RBI’s 2026 cybersecurity Directions for Credit Information Companies: what the Board, the CISO and auditors need to show

On 31 July 2026 the Reserve Bank of India’s Department of Supervision issued the Credit Information Companies (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026. They apply to Credit Information Companies as defined in clause (e) of Section 2 of the Credit Information Companies (Regulation) Act, 2005, came into force with immediate effect, and repeal the earlier cybersecurity framework and IT governance instructions for these companies.

The Directions run to eight chapters: the Board, IT governance, risk management, baseline controls, the Cyber Security Operations Centre, Information Systems audit, and repeal and saving provisions. Chapter V alone carries 31 baseline areas, from inventory of information assets to forensics. The text is written for regulated entities in general, so the work for a Credit Information Company is to decide what each requirement means for its own systems and to keep the proof.

Who do the Directions apply to?

Paragraph 3 applies them to Credit Information Companies, and nothing else. The text contains no separate chapter on credit information data, data submission by credit institutions or consumer consent. What it does say is that the company, as owner of customers’ personal and sensitive data, must protect its confidentiality, integrity and availability (paragraph 52).

One boundary matters in practice. The section on third-party arrangements applies only to technology and cybersecurity arrangements that are not already covered by the Managing Risks in Outsourcing Directions, 2025. Map each vendor to one regime or the other before assessing it.

What does the Board have to do?

The Board approves the strategies and policies for IT, information assets, business continuity, information security and cybersecurity, including incident response and cyber crisis management, and reviews them at least annually (paragraphs 6 and 7). The company must also set up a Board-level IT Strategy Committee, and the Audit Committee of the Board oversees IS audit.

The governance structure is specific:

• An IT Strategy Committee of at least three directors, chaired by an independent director with substantial IT expertise, defined as at least seven years of experience managing information systems or leading technology or cybersecurity initiatives. It meets at least quarterly.
• An IT Steering Committee with senior management from IT and business functions, also meeting at least quarterly.
• An Information Security Committee under the oversight of the IT Strategy Committee, headed by someone from the risk management vertical.
• A Chief Information Security Officer with no direct reporting line to the Head of IT Function and no business targets, reporting to the Executive Director or equivalent overseeing risk management, and placing a review of cybersecurity risks, arrangements and preparedness before the Board, the Risk Management Committee of the Board or the IT Strategy Committee at least quarterly.

Requirement by requirement: what a reviewer will ask for

Baseline controls worth separating out

Chapter V covers the day-to-day technical and operational controls. A few carry wording a reviewer can test:

• Privileged access: multi-factor authentication is mandatory for privileged users of critical systems and critical activities, based on risk assessment (paragraph 109). Administrative rights on end-user workstations, PCs and laptops must be disallowed (paragraph 107).
• Patching: patches are applied expeditiously, with an emergency route for critical, actively exploited vulnerabilities, and vulnerabilities are fixed in a time-bound manner. The text gives no number of days, so the company has to set and defend its own.
• Logs: logging settings are validated periodically and audit trails monitored regularly. No retention period is stated in these Directions, so the retention rule that applies to you comes from elsewhere. For CERT-In’s separate log duty, see our CERT-In guide.
• Third parties: contracts give the company audit rights and give the RBI inspection rights (paragraph 131), and background checks and non-disclosure agreements apply to third-party personnel with critical access.
• Red teaming: the text says the company may conduct red teaming exercises. It is not a fixed requirement, and no frequency is given.
• Awareness: cybersecurity awareness is mandatory for new recruits, lower and middle management are trained annually, and the Board and senior management receive annual training on IT and cyber risks.

For the vendor side, see the third-party risk management checklist.

Security operations and IS audit

Chapter VI asks for a Cyber Security Operations Centre framework scaled to the company’s technology risk profile, scale and complexity. Staffing is described in three levels: round-the-clock monitoring by trained staff, specialists who carry out root-cause analysis and corrective action, and advanced analysts for deep packet analysis, indicators of compromise, forensic evidence and malware analysis. The company works out the staffing it needs for continuous 24x7 monitoring, and the text accepts in-house or managed-service models.

Chapter VII places IS audit with the Audit Committee of the Board. The company needs an IS audit function, or resources with the right skills within Internal Audit, and may use external resources where skills are lacking, with accountability remaining inside Internal Audit. Continuous auditing of critical systems is something the company may consider, not a requirement.

A readiness checklist

Tick what you can already evidence.

Where the work usually gets stuck

1. 1Policies approved once and then not reviewed on schedule
2. 2Findings from assessments that stay open without tracked closure
3. 3Drills that test failover but never run the recovery site as primary for a full day
4. 4Incident records without a detection time
5. 5Committee papers and evidence spread across email and shared drives when the supervisory review starts

How this is run as owned work in Netra

Treat each requirement as work with an owner and a due date, and let the evidence build up as the work is done. In Netra, the Direction is loaded as requirements, tasks and policies. Evidence is attached once and can serve every requirement it touches, status is derived from completed work and evidence rather than entered by hand, and recurring obligations such as quarterly committee reviews and half-yearly drills reopen on their own. The Audit Centre keeps findings and follow-up in the same place, so the audit does not start from a blank page. You can read the fuller breakdown on the RBI CTRRAF 2026 for Credit Information Companies page, and the commercial bank equivalent in our commercial banks article.

This article is a summary for general information. It is not legal advice. Credit Information Companies should confirm how the Directions apply to them with their compliance and legal teams.