance to mean anything — asset inventory with criticality classification, patch management, multi-factor authentication, data loss prevention, and a Cyber Security Operations Centre monitoring round the clock. The full chapter-by-chapter reading covers it; two timings deserve a director's attention directly.

Cyber incidents must be reported within six hours of detection on the RBI's DAKSH supervisory platform — the same clock CERT-In runs, now with a second regulator at the other end of it. And disaster recovery drills are expected half-yearly for critical systems, with a minimal recovery time and a near-zero recovery point. Both are commitments about capability, not paperwork; neither can be assembled after the incident that tests them.

The practical consequence for a board pack is unchanged in kind but sharper in degree: “the CISO reported no significant issues” is a weaker minute than it used to be. Periodic review implies something to review — a measurement that changes between meetings and can be interrogated.

SEBI: standards with prescribed reporting formats

SEBI issued the Cybersecurity and Cyber Resilience Framework for SEBI Regulated Entities by circular dated 20 August 2024 — SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113. CSCRF is structured in parts covering objectives and standards, guidelines, and standardised compliance and audit reporting formats.

Citing that circular alone is the common error, because the provisions a compliance officer actually needs arrived later. The categorisation thresholds — which decide the standards an entity is held to — were revised by SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/60 of 30 April 2025. The deadline reached 31 August 2025 through two extensions, SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/45 of 28 March 2025 and SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/96 of 30 June 2025, both of which carved out market infrastructure institutions, KYC registration agencies and qualified registrars — none of those three took either extension.

The reporting formats matter more than they first appear. Where a regulator prescribes the shape of the evidence, an internal narrative is no longer a substitute for it. The CSCRF compliance guide covers the categories, the Cyber Capability Index and the audit cadence in full.

IRDAI: a new instrument, and a reporting-line test

Insurers were brought under a revised regime on 6 April 2026, when IRDAI issued the Information and Cyber Security Guidelines, 2026 — IRDAI/GA&HR/CIR/MISC/51/4/2026 — in place of its 2023 Guidelines. For a board the sharpest provision is structural rather than technical: the CISO must not report to the Head of IT and must not carry business targets. That is a test an insurer either passes or does not, and it is visible from an organisation chart. What the 2026 Guidelines require covers the governance committees, the testing cadence and the third-party obligations.

CERT-In: six hours

The CERT-In Directions of 28 April 2022, issued under section 70B(6) of the Information Technology Act 2000, require cyber incidents to be reported within six hours of noticing them or being made aware of them. They apply broadly — service providers, intermediaries, data centres, body corporates and government organisations — and non-reporting can attract penal consequences. There is no circular number to cite here: the Directions carry none, and are referenced by their statutory basis and date.

Six hours is an operational constraint disguised as a reporting rule. An organisation that learns about its own incidents from a customer, or from a journalist, has already failed the timeline. Boards should ask how detection actually happens, and how quickly, rather than whether a reporting procedure exists on paper.

DPDP: the clock is already running

The Digital Personal Data Protection Rules were notified on 13 November 2025, operationalising the DPDP Act 2023 with a phased timeline. The provisions establishing the Data Protection Board took effect on notification, though its chairperson and members had still not been appointed by August 2026; Consent Manager registration opens on 13 November 2026; and full compliance is required by 13 May 2027 — the eighteen-month clock running from the notification date.

Eighteen months reads as comfortable and is not. Consent architecture, retention policy, breach response and data-principal rights each touch systems that take multiple quarters to change. Boards seeing a DPDP programme that has not yet started should treat that as a red-flag item now, not in 2027.

Every reference number above was read from the issuing regulator's own notification, each of which is linked. Every instrument cited here was verified against the issuing regulator's own notification on 11 August 2026. This page is general information, not legal advice — confirm applicability and current status with your own counsel and compliance function.

What actually counts as evidence

Across every one of these instruments, the same underlying question recurs: can the organisation demonstrate that oversight happened, rather than assert that it did? Three kinds of artefact carry different weight.

Weak: management assertion

“We take cyber security seriously.” “No material incidents this quarter.” These are statements by the party being overseen, about itself. They are necessary and entirely insufficient.

Better: point-in-time third-party assessment

An annual penetration test or ISO 27001 certification is independent, which is a real improvement. Its limitation is temporal: it describes a moment, and the environment changes daily. A clean test in April says little about your posture in October.

Strongest: continuous, independent, externally verifiable measurement

A measurement calculated by an outside party, updated continuously, benchmarked against sector peers, and reviewable as a trend. It answers the question a director actually needs answered — is this getting better or worse, and how do we compare — in a form that was not produced by the people being assessed.

Where security ratings fit — and where they do not

A security rating is useful here for a specific and limited reason: it is independent, continuous, benchmarked, and produced by a third party. That makes it good evidence of ongoing external oversight, and a reasonable input to the board pack. How ratings are calculated explains the mechanics, including their limits.

It is not, and should not be presented as, compliance with any of the instruments above. None of them can be satisfied by a score. A rating evidences external hygiene and supports third-party due diligence; it says nothing about your internal controls, your incident response capability, your consent architecture, or your DPDP readiness. Treating a good score as regulatory cover would be a serious misreading — of the regulation and of the rating.

Used properly, it does one thing well: it converts “we take cyber seriously” from a claim into a measured, independently calculated, trended position that a director can interrogate and a regulator can be shown.

Related reading

• Third-party risk management for Indian BFSI — building the vendor-oversight side of the same obligation.
• What is a cyber security rating? — the mechanics, and the honest limitations.