RBI cybersecurity Directions · in force 31 July 2026The RBI replaced the whole framework. Which one binds you?
7 Directions, each for one licence class, all in force the day they were issued. No transition period. How much of yours applies is decided by facts that are not on your balance sheet.
What happened
Hundreds of circulars became one Direction for you.
The Reserve Bank repealed 628 supervisory circulars — consolidated or obsolete — and issued 64 consolidated Directions. Seven of the 64 cover cybersecurity, each for one licence class; Local Area Banks, Regional Rural Banks, rural co-operative banks and asset reconstruction companies have none in this set. All took effect immediately: the Directions contain no transition period, phase-in or glide path.
- 628supervisory circulars repealed
- 64consolidated Directions issued in their place
- 7of them cover cybersecurity — each for one licence class
- 1binds your institution
Which one binds you?
Free · no emailPick your licence class. Two taps to your instrument, your tier and what you owe.
Indicative, based on the published notifications as we read them. Confirm your classification with your compliance function before acting on it.
Nine doors — find yours
Seven RBI Directions, each for one licence class, plus SEBI's CSCRF and IRDAI's guidelines. Each opens the whole regulation for that licence in the explorer.
- Commercial bankRBIApplies as a whole2026-27/410
- Urban co-operative bankRBILevels I–IV, by digital services2026-27/437
- Small finance bankRBIApplies as a whole2026-27/419
- Payments bankRBIApplies as a whole2026-27/428
- NBFCRBIBy layer; Base splits at ₹500 cr2026-27/461
- All India financial institutionRBIApplies as a whole2026-27/456
- Credit information companyRBIApplies as a whole2026-27/470
- SEBI-regulated entitySEBICSCRF — banded by entity typeITD-1/ITD_CSC_EXT/P/CIR/2024/113
- Insurer or intermediaryIRDAIIRDAI guidelines, reissued 2026Information and Cyber Security Guidelines, 2026
All 7 read in full, from the notifications
Not by what you are worth
Only two of the seven Directions are graded. A ₹300-crore co-operative bank with UPI membership sits at Level II — digital depth sets the staircase, not size. NBFCs are graded by layer, and the Base splits at ₹500 crore.
Urban co-operative banks
Levels I–IV, by digital services
- Level I
- Every UCB
- Level II
- Sub-member + UPI/IMPS/CTS or net banking
- Level III
- Direct member, own switch, or SWIFT
- Level IV
- Switch + SWIFT, or hosts its own DC
NBFCs
By layer — and most of it may not be yours
- Middle, Upper and Top Layer2 chapters attach
- Base Layer, ₹500 crore and above2 chapters attach
- Base Layer, under ₹500 crore (and all CICs)2 chapters attach
Base Layer under ₹500 crore? No periodic vulnerability assessment or penetration testing — those appear only in Chapter V (paragraph 121). No six-hour DAKSH incident reporting deadline — that appears in Chapters IV and V. No security operations centre — that appears only in Chapter V.
One incident. Two filings. Six hours.
The RBI wants it on DAKSH within six hours of detection. CERT-In has wanted the same incident within six hours since 2022, under a different instrument, to a different recipient. Filing one does not discharge the other.
Directions under section 70B(6) of the Information Technology Act, 2000, dated 28 April 2022
Detected
both due at 6h
What each level adds
11 obligations, derived from the chapter sub-sections of the UCB Direction. 3 cannot be bought: penetration testing is a service, the IS Audit function is a team, and the contract flow-down is a negotiation with providers you already have.
- Information asset inventory
- Anti-virus and endpoint protection
- Change and patch management
- User access control and privileged access
- Data leak prevention
- Email security and anti-phishing
- Backup, restoration and continuity
- Audit logs and monitoring
- Vulnerability assessment and penetration testingNot a product
- Information Systems Audit functionNot a product
- Vendor and outsourcing risk, and the contract flow-downNot a product
Filled: binds at that level. Red: binds, but no software answers it. Mapped from the chapter sub-sections of the UCB Direction; the other licence classes apply as a whole or by layer.
The dates still ahead
In order — RBI, SEBI, IRDAI and the DPDP Act. Every date is read from the regulator's own text, including SEBI's final CSCRF deadline.
Already in force — 9 milestones since 28 Apr 2022
What we read, and what we have not done
Everything here was read from the regulator's own notification. That rule earns its keep: circulating summaries put the NBFC Base Layer threshold at ₹2,500 crore where the notification says ₹500 crore, and count six Directions where there are 7.
- 7/7Directions read in fullFrom the notification, not commentary
- 0Products assessedEdition I's scores measured a repealed framework and were deleted, not carried forward
- 9SEBI and IRDAI texts readCSCRF and every circular since, and IRDAI's 2026 Guidelines
- Free · no emailLevel checkAnswer a few questions, get your instrument, level, chapters and calendar. Shareable and printable.
- Every licence classExplorerPick a licence and the page re-renders: chapters, recurring obligations, contract clauses, governance.
- ReferenceGlossaryThe terms in the Directions and in procurement conversations, defined plainly.
BFSI cybersecurity, answered
Short answers, read from the notifications.
What changed for Indian financial institutions on 31 July 2026?
The Reserve Bank repealed 628 supervisory circulars — consolidated or obsolete — and issued 64 consolidated Directions. Seven of the 64 cover cybersecurity, each for one licence class; Local Area Banks, Regional Rural Banks, rural co-operative banks and asset reconstruction companies have none in this set. All took effect immediately: the Directions contain no transition period, phase-in or glide path.
How many cybersecurity Directions did the RBI issue?
7, each for one licence class, all in force on issuance. Secondary summaries often count six, omitting the All India Financial Institutions Direction. Local Area Banks, Regional Rural Banks, rural co-operative banks and asset reconstruction companies have none in this set.
How is a co-operative bank's level decided?
By its digital depth and how it connects to the payment systems — not by asset size. A small bank that is a sub-member of the centralised payment systems and offers internet or mobile banking, or is a direct member of CTS, IMPS or UPI, sits at Level II or above.
Do small NBFCs need a security operations centre?
No. Three paragraphs, roughly two hundred words. Chapter III asks a small Base Layer NBFC to digitise and secure its primary business databases, to adopt a board-approved IT and information security policy covering nine basic standards, and to scale its systems up as the business grows. No periodic vulnerability assessment or penetration testing — those appear only in Chapter V (paragraph 121). No six-hour DAKSH incident reporting deadline — that appears in Chapters IV and V. No security operations centre — that appears only in Chapter V.
Does reporting an incident to the RBI on DAKSH also satisfy CERT-In?
No. The RBI wants the incident on DAKSH within six hours of detection. CERT-In wants it within six hours too, under Directions under section 70B(6) of the Information Technology Act, 2000, dated 28 April 2022. Runs in parallel with the RBI's DAKSH clock. Same incident, same six hours, different recipient, different instrument. Filing on DAKSH does not discharge this.
If our IT vendor detects the incident first, when does our six-hour RBI clock start?
At the vendor's detection. The RBI's Managing Risks in Outsourcing Directions 2025 (paragraph 56 of the commercial-bank version) require the service provider to report to the bank without undue delay, so that the bank can report to the RBI within six hours of detection by the service provider.
When is the SEBI CSCRF compliance deadline?
Every CSCRF implementation deadline has passed. MIIs and QRTAs had to comply from 1 January 2025 (with forbearance to 31 March 2025) and KRAs from 1 April 2025; every other regulated entity by 31 August 2025, after two extensions (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/96). What recurs now is the cyber audit: from FY 2025-26 it follows CSCRF and runs on the financial year, starting after the period ends, with the report due within one month of completing the audit and findings closed within three months of submitting it.
Which IRDAI cybersecurity guidelines apply now?
The IRDAI Information and Cyber Security Guidelines, 2026 (IRDAI/GA&HR/CIR/MISC/51/4/2026), issued on 6 April 2026, revising the 2023 edition and applying from the current financial year. Insurers and intermediaries are graded into three categories by gross insurance revenue. Incidents go to CERT-In within six hours with a copy to IRDAI; internet-facing systems get VA and PT every six months from a CERT-In empanelled auditor; and insurers file an annual assurance audit with IRDAI.
Where software is the answer, and where it is not
8 of the 11 controls we have mapped are answered by software. We resell those, price them in INR with GST, and implement them. The other 3 are a service, a team and a contract negotiation — and we say so rather than selling you something that does not answer the question.
Reference numbers and chapter contents read from the RBI notifications on 2026-10-05. General information, not legal advice — confirm applicability and current status with your compliance function and counsel. Regional Rural Banks have no instrument under this title; the Outsourcing Directions 2025 and the Digital Payment Security Controls Directions 2026 are separate and were not absorbed.