RBI’s 2026 cybersecurity Directions for All India Financial Institutions: what the Board, the CISO and auditors need to show
The 2026 Directions name five All India Financial Institutions and set out governance, baseline controls, a SOC and IS audit. Here is what they ask.
Key takeaways
- Five institutions are named in paragraph 3: EXIM Bank, NABARD, SIDBI, NHB and NaBFID. The Directions have applied since 31 July 2026.
- The Board approves the strategies and policies and reviews them at least annually. The CISO reports on cyber risk at least quarterly.
- Incidents go to the RBI on DAKSH within six hours of detection, so the detection time has to be recorded.
- The text applies to all five collectively. Each institution still has to decide what counts as a critical system in its own business.
On 31 July 2026 the Reserve Bank of India’s Department of Supervision issued the All India Financial Institutions (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026. Paragraph 3 applies them to five named institutions: Export-Import Bank of India (EXIM Bank), National Bank for Agriculture and Rural Development (NABARD), Small Industries Development Bank of India (SIDBI), National Housing Bank (NHB) and National Bank for Financing Infrastructure and Development (NaBFID). They came into force with immediate effect, and they repeal the earlier cybersecurity framework and IT governance instructions for All India Financial Institutions (AIFIs).
The text has eight chapters: the Board, IT governance, risk management, baseline controls, the Cyber Security Operations Centre, Information Systems audit, and repeal and saving provisions. Chapter V holds 31 baseline areas. The Directions contain no provision for any single AIFI, so each institution reads the same text against its own mandate and systems.
Who do the Directions apply to?
The five institutions named in paragraph 3, collectively as AIFIs. Other regulated entities have Directions of their own, including commercial banks and NBFCs.
The section on third-party arrangements applies only to technology and cybersecurity arrangements outside the Managing Risks in Outsourcing Directions, 2025. Sort each service provider into one regime or the other before you assess it.
What does the Board have to do?
The Board approves the strategies and policies for IT, information assets, business continuity, information security and cybersecurity, including incident response and cyber crisis management, and takes them up for review at least annually (paragraphs 6 and 7). The AIFI sets up a Board-level IT Strategy Committee, and the Audit Committee of the Board oversees IS audit.
The structure below is where reviewers start:
- An IT Strategy Committee of at least three directors, chaired by an independent director with substantial IT expertise, meaning at least seven years of experience managing information systems or leading technology or cybersecurity initiatives. It meets at least quarterly.
- An IT Steering Committee with senior management from IT and business, meeting at least quarterly and updating the IT Strategy Committee and the MD/CEO.
- An Information Security Committee under the IT Strategy Committee, headed from the risk management vertical, with the CISO among its members.
- A Chief Information Security Officer, preferably a General Manager or equivalent, with no direct reporting relationship with the Head of IT Function and no business targets, appointed for a reasonable minimum term, reporting to the Executive Director or equivalent overseeing risk management, and a permanent invitee to the IT Strategy Committee and the IT Steering Committee.
The CISO places a review of cyber risks, arrangements and preparedness before the Board, the Risk Management Committee of the Board or the IT Strategy Committee at least quarterly.
Requirement by requirement: what a reviewer will ask for
| Requirement | What is asked | Evidence a reviewer will want |
|---|---|---|
| Board policies (paras 6 to 7) | Strategies and policies approved by the Board and reviewed at least annually | Board minutes, dated policy versions |
| IT Strategy Committee (paras 16 to 18) | At least three directors, independent chair with seven years of relevant experience, quarterly meetings, BCP and DR reviewed at least annually | Charter, chair’s profile, minutes, annual BCP and DR review |
| CISO (paras 26 to 27) | Separate from the Head of IT, no business targets, quarterly risk review | Reporting chart, appointment record, quarterly review papers |
| Risk and security policy review (paras 38, 42) | Risk policy including IT and cyber risk, and security policies, reviewed at least annually | Review records with the approving body |
| Vulnerability assessment and penetration test (paras 146, 156) | Critical and customer-facing DMZ systems: assessment at least every six months, test at least every twelve; closure status to the IT Strategy Committee and Information Security Committee at least quarterly | Scope, reports, closure tracker, committee papers |
| Disaster recovery (paras 160 to 168) | Drills for critical systems at least half-yearly, DR site as primary for a full working day, RTO approved by the IT Strategy Committee, near-zero RPO, matching DC and DR configuration | Drill results, issue log, retest evidence, configuration comparison |
| Incident reporting (para 177) | RBI on DAKSH within six hours of detection; proactive notice to CERT-In | Incident record with detection time, report time and decision-maker |
| IS audit (paras 219 to 222) | Audit Committee approves the IS Audit Policy and reviews it at least annually; risk-based plan | Approved policy, plan, reports, follow-up |
Baseline controls worth separating out
- Privileged access: multi-factor authentication is mandatory for privileged users of critical systems and critical activities, based on risk assessment (paragraph 109). Administrative rights on end-user workstations, PCs and laptops must be disallowed (paragraph 107).
- Patching: patches are applied expeditiously, and vulnerabilities fixed in a time-bound manner. The text states no number of days, so the institution sets and defends its own.
- Logs: settings are validated periodically and audit trails monitored regularly. These Directions state no retention period.
- Third parties: contracts give the AIFI audit rights and the RBI inspection rights (paragraph 131), the RBI has access to information resources consumed by the AIFI (paragraph 132), and location and cross-border data rules must be followed.
- Disaster recovery sites: the data centre and the DR site are geographically separated (paragraph 61).
- Information sharing: participation in the IDRBT CISO forum and sharing with IB-CART is permitted. The text says "may", so it is optional.
- Awareness: mandatory for new recruits, annual for lower and middle management, and annual IT and cyber risk training for the Board and senior management.
For the vendor side, see the third-party risk management checklist.
Watch for. The six hours in paragraph 177 run from detection. Keep the detection time in the incident record, and keep the CERT-In notification in the same record. CERT-In’s own Directions are covered in our six-hour reporting guide.
Security operations and IS audit
Chapter VI asks for a Cyber Security Operations Centre framework scaled to the institution’s technology risk profile, scale and complexity, with the Board or IT Strategy Committee briefed on threat intelligence and given dashboards. Staffing is described in three levels, from round-the-clock monitoring to advanced analysis of packets, indicators of compromise, forensic evidence and malware, with the institution working out the staffing it needs for continuous 24x7 monitoring, in-house or through a managed-service model.
Chapter VII sits with the Audit Committee of the Board: it approves the IS Audit Policy, reviews it at least annually, and reviews critical IT, information security and cybersecurity issues. Continuous auditing for critical systems is an option the institution may consider.
A readiness checklist
Where the work usually gets stuck
- 1Policies approved once and then left until the next inspection
- 2Assessment findings with no tracked closure
- 3Drills that stop short of running the DR site as primary for a full working day
- 4Incident records with no detection time
- 5Committee papers and evidence scattered across email and shared drives
Tip. Put each recurring obligation on a calendar with a named owner. Quarterly reviews without an owner are the ones that slip.
How this is run as owned work in Netra
Treat each requirement as work with an owner and a due date, and let the evidence build up as the work is done. In Netra, the Direction is loaded as requirements, tasks and policies. Evidence is attached once and can serve every requirement it touches, status is derived from completed work and evidence rather than entered by hand, and recurring obligations such as quarterly committee reviews and half-yearly drills reopen on their own. The Audit Centre holds findings and follow-up alongside, so the audit does not start from a blank page. The fuller breakdown is on the RBI CTRRAF 2026 for AIFIs page, and the commercial bank equivalent is in our commercial banks article.
This article is a summary for general information. It is not legal advice. Institutions should confirm how the Directions apply to them with their compliance and legal teams.
Frequently asked questions
Which institutions do the RBI’s 2026 cybersecurity Directions for AIFIs cover?
Paragraph 3 names five: EXIM Bank, NABARD, SIDBI, NHB and NaBFID. The Directions were issued on 31 July 2026 under sections 45-L and 45-M of the Reserve Bank of India Act, 1934, and came into force with immediate effect.
What reporting line does the CISO have under these Directions?
The CISO has no direct reporting relationship with the Head of IT Function, carries no business targets, and reports to the Executive Director or equivalent overseeing risk management. The CISO reviews cyber risk before the Board, its Risk Management Committee or the IT Strategy Committee at least quarterly.
What is the incident reporting deadline?
Cyber incidents are reported to the RBI on the DAKSH platform within six hours of detection. The Directions also ask for proactive notification of CERT-In, with no separate timeline stated.
How often must disaster recovery drills run?
At least half-yearly for critical systems, running the DR site as primary for at least a full working day. Other systems follow the risk assessment.
Sources
The Direction for your entity, loaded as owned work
Requirements, tasks and policies with status derived from evidence.
See it in Netra
A demo on the frameworks that matter to you.
