What documents must a bank board approve under the RBI 2026 Directions?

In the commercial banks Directions, paragraph 7 of Chapter II requires the board to approve the strategies and policies for five named frameworks: Information Technology, Information Assets, Business Continuity, Information Security and Cybersecurity — the last expressly including Incident Response and Recovery Management and Cyber Crisis Management. Paragraph 8 requires them reviewed at least annually — since 1 October 2026 by the board or, if it delegates, its IT Strategy Committee, with material amendments still approved by the board. Chapter III then adds an Information Security Policy at paragraph 14 and a Cybersecurity Policy at paragraph 15, which must be a distinct and separate document. The small finance bank, payments bank, AIFI and credit information company Directions carry the same provisions one paragraph lower — 6, 7, 13 and 14 — and in the AIFI and CIC texts the annual review stays with the board.

Does the cybersecurity policy have to be separate from the IT policy?

Yes, under both regimes. Paragraph 15 of the RBI commercial banks Directions, and paragraph 14 of the small finance bank, payments bank, AIFI and CIC Directions, requires the Cybersecurity Policy to be “distinct and separate from the broader IT policy / Information Security policy” so that cyber risks and the measures against them are visible on their own. The urban co-operative bank Directions say the same at paragraph 12. One document with a security chapter inside it does not satisfy either.

What policy does SEBI CSCRF require a board to approve?

A comprehensive Cybersecurity and Cyber Resilience policy document encompassing CSCRF, approved by the Board, Partners or Proprietor and reviewed by them periodically, under standards GV.PO.S1, GV.PO.S2 and GV.PO.S5. The requirement most often missed is that where the entity deviates from CSCRF, the reasons for the deviation — technical or otherwise — must be stated in the policy document itself.

Does a small urban co-operative bank need an IT Strategy Committee?

No. The urban co-operative bank Directions raise the committee only at Level IV, and even there paragraph 8 says the bank “may consider” setting one up, with a minimum of two directors one of whom is a professional director. That is discretionary, and it is a smaller committee than the minimum of three directors the commercial banks Directions require at Chapter III.

Does every SEBI regulated entity need a CISO?

No. CSCRF requires a Chief Information Security Officer reporting directly to the MD and CEO for Market Infrastructure Institutions and Qualified REs, under GV.RR.S3. Mid-size, small-size and self-certification REs designate a Designated Officer instead, with the same functions and no stated reporting line to the MD and CEO. Describing the CISO requirement as applying across CSCRF overstates it for three of the five categories.

Free tool · Board governance

What a commercial bank board has to approve

The documents, committees and roles your board must put in place under the RBI 2026 Directions or SEBI CSCRF, each cited to its own paragraph or standard.

No sign-in. Nothing leaves your browser.Sources verified 3 September 2026Reviewed by Nimitt Jhaveri

In short

A board under the RBI Directions of 31 July 2026 approves the strategies and policies for five named frameworks, an Information Security Policy and a separate Cybersecurity Policy. Under SEBI CSCRF it approves a Cybersecurity and Cyber Resilience policy document that must record every deviation from the framework and the reason for it. The lists differ by NBFC chapter, by urban co-operative bank level and by CSCRF category.

Your board document register

The commercial banks instrument is the most specified of the seven. Its paragraph 7 names five frameworks rather than the three usually reported, paragraph 8 has them reviewed at least annually, by the board or since 1 October 2026 its IT Strategy Committee, and paragraph 15 insists the cybersecurity policy be a document of its own.

The instrument is Reserve Bank of India (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, RBI/DoS/2026-27/410. It binds: Banking companies other than Small Finance Banks, Payments Banks and Local Area Banks, together with corresponding new banks and the State Bank of India. Foreign banks operating through branches follow comply-or-explain on selected chapters.

7 artefactsCommercial bank

A banking company other than a Small Finance Bank, Payments Bank or Local Area Bank, together with the corresponding new banks and the State Bank of India.

5 documents the board approves, plus 2 committees and named roles it has to put in place. Every row cites the paragraph or standard it comes from.

Board artefacts for Commercial bank, each cited to its paragraph or standard
Artefact	Approved by	Back before them	Clause
Strategies and policies for five named frameworks Document	The Board	At least annually	Chapter II, paragraphs 7 and 8
Information Security Policy Document	The Board	At least annually	Chapter III, paragraph 14 (commercial banks); paragraph 13 (SFBs, Payments Banks, AIFIs, CICs)
Cybersecurity Policy — a separate document Document	The Board	At least annually	Chapter III, paragraph 15 (commercial banks); paragraph 14 (SFBs, Payments Banks, AIFIs, CICs)
IT Governance Framework Document	The Board	Periodically	Chapter III, paragraphs 11 and 12 (commercial banks); paragraphs 10 and 11 (SFBs, Payments Banks, AIFIs, CICs)
Enterprise-wide or operational risk management policy Document	The Board	Periodically	Chapter III, paragraph 13 (commercial banks); paragraph 12 (SFBs, Payments Banks, AIFIs, CICs)
IT Strategy Committee of the Board Committee	The Board	Periodically	Chapter II paragraph 9, with composition at Chapter III paragraphs 16 to 19 (commercial banks); paragraph 8, with paragraphs 15 to 18 (SFBs, Payments Banks, AIFIs, CICs)
Audit Committee of the Board Committee	The Board	Periodically	Chapter II, paragraph 10 (commercial banks); paragraph 9 (SFBs, Payments Banks, AIFIs, CICs)

What each one has to contain

Strategies and policies for five named frameworks. Information Technology, Information Assets, Business Continuity, Information Security and Cybersecurity — the last of which expressly includes Incident Response and Recovery Management and Cyber Crisis Management. Five frameworks, not three. Summaries of these Directions commonly report the board approving “the IT, cybersecurity and business continuity strategies”, which drops Information Assets and Information Security. Paragraph 8, as substituted from 1 October 2026, lets the board delegate the annual review to its IT Strategy Committee while keeping approval of material amendments — so the review can move to the committee, but an approval with no review in the year is still a gap.
Information Security Policy. Objectives, scope, ownership and responsibility for the policy; the information security organisational structure; exceptions; compliance review; and penal measures for non-compliance.
Cybersecurity Policy — a separate document. The strategy for combating cyber threats, sized to the complexity of the business and to acceptable levels of risk, duly approved by the board. Paragraph 15 of the commercial banks Directions, and paragraph 14 of the other four, requires this policy to be “distinct and separate from the broader IT policy / Information Security policy”, so that the cyber risks and the measures against them are visible on their own. One document with a security chapter in it does not satisfy it — this is two documents, and on the reading above, three.
IT Governance Framework. The governance structure and processes needed to meet the strategic objectives; the roles and authority of the Board, its committee and senior management; and oversight mechanisms for accountability and for mitigating IT and cyber risk. Focus areas are strategic alignment, risk management, resource management, performance management and business continuity.
Enterprise-wide or operational risk management policy. Periodic assessment of IT-related risks, both inherent and potential, incorporated into the existing risk policy rather than kept in a separate technology document.
IT Strategy Committee of the Board. A minimum of three directors including its chairperson. The commercial banks Directions alone add that a foreign bank operating through branch mode may rely on a controlling, head, regional or zonal office committee, provided the governance responsibilities are met.
Audit Committee of the Board. Oversight of the Information Systems Audit.

Indicative, and not legal advice. RBI paragraph numbers read from the Directions of 31 July 2026 on the RBI’s own notification pages; CSCRF standard codes and their applicability read from SEBI’s own copy of the framework. Whether an artefact reaches your entity, and what it has to say, is a determination for your compliance and legal team.

Take this away as a print-ready board document register

Everything above is yours already. This is the version you can put in front of your team — the same result with your details on it, an owner column against every action, and the checklist attached. It opens here and lands in your inbox, so it is to hand when you actually need it rather than in a tab you closed.

Why the cybersecurity policy is its own document

Both the RBI Directions and SEBI CSCRF require a cybersecurity policy that is distinct from the IT and information security policies, so that cyber risk is visible on its own rather than as a chapter inside something longer. That is the requirement most often satisfied on paper and not in fact, and it is the one an inspection can test by asking for the document by name.

RBI paragraph numbers read from the Directions of 31 July 2026 on the RBI’s own notification pages. CSCRF standard codes and applicability read from SEBI’s own copy of the framework. Indicative, and not legal advice.

Every instrument cited here was verified against the issuing regulator's own notification on 3 September 2026.

Other worked examples

The same calculator, run for a specific entity — with the thresholds and clocks that apply to it, and the instrument each one comes from.

Questions this page answers

What documents must a bank board approve under the RBI 2026 Directions?: In the commercial banks Directions, paragraph 7 of Chapter II requires the board to approve the strategies and policies for five named frameworks: Information Technology, Information Assets, Business Continuity, Information Security and Cybersecurity — the last expressly including Incident Response and Recovery Management and Cyber Crisis Management. Paragraph 8 requires them reviewed at least annually — since 1 October 2026 by the board or, if it delegates, its IT Strategy Committee, with material amendments still approved by the board. Chapter III then adds an Information Security Policy at paragraph 14 and a Cybersecurity Policy at paragraph 15, which must be a distinct and separate document. The small finance bank, payments bank, AIFI and credit information company Directions carry the same provisions one paragraph lower — 6, 7, 13 and 14 — and in the AIFI and CIC texts the annual review stays with the board.
Does the cybersecurity policy have to be separate from the IT policy?: Yes, under both regimes. Paragraph 15 of the RBI commercial banks Directions, and paragraph 14 of the small finance bank, payments bank, AIFI and CIC Directions, requires the Cybersecurity Policy to be “distinct and separate from the broader IT policy / Information Security policy” so that cyber risks and the measures against them are visible on their own. The urban co-operative bank Directions say the same at paragraph 12. One document with a security chapter inside it does not satisfy either.
What policy does SEBI CSCRF require a board to approve?: A comprehensive Cybersecurity and Cyber Resilience policy document encompassing CSCRF, approved by the Board, Partners or Proprietor and reviewed by them periodically, under standards GV.PO.S1, GV.PO.S2 and GV.PO.S5. The requirement most often missed is that where the entity deviates from CSCRF, the reasons for the deviation — technical or otherwise — must be stated in the policy document itself.
Does a small urban co-operative bank need an IT Strategy Committee?: No. The urban co-operative bank Directions raise the committee only at Level IV, and even there paragraph 8 says the bank “may consider” setting one up, with a minimum of two directors one of whom is a professional director. That is discretionary, and it is a smaller committee than the minimum of three directors the commercial banks Directions require at Chapter III.
Does every SEBI regulated entity need a CISO?: No. CSCRF requires a Chief Information Security Officer reporting directly to the MD and CEO for Market Infrastructure Institutions and Qualified REs, under GV.RR.S3. Mid-size, small-size and self-certification REs designate a Designated Officer instead, with the same functions and no stated reporting line to the MD and CEO. Describing the CISO requirement as applying across CSCRF overstates it for three of the five categories.