--- title: "11 RBI cyber controls, 3 you can’t buy: the other 8 cost ₹27.5 lakh to ₹2.5 crore" summary: "TechBag’s cost bands for the 11 controls in RBI’s July 2026 cyber Directions, read for a fintech that sells to banks and NBFCs, as of September 2026." url: https://www.thetechbag.com/blog/essential-it-solutions-fintech-security-backup-cost format: Analysis desk: "Data & privacy" published: 2026-07-21 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["fintech","RBI","cyber Directions 2026","SEBI CSCRF","CERT-In","payment data localisation","SIEM","backup","penetration testing","third-party risk","DPDP"] cover: https://www.thetechbag.com/blog/covers/essential-it-solutions-fintech-security-backup-cost.png --- # 11 RBI cyber controls, 3 you can’t buy: the other 8 cost ₹27.5 lakh to ₹2.5 crore *TechBag’s cost bands for the 11 controls in RBI’s July 2026 cyber Directions, read for a fintech that sells to banks and NBFCs, as of September 2026.* Analysis · Data & privacy · By TechBag · Published 2026-07-21 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/essential-it-solutions-fintech-security-backup-cost The short version - A fintech’s IT list is now written by the regulator, not by a vendor deck. RBI’s July 2026 cyber Directions map to eleven controls; eight are answered by software, at ₹27.5 lakh to ₹2.5 crore a year at mid-market scale on TechBag’s indicative bands.[1] - The other three, the penetration test, the IS audit cell and the contract flow-down to suppliers, cannot be bought. They are also the three a bank asks its fintech partner about first. - The widest band is logs: monitoring runs ₹8 lakh to ₹90 lakh because it is priced on volume. For a fintech, “cost management” starts with what it ingests and stores, not with a cost tool. In November 2024 this blog told fintech companies to invest in four pillars: security, backup, infrastructure cost management and compliance. It named PCI DSS, GDPR and AML, and no Indian rule. Two years on, the question a fintech founder or CTO actually asks is narrower and harder: which rulebook applies to my company, what does it make me buy, and what does that cost in rupees? On 31 July 2026 the Reserve Bank answered most of it, by repealing 628 supervisory circulars and issuing 64 consolidated Directions, seven of them on cybersecurity, one per licence class, all in force on the day of issue.[2] This piece uses TechBag’s map of those controls to put a price on the four pillars, and to name the three that no purchase discharges. ## Four routes into the rulebook, and most fintechs take two “Fintech” is not a licence. A lending app, a payment gateway, a broker and a core-banking vendor all call themselves fintechs, and each reaches the rulebook differently. If you hold an RBI licence, as a bank, small finance bank, payments bank, NBFC or credit information company, one of the seven Directions binds you directly. The NBFC Direction attaches chapters by scale-based layer and, inside the Base Layer, by a ₹500 crore asset-size test.[3] If you are registered with SEBI, as a broker, adviser or fund, the Cybersecurity and Cyber Resilience Framework (CSCRF) of 20 August 2024 applies, graded by size: a broker with more than 5,00,000 active clients is a Qualified entity.[4] Most fintechs we speak to hold neither. They sell software or services to a bank or NBFC, and the rulebook reaches them through the contract. The urban co-operative bank Direction is explicit: the bank must impose 12 named controls on its ATM switch provider (paragraph 83) and 34 on its core-banking provider (paragraph 85).[1] Whatever your route, two older rules apply to everyone: CERT-In’s six-hour incident reporting and 180-day log retention, and the RBI’s 2018 rule that payment system data is stored only in India.[5][6] **Figure: A fintech meets the rulebook through a licence, a SEBI registration, a supplier contract, or simply by operating in India** *Which cybersecurity instrument binds which kind of fintech, as of September 2026* 1. 01Licensed by RBIBank, SFB, payments bank, NBFC, CIC or AIFI: one of seven Directions, in force on 31 July 2026 with no phase-in. 2. 02Registered with SEBIBroker, adviser, AMC, portfolio manager: CSCRF, with the category set by active clients or assets under management. 3. 03Supplier to eitherNo licence, but the bank must write the controls into your contract: 12 for an ATM switch, 34 for core banking. 4. 04Everyone in IndiaCERT-In: report in six hours, keep logs 180 days. RBI: payment data stored only in India. DPDP Rules from 2027. Source: RBI Directions of 31 July 2026 (UCB, NBFC); SEBI CSCRF circular of 20 August 2024; CERT-In Directions of 28 April 2022; RBI payment data circular of 6 April 2018 · as of 30 September 2026 Our view Our view: if you sell to banks, read the Direction your largest customer is bound by before you read any vendor’s brochure. Its supplier clauses are your real requirements document, and they arrive at renewal whether or not you prepared for them. ## The eight controls software answers, priced TechBag’s BFSI obligations map takes the chapter sub-sections of the RBI’s urban co-operative bank Direction and turns them into eleven controls, each linked to the category guide that shortlists products and each carrying an indicative annual cost band for an Indian organisation with 200 to 1,000 endpoints.[1] The UCB Direction is the most granular of the seven, which is why we used it; a licensed NBFC or a bank’s supplier will find the same families of control, sized differently. **Figure: Monitoring has the widest band, ₹8 lakh to ₹90 lakh a year, because it is priced on log volume** *TechBag's indicative annual cost band per control: the floor, then the spread up to the ceiling, ₹ lakh, mid-market scale, September 2026* Audit logs and monitoring 82 90 lakh Privileged access 35 40 lakh Backup and continuity 32 35 lakh Data leak prevention 26 30 lakh Asset inventory 15 18 lakh Endpoint protection 13 15 lakh Patch management 12 lakh Email security 10 lakh | | Floor of the band | Spread to the ceiling | | --- | --- | --- | | Audit logs and monitoring | 8 | 82 | | Privileged access | 5 | 35 | | Backup and continuity | 3 | 32 | | Data leak prevention | 4 | 26 | | Asset inventory | 3 | 15 | | Endpoint protection | 2 | 13 | | Patch management | 1.5 | 10.5 | | Email security | 1 | 9 | Source: TechBag BFSI obligations map, derived from RBI/DoS/2026-27/437 · as of 30 September 2026 · indicative bands, not quotes; GST extra; the bar's end is the band's ceiling. Monitoring is priced by ingest, privileged access by privileged account, backup by protected TB, email by mailbox TechBag countTechBag count Adding the low ends of the eight bands gives ₹27.5 lakh a year; adding the high ends gives ₹2.5 crore. Add the vulnerability-scanning platform (₹2 lakh to ₹20 lakh) and an outsourced SOC used to meet the supplier flow-down (₹6 lakh to ₹50 lakh) and the full map runs ₹35.5 lakh to ₹3.2 crore. These are sums of indicative bands from the map, not a quote for any company. Read the chart for its shape, not its total. Four of the original post’s security tools, endpoint, email, data leak prevention and identity, sit in the middle. Backup, the second pillar, carries a ₹35 lakh ceiling because it is priced by protected terabyte, and the RBI asks for restore tests with dates and outcomes, not backup success reports, which prove only that data was written.[1] The payment data rule adds a constraint the 2024 post never mentioned: a copy of payment data is still payment data, so the backup target and the recovery site must be in India.[6] Our [backup comparison](https://www.thetechbag.com/blog/simplify-multi-cloud-data-management-deep-dive) counts which products document an India region. The widest band is monitoring, and that is where the third pillar, cost management, really lives. The map’s own note on that band is that “the licence is the small number”: a log platform is priced on what you ingest and how long you keep it. The RBI expects a year of audit logs; CERT-In expects 180 days kept in India.[1][5] A fintech that logs every API call at debug level pays for that choice every month. Cutting noise at the source is the cheapest cost control on this list. ## Three obligations no purchase discharges The fourth pillar, compliance, is where the 2024 post went most wrong. It suggested automated reporting tools, audit platforms and eDiscovery. Three of the eleven controls in the map are not products at all, and the map says so in as many words.[1] **Figure: The three controls a bank asks its fintech partner about are a test, a team and a contract** *Controls in RBI's 2026 UCB cyber Direction that software cannot discharge, against the evidence a supervisor expects, September 2026* What no purchase discharges - Penetration test: at least yearly, by a competent independent assessor; a scanner finds issues, it does not test - IS Audit cell: a team inside the audit department, reporting to the Audit Committee - Contract flow-down: 12 controls for ATM switch providers, 34 for core banking, written into signed agreements What the supervisor asks to see - The test reports, the assessor's independence, and the remediation trail - The audit policy, the cell's composition, and what happened to the last findings - The clauses in executed agreements, and the letters asking suppliers to amend them - Restore tests with dates, and an incident with both six-hour filing timestamps Source: TechBag BFSI obligations map, derived from RBI/DoS/2026-27/437, Chapters III and IV · as of 30 September 2026 For a fintech supplier, the third item is the one to prepare for. A bank that must put 34 controls into its core-banking contract will send you those 34 controls, and your answers become evidence in its inspection. Buying a third-party-risk platform does not help you answer; it helps the bank track you. What helps is having the penetration test report, the access-review trail and the restore-test log ready before the questionnaire arrives. ReportedWhat the map says about the pen test Vulnerability assessment of critical and internet-facing applications every six months and a penetration test at least once a year. The scanning platform costs ₹2 lakh to ₹20 lakh a year; the test is a separate engagement. TechBag does not perform or resell penetration testing; the map points readers to a CERT-In empanelled assessor.[1] Our view Our view: a fintech under ₹50 crore of revenue should spend its first compliance rupee on a clean, independent pen test and a documented restore drill, not on a compliance dashboard. The dashboard reports on evidence; it does not create it. If you are buying this in India The bands above are indicative annual costs before GST; budget 18% on top of any quote. Most of the categories are sold in US dollars and invoiced in rupees by a reseller, so ask for an INR quote with the GST line shown, and a price lock for the term. TechBag quotes all eight software categories this way; the map links each control to the guide that does the shortlisting. The dated obligations, as of September 2026: the **RBI cyber Directions** of 31 July 2026 are in force on issue for regulated entities, with no transition period.[2] **SEBI’s CSCRF** has been in force since 31 August 2025 for regulated entities after its June 2025 extension.[7] **CERT-In’s Directions** of 28 April 2022 require reporting within six hours and 180 days of logs.[5] The **RBI payment data circular** of 6 April 2018 keeps payment system data in India.[6] The **DPDP Rules**, notified on 13 November 2025, bring the security-safeguard and breach-notice duties into force on 13 May 2027.[8] A fintech that touches customer data answers to the last two whatever its licence. How we did this Figures as of 30 September 2026 The eleven controls, their cost bands, the supplier-control counts and the evidence lists are taken from TechBag’s BFSI obligations map as it stood on 30 September 2026; the map is derived from the chapter sub-sections of the RBI’s urban co-operative bank Direction (RBI/DoS/2026-27/437), and its instrument records were verified against rbi.org.in on 26 August 2026. The bands are TechBag’s indicative ranges for 200 to 1,000 endpoints, not quotes; the sums are simple additions of those bands. The NBFC Direction has a different chapter structure and has not been mapped control by control. No product has yet been assessed against the 2026 Directions, so this piece names none. Excluded: GST, implementation services and the penetration-test engagement fee. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, BFSI obligations map: eleven controls with cost bands, derived from RBI Directions RBI/DoS/2026-27/437 (Urban Co-operative Banks)](https://www.thetechbag.com/industries/bfsi/obligations) — instrument records verified 26 August 2026 2. [RBI, repeal circular DoS.CO.PPG.66/11.01.005/2026-27 (628 circulars repealed, 64 Directions issued) and Master Directions list](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx) — 31 July 2026 3. [RBI, Non-Banking Financial Companies cyber Directions, 2026 (RBI/DoS/2026-27/461)](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=13592) — 31 July 2026 4. [SEBI, Cybersecurity and Cyber Resilience Framework for SEBI Regulated Entities (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113)](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) — 20 August 2024 5. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, 180-day logs)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 6. [RBI, Storage of Payment System Data (RBI/2017-18/153)](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11244) — 6 April 2018 7. SEBI, extension of CSCRF timelines (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/96) — 30 June 2025 Circular cited by number; in force for regulated entities from 31 August 2025. 8. [DPDP Rules 2025, commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 Related on TechBag: the [BFSI obligations map](https://www.thetechbag.com/industries/bfsi/obligations) holds every control in this piece with its guide; the [SIEM and log management guide](https://www.thetechbag.com/browse/security/siem-log-management) prices the widest band. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [BFSI obligations: the 11 controls, each with a guide and a cost band](https://www.thetechbag.com/industries/bfsi/obligations) — the map every number in this piece comes from - [SIEM & log management guide](https://www.thetechbag.com/browse/security/siem-log-management) — the widest band, priced on ingest