By Akash Sengar · · 7 min read
Start with who regulates you
Indian financial-sector cyber rules are set by your regulator and, in most cases, by the type of entity you are. Before reading any framework, answer three questions: who licenses you (RBI, SEBI, IRDAI or more than one), which category you fall into, and, for NBFCs, which layer and asset size apply. Then use the sections below. Every entity, whatever its regulator, also has the CERT-In reporting duty.
ITCCS helps with readiness, gap assessments and remediation. We do not perform statutory or regulatory audits.
RBI: entity-wise Directions of 31 July 2026
On 31 July 2026, the Reserve Bank of India issued separate Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 for each category of regulated entity, consolidating earlier circulars. We have confirmed these on rbi.org.in:
- Commercial Banks (updated as on 1 October 2026).
- Small Finance Banks.
- Payments Banks (updated as on 1 October 2026).
- Urban Co-operative Banks, with requirements arranged in levels.
- Non-Banking Financial Companies.
- All India Financial Institutions.
Other categories may have their own Directions; check the Master Directions list on rbi.org.in for your entity type rather than relying on a summary.
Banks and AIFIs
The bank and AIFI Directions share a structure: Board-approved policies and committees; IT governance including an IT Strategy Committee, IT Steering Committee, Information Security Committee and a Chief Information Security Officer; IT and information security risk management; and baseline cybersecurity and resilience requirements such as asset inventory, secure configuration, patch and vulnerability management, access control, log monitoring and third-party arrangements.
NBFCs: scaled by layer and asset size
The NBFC Directions apply proportionately:
- Base Layer below ₹500 crore assets, and Core Investment Companies: baseline cybersecurity and resilience requirements.
- Base Layer at ₹500 crore and above: IT governance, IT policy, information and cybersecurity, IT operations, information systems audit, business continuity and disaster recovery, and IT outsourcing.
- Middle Layer and above (excluding CICs): fuller IT governance, IT and information security risk management, baseline requirements and information systems audit.
The NBFC Directions include a repeal and saving chapter covering earlier instructions, including the previous NBFC IT governance directions. Read the repeal list in the Directions to see exactly which documents they replace.
Payment system operators
Authorised non-bank payment system operators are covered by the Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators issued on 30 July 2024. Check rbi.org.in for any later updates that apply to your authorisation.
SEBI: CSCRF
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued on 20 August 2024, applies to SEBI-regulated entities including stock brokers, depository participants, mutual funds and AMCs, portfolio managers, investment advisers, research analysts, KYC registration agencies, registrars and share transfer agents, stock exchanges, depositories and clearing corporations. SEBI published clarifications on 31 December 2024.
CSCRF sorts entities into categories by size and type, and requirements scale with the category. It requires periodic cybersecurity audits by CERT-In-empanelled auditors. We help with readiness and remediation before that audit; we are not an empanelled auditor and do not conduct it.
IRDAI: Information and Cyber Security Guidelines, 2026
IRDAI issued revised Information and Cyber Security Guidelines, 2026 on 6 April 2026, replacing the 2023 guidelines, for insurers (including foreign reinsurance branches), insurance intermediaries and the Insurance Information Bureau, with compliance expected from the current financial year. The summary of changes includes more frequent Information Security Risk Management Committee meetings and Board responsibility for budget and for closing audit gaps within 12 months.
CERT-In: six-hour reporting for everyone
Whatever your regulator, the CERT-In Directions of 28 April 2022 require reportable cyber incidents to be reported to CERT-In within six hours of noticing them, logs kept for 180 days in India, and clocks synchronised. Sector rules may add their own reporting to your regulator. See our CERT-In reporting guide.
A quick decision table
- Bank, SFB, payments bank, UCB, AIFI: your entity's RBI Directions of 31 July 2026, plus CERT-In.
- NBFC: the NBFC Directions, at the chapter for your layer and asset size, plus CERT-In.
- Non-bank payment system operator: the RBI PSO Master Directions, plus CERT-In.
- SEBI-regulated entity: CSCRF for your category, with audits by a CERT-In-empanelled auditor, plus CERT-In.
- Insurer or intermediary: IRDAI Guidelines, 2026, plus CERT-In.
- Fintech or vendor serving these entities: not directly regulated, but expect the regulated entity's third-party requirements in your contract and audits.
If you supply a regulated entity
Technology vendors, fintechs and service providers to banks, NBFCs, brokers and insurers are usually not regulated directly by these frameworks, but the requirements reach them through contracts. The RBI Directions include sections on third-party arrangements, and SEBI and IRDAI frameworks cover third-party service providers. Expect your customer to ask for:
- Security questionnaires and evidence of your controls, often mapped to their framework.
- Audit rights, including access for the regulator.
- Incident notification to the customer within a short, defined time, so they can meet their own reporting duties.
- Data location, encryption, access control and log retention commitments.
- Business continuity and exit arrangements.
An ISO/IEC 27001 certificate or SOC 2 report does not replace these requirements, but it answers many questions at once.
Areas worth checking first
Reading the Directions and frameworks side by side, a few requirements tend to need the most preparation:
- Governance: committee composition, meeting frequency and minutes, and an independent CISO role where required.
- Asset inventory: a complete, current inventory of information assets, including cloud and SaaS.
- Logging and monitoring: log sources, retention and review that meet both the sector rules and the CERT-In 180-day requirement.
- Third parties: contracts, assessments and exit plans for critical vendors.
- Incident response: a plan that covers the regulator's reporting as well as CERT-In, tested in an exercise.
Running a gap assessment
- Download the Directions or framework for your exact category and turn each requirement into a line in a tracker.
- Record current status, evidence, owner and gap for each.
- Prioritise by regulatory deadline, risk and audit findings.
- Fix, collect evidence and get Board or committee sign-off where required.
- Repeat before each audit cycle.
Our BFSI page explains how we support regulated financial entities.
This guide is general guidance, not legal advice.
