RBI Cyber Security Framework: A Compliance Guide for REs

Most banks and NBFCs think they are compliant with the RBI cybersecurity framework right up until the examiner asks one question: show me the board minute where your CISO presented the last unusual cyber incident, and show me you reported it to RBI within six hours. The room goes quiet. The policy exists, beautifully bound. The evidence does not.

That gap between having a policy and being able to prove you live it is where almost every RBI cyber audit goes wrong. This guide is about closing it. Not the theory of the framework, but what a regulated entity actually has to produce, on what timeline, and what an examiner does when you cannot.

When people say the RBI cybersecurity framework they usually mean one specific circular: RBI/2015-16/418 (DBS.CO/CSITE/BC.11/33.01.001/2015-16) dated 2 June 2016, titled Cyber Security Framework in Banks. But that circular is now the floor, not the ceiling. Over the years RBI layered several instruments on top, and which ones bind you depends on what kind of regulated entity (RE) you are.

An RE is any entity RBI regulates: scheduled commercial banks, small finance banks, payments banks, urban co-operative banks, and non-banking financial companies (NBFCs). The rulebook is not one document. It is a stack, and the examiner expects you to know which layers apply to you.

The practical mistake is reading only the 2016 circular. If you are an NBFC, your primary obligation now flows from the 2023 IT Governance Master Direction, and your outsourcing obligations from the IT Outsourcing Master Direction. If you issue cards or run a mobile app, the Digital Payment Security Controls direction is where you will actually get hurt in an audit.

Strip away the hundreds of individual control points and an RBI cyber inspection is really testing five things. Get these five right and the detailed controls tend to fall into place. Get them wrong and no amount of tooling saves you.

The framework is explicit that cybersecurity is a board and top-management responsibility, not something you delegate to IT and forget. The examiner will ask for the board-approved cybersecurity policy, and crucially it must be distinct from your broader IT policy or information security policy. They are separate documents for a reason. Then they will read the minutes: did the board actually discuss cyber risk, or did it rubber-stamp a policy once and never revisit it?

The 2016 circular ships with Annex 1, a baseline of controls every bank must implement regardless of size. This is where inspections spend most of their time, because it is concrete and testable. Annex 1 covers inventory management, network and boundary defences, patch and vulnerability management, user access, secure configuration, application security, anti-malware, data leak prevention, and more. The examiner does not want to hear that you have a firewall. They want the rule base, the change tickets, and the last review date.

The framework requires continuous surveillance through a Cyber Security Operations Centre (C-SOC or SOC). Whether you build it in-house or outsource it, the examiner tests whether it produces outcomes. What is your log source coverage? Are your critical systems and privileged accounts actually feeding the SIEM, or is coverage 40 percent and nobody noticed? When was your last detected-and-contained incident, and what was the mean time to detect?

This is the single control most REs fail. The 2016 framework requires banks to report unusual cybersecurity incidents to RBI within two to six hours of detection. It is not enough to eventually file a report. You must show the detection timestamp, the triage decision, and the report submission timestamp, and the delta must be inside the window. Separately, if you are also a CERT-In constituent, you must report specified incident types to CERT-In within six hours under the CERT-In directions of 28 April 2022. Two clocks, both running, both from the moment of noticing.

You cannot mark your own homework. The framework and the 2023 IT Governance direction require periodic Information Systems (IS) audit and Vulnerability Assessment and Penetration Testing (VAPT). Critically, RBI expects VAPT of internet-facing and critical applications at least annually, and after every material change, conducted by a competent, independent party (in practice, a CERT-In empanelled auditor). The examiner reads the report AND the closure evidence for the findings.

Let me give you a concrete scene, because the abstract requirements only make sense once you have watched them play out.

A mid-sized NBFC, roughly 900 crore book, invites us for a pre-inspection readiness review three months before RBI is due. The CISO is confident. The policy binder is immaculate. We ask for the VAPT report on the customer-facing loan app. It exists, dated fourteen months ago. Since then they shipped a new eKYC flow and switched payment gateways. No re-test. That is a finding on its own: the framework requires re-testing after material change, and a new eKYC and gateway is unambiguously material.

Then we ask for the last incident. They had a credential-stuffing wave two months prior. Detected by the SOC at 11:20, escalated internally, remediated by end of day. Good response. We ask for the RBI incident report. Blank stares. Nobody had classified it as an unusual cyber incident, so nothing went to RBI. That is the finding that turns a routine inspection into a supervisory concern, because it signals a governance failure, not just a control gap. Detection worked; the reporting muscle did not exist.

The fix took six weeks: a written incident classification matrix mapping event types to RBI and CERT-In reporting obligations, a two-hour reporting SLA baked into the runbook with a named accountable officer, and a re-test of the app. None of it was expensive. All of it was invisible until someone asked the right question.

Because timing is where REs get caught, it is worth setting out the clocks side by side. Treat these as hard deadlines, not targets.

One clarification that trips people up: the six-hour CERT-In clock starts when you notice the incident, and CERT-In also requires you to keep logs for 180 days and sync clocks to NPL or NIC time. If your log retention is 90 days, you have a live non-compliance sitting in your infrastructure right now, and it is trivially provable.

For years NBFCs treated the bank framework as somebody else s problem. The 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices ended that. Effective 1 April 2024, it brought NBFCs (in the middle and upper layers of the scale-based regulation) firmly into scope for board-level IT governance, IT and information security functions, cyber crisis management plans, BCP and DR with defined RTO and RPO, and IS audit.

If you are an NBFC and your last board-approved cyber policy predates April 2024, or you have no independent CISO function, or your IS audit does not exist, you are behind. RBI has been actively inspecting NBFC IT governance since the direction took effect, and this is exactly the low-hanging finding inspectors look for.

REs consistently under-budget for this, then panic-spend before an inspection. Here is a realistic picture for a mid-sized NBFC or small bank, annualised. Figures are indicative ranges and vary with scope and geography.

The number that should worry you is not the spend. It is the cost of getting it wrong. A supervisory finding can trigger enhanced monitoring, restrictions on onboarding new digital customers, and in serious cases monetary penalties running from tens of lakhs upward. RBI has levied penalties in the crore range on entities for IT and cyber lapses. The audit is the cheap part.

Across readiness reviews, the same five gaps recur. If you fix nothing else this quarter, fix these.

Turn the above into action. Work through this in order; it is roughly the sequence an examiner would.

Come back to that silent audit room. The policy was fine. The tooling was fine. What was missing was proof that the organisation lives its controls day to day: the board minute, the six-hour report, the re-test after the change. RBI compliance is not a binder you produce for the inspection. It is an evidence trail you generate continuously, so that whenever the examiner asks, the answer is already sitting there with a timestamp on it.

If you want a candid read on where your evidence trail actually stands before RBI asks, our CERT-In empanelled auditors do this hands-on, in the room, the same way an examiner would. No binder theatre, just the questions that matter and the gaps that would surface.