RBI Cybersecurity Guidelines for Banks and NBFCs: A Practical Compliance Guide

Which entities do the RBI cybersecurity guidelines cover?

RBI directions cover a wide set of regulated entities. The depth of expected controls depends on size, complexity and digital exposure.

What does the 2023 IT Governance Master Direction require?

The Master Direction pulls earlier circulars into one framework and focuses on governance and assurance. Key requirements include:

• A board-level IT Strategy Committee and an IT Steering Committee
• A Chief Information Security Officer independent of IT operations
• Board-approved information security and cyber crisis management policies
• Asset inventory, data classification and access control
• Business continuity and disaster recovery with regular drills
• Vendor and outsourcing risk management
• Periodic IS audits and vulnerability assessments

How quickly must cyber incidents be reported?

Regulated entities must report unusual cyber incidents to RBI promptly, generally within 6 hours of detection. Separately, the CERT-In directions of April 2022 require reporting of specified incidents to CERT-In within 6 hours.

This short window means you need 24x7 monitoring and a clear escalation process. An incident discovered on a Saturday night cannot wait for Monday's meeting.

How often should banks run VAPT and audits?

RBI expects risk-based testing. The schedule below reflects common practice among regulated entities and what examiners typically look for.

What are the most common RBI audit gaps?

In our audits of banks and NBFCs, the same weaknesses appear again and again. Fixing these early saves time during RBI inspection.

• Privileged accounts without MFA or session recording
• Unpatched internet-facing servers and VPN appliances
• Logs not retained for 180 days as required by CERT-In
• Outdated asset inventory and shadow IT
• Vendor access not reviewed or revoked on time
• Disaster recovery plans never fully tested

How can banks and NBFCs build a compliant cybersecurity programme?

Start with a gap assessment against the applicable RBI direction. Prioritise fixes by risk, then put continuous controls in place: a SOC for monitoring, a vulnerability management cycle, and a tested incident response plan.

Many mid-size banks and NBFCs choose SOC-as-a-Service rather than building an in-house team, as it provides 24x7 coverage and threat intelligence at a predictable cost.

How KCyber Experts supports RBI compliance

KCyber Experts is a CERT-In empanelled auditor working with BFSI organisations. We deliver RBI-ready IS audits, VAPT of banking apps and APIs, SOC-as-a-Service, incident response and remediation support, with reports structured the way regulators expect to read them.

What role does the board and CISO play under RBI rules?

RBI is clear that cybersecurity is not only an IT function. The board must approve the information security policy, review cyber risk regularly and ensure enough budget and skilled people are available. The IT Strategy Committee oversees technology risk, while the CISO runs the security programme day to day.

The CISO should report independently, not to the head of IT operations, so that security concerns are escalated without conflict of interest. Examiners often ask for board minutes showing that cyber risk, incidents and audit findings were discussed and acted upon.

A practical way to show this is a quarterly cyber risk dashboard for the board covering open audit findings, critical vulnerabilities, incident trends, SOC metrics such as mean time to detect and respond, and the status of remediation projects. This turns compliance into a measurable, ongoing process instead of a once-a-year exercise before inspection.