Financial servicesIndia

RBI CTRRAF 2026 - Credit Information Companies

Make credit-information security work traceable

Connect technology safeguards, risk decisions and audit evidence across your credit information organisation.

Full title
Reserve Bank of India (Credit Information Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026
Issued by
Reserve Bank of India, Department of Supervision
Issued and in force
31 July 2026, with immediate effect
Applies to
Credit information companies as defined in Section 2(e) of the Credit Information Companies (Regulation) Act, 2005
Nature
Binding regulatory Directions issued under CICRA, reviewed through RBI supervision and the company’s own information systems audit
Structure
Eight chapters and 227 paragraphs, including 31 baseline cybersecurity and resilience requirement areas

Overview

What the Directions require

The Directions set out how a credit information company must govern technology, manage IT and cyber risk, protect its systems, respond to incidents and prove that its controls work. They were issued by the Reserve Bank of India’s Department of Supervision on 31 July 2026 under the Credit Information Companies (Regulation) Act, 2005, took effect immediately and replace the earlier cybersecurity framework and IT governance instructions that applied to credit information companies, with a saving clause for actions already taken under them.

Credit information companies hold and exchange sensitive credit data with lenders, and the Directions treat them much as they treat banks. The structure follows the commercial bank Directions closely: Board accountability, IT governance, risk management, 31 baseline control areas, a Cyber Security Operations Centre and information systems audit. Unlike the UCB and NBFC Directions, there is no tiering: every credit information company follows the whole text.

Accountability sits at the top. The Board approves the IT, information asset, business continuity, information security and cybersecurity strategies and policies and reviews them at least annually. A Board-level IT Strategy Committee, an IT Steering Committee, an Information Security Committee and an independent CISO each have defined roles, meeting frequencies and reporting lines.

The hard part is not interpreting the text. It is running it: giving every requirement an owner, keeping evidence current between inspections, closing findings on time and showing the Board where the company stands.

Who it applies to

The Directions apply to every credit information company, meaning a company defined as such in Section 2(e) of the Credit Information Companies (Regulation) Act, 2005. In practice this means:

  • Companies that hold a certificate of registration from RBI to carry on the business of credit information
  • The whole text applies to each company, with no graded levels or layers
  • Several obligations are written as optional (“may”), such as red teaming and continuous auditing, and many controls are scaled to risk and materiality
  • Third-party arrangements that fall outside the Managing Risks in Outsourcing Directions, 2025 are covered by the third-party provisions of these Directions
  • The text has no comply-or-explain route and no provisions on ATM switch providers, unlike the commercial bank Directions

Credit information companies are not Core Investment Companies, which fall under the NBFC Directions. Other entities have their own Directions: Commercial Banks, Small Finance Banks, Payments Banks, Urban Co-operative Banks and All India Financial Institutions. Incident notification to CERT-IN also applies; see CERT-IN Guidelines.

Structure

How the Directions are organised

Eight chapters, from the role of the Board to information systems audit. Chapter V holds the 31 baseline areas, lettered A to EE, grouped here by theme.

Chapter I

Preliminary

Short title and commencement, applicability, and definitions, most adapted from the FSB Cyber Lexicon.

Chapter II

Role of the Board

The Board owns technology and cyber risk.

Board-approved policies
The Board approves the IT, information asset, business continuity, information security and cybersecurity strategies and policies, including incident response, recovery and cyber crisis management, and reviews them at least annually.
Board-level committees
A Board-level IT Strategy Committee is required, and the Audit Committee of the Board oversees information systems audit.
Chapter III

IT governance and oversight

Who does what, how often they meet and to whom they report.

IT governance framework
A framework that sets out how technology is governed, from strategy to delivery.
Information security and cybersecurity policies
An information security policy and a separate cybersecurity policy.
IT Strategy Committee
At least three directors, chaired by an independent director with substantial IT expertise of at least seven years. Meets at least quarterly and reviews business continuity and disaster recovery at least annually.
Senior management and IT Steering Committee
Senior management from IT and business. Meets at least quarterly, oversees BCP/DR and updates the ITSC and MD/CEO periodically.
Information Security Committee
Works under the oversight of the ITSC, is headed by an official from the risk management vertical and includes the CISO and business and IT representatives.
Head of IT function
A senior, technically competent official who acts as the first line of defence for IT controls and IT risk.
Chief Information Security Officer
Preferably at General Manager level, with a reasonable minimum term. Must not report directly to the Head of IT and must not carry business targets. Reports to the Executive Director overseeing risk management and reviews cyber risk before the Board, its Risk Management Committee or the ITSC at least quarterly.
IT project management, architecture and services
Governance of technology projects, an IT architecture reviewed by the ITSC at least annually, and IT service management.
Chapter IV

IT and information security risk management

Periodic review of IT risks
The Risk Management Committee, with the ITSC, reviews the IT-related risk policy at least annually.
Risk management framework
A framework for identifying, assessing and treating IT and information security risk, with security infrastructure and policies reviewed at least annually.
Identification, assessment and documentation
Inherent risk rated low, moderate, high or very high, or on a similar scale.
Chapter V

Baseline controls: assets, data and infrastructure

31 baseline areas, lettered A to EE.

Inventory management
An up-to-date inventory of information assets showing business criticality. The company may set its own criteria for identifying critical assets.
Data leak prevention and data migration
Controls to prevent data leakage and to govern migration between systems.
Preventing unauthorised software
Controls that stop unauthorised software running on company systems.
Physical, environmental and capacity controls
Protection of facilities and equipment, and capacity management.
Secure configuration and network security
Systems configured securely and networks managed and protected.
Application security life cycle
Security built into how applications are designed, built, tested and run.
Audit logs
Logging and review of activity on systems.
Patch, vulnerability and change management
Patches applied and vulnerabilities and changes managed in a controlled way.
Removable media, cryptography and straight through processing
Controls over removable media, use of cryptography, and automated processing without manual intervention.
Chapter V

Baseline controls: access, detection and testing

User access control and teleworking
Access granted and managed by need, including privileged access, and secure remote working.
Customer authentication
An authentication framework for customers using the company’s channels.
Secure mail and anti-phishing
Protection of mail and messaging systems and measures against phishing.
Continuous surveillance and advanced threat defence
Continuous monitoring and defences against advanced threats.
Vulnerability assessment and penetration testing
For critical systems and DMZ systems with customer interfaces, VA at least every six months and PT at least every 12 months, with risk-based testing for other systems. Closure status reported to the ITSC and Information Security Committee at least quarterly.
Red teaming
The company may run red team exercises. These are optional.
Risk-based transaction monitoring and forensics
Monitoring across channels according to risk, and network forensics and DDoS mitigation support on standby.
Chapter V

Baseline controls: resilience, response, third parties and people

Third-party arrangements
Risk assessment proportionate to risk and materiality, covering concentration risk, conflicts of interest, single points of failure and supply chain risk. Contracts give the company audit rights and RBI inspection rights, including access to resources off company premises. Data location rules, background checks and NDAs apply.
Business continuity and disaster recovery
DR drills for critical systems at least half-yearly, running the DR site as primary for at least a full working day. A minimal RTO approved by the ITSC and near-zero RPO for critical systems.
Cyber incident response and recovery
Incidents reported to RBI on the DAKSH platform within six hours of detection, with CERT-IN notified proactively. A Cyber Crisis Management Plan forms part of the Board-approved cybersecurity framework.
Metrics
Key performance and risk indicators, and recovery metrics including RTO and RPO for critical systems.
Awareness and customer education
Mandatory training for new recruits, annual training for lower and middle management and for the Board and senior management, and education of customers on phishing and on not sharing credentials, OTPs and PINs.
Chapter VI

Cyber Security Operations Centre

Governance
A CSOC framework suited to the company’s risk profile, with threat briefings and dashboards for the Board and ITSC.
Capabilities
SIEM-based log correlation, root-cause analysis, collection of indicators of compromise, malware analysis and high availability.
Staff
Three levels: round-the-clock monitoring, specialists for root-cause analysis, and advanced analysts for deep analysis and forensics.
Chapter VII

Information systems audit

Oversight and policy
The Audit Committee of the Board oversees IS audit, and approves the IS Audit Policy and reviews it at least annually.
Function and planning
A separate IS audit function or skilled resources within internal audit, risk-based audit planning, and the option of continuous auditing for critical systems.
Chapter VIII

Repeal and other provisions

Earlier instructions on the cybersecurity framework and IT governance for credit information companies are repealed, with a saving clause. Other laws continue to apply, and RBI’s interpretations are final.

Implementation roadmap

How to implement it, step by step

A practical sequence for a credit information company putting the Directions into operation and keeping them there.

  1. 1

    Confirm scope and critical systems

    List information systems, including member data intake, bureau databases and customer-facing services, and decide through risk assessment which are critical, because several requirements apply specifically to critical systems.

    OutputsScope noteCritical systems list
  2. 2

    Put governance in place

    Have the Board approve the IT, information security, cybersecurity and business continuity policies. Constitute or re-check the IT Strategy Committee, IT Steering Committee and Information Security Committee, and confirm the CISO’s level, independence and reporting line.

    OutputsApproved policiesCommittee chartersGovernance calendar
  3. 3

    Assess gaps requirement by requirement

    Map current practice against each chapter and each of the 31 baseline areas. Record every gap with an owner, a target date and a risk rating.

    OutputsGap registerOwners and dates
  4. 4

    Remediate the baseline controls

    Close gaps in order of risk, starting with critical systems and data leak prevention. Build in six-monthly VA, annual PT, half-yearly DR drills and periodic access and log reviews.

    OutputsRemediation planTesting schedule
  5. 5

    Build detection and response

    Set up or contract the CSOC, approve the incident response policy and Cyber Crisis Management Plan, and rehearse the six-hour report to RBI on DAKSH and the notification to CERT-IN.

    OutputsCSOC modelIncident response policyCCMP
  6. 6

    Bring third parties into scope

    Risk-assess IT and cybersecurity vendors in proportion to materiality, and update contracts with audit rights, RBI inspection rights, data location terms and personnel checks.

    OutputsVendor risk assessmentsUpdated contracts
  7. 7

    Establish assurance and reporting

    Approve the IS Audit Policy and a risk-based audit plan. Set up quarterly CISO reporting, quarterly VA/PT closure reporting and the agreed metrics.

    OutputsIS Audit PolicyAudit planBoard and committee packs
  8. 8

    Keep it running and inspection-ready

    Run the annual reviews and training, track amendments to the Directions, and keep evidence current so that a supervisory review finds a record of continuous work.

    OutputsEvidence libraryAnnual review records

Audit and evidence guide

What auditors look for, and the evidence to keep

Compliance is reviewed through RBI’s supervision of the company and through its own information systems audit, which the Audit Committee of the Board oversees. Reviewers look for proof that each requirement operates, at the frequency the Directions set.

What reviewers look for

  • Board and committee minutes showing approvals and reviews at the required frequency
  • IT Strategy Committee composition, including an independent chair with the required IT experience
  • The CISO’s level, independence from the Head of IT and reporting line to the Executive Director overseeing risk
  • How critical systems were identified and how the stricter requirements were applied to them
  • Data leak prevention and access controls around credit information
  • VA/PT reports and quarterly closure reporting to the ITSC and Information Security Committee
  • DR drill records, including running the DR site as primary for a full working day
  • Incident records showing detection time and reporting on DAKSH within six hours, and to CERT-IN
  • Third-party contracts with audit and inspection rights and data location terms
  • CSOC operation and the IS Audit Policy, plan and follow-up of findings

Recurring obligations and timelines

Board review of IT, security, cyber and BCP policiesAt least annually
IT Strategy Committee meetingsAt least quarterly
IT Steering Committee meetingsAt least quarterly
CISO review of cyber risk before Board, RMCB or ITSCAt least quarterly
VA of critical and customer-facing DMZ systemsAt least every 6 months
PT of the same systemsAt least every 12 months
VA/PT closure status to ITSC and ISCAt least quarterly
DR drills for critical systemsAt least half-yearly
IT architecture review by the ITSCAt least annually
Review of IT risk policy by RMCB with ITSCAt least annually
IS Audit Policy review by the Audit CommitteeAt least annually
Training for Board and senior managementAnnually
Cyber incident reporting to RBI on DAKSHWithin 6 hours of detection

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Governance

  • Board and committee minutes
  • Approved policies with version history
  • ITSC constitution
  • CISO appointment and reporting line

Risk management

  • IT and information security risk register
  • Critical systems list and rationale
  • Annual risk policy review

Baseline controls

  • Asset inventory with criticality
  • Data leak prevention records
  • Patch and change records
  • Access and privileged access reviews

Testing

  • VA and PT reports
  • Findings closure tracker
  • Red team reports, where run
  • DR drill reports

Incident response

  • Incident register with detection times
  • DAKSH and CERT-IN submissions
  • Cyber Crisis Management Plan
  • Post-incident reviews

Third parties

  • Vendor risk assessments
  • Contracts with audit and inspection clauses
  • Background check and NDA confirmations

Operations centre

  • Monitoring and escalation records
  • Staffing roster across levels
  • Threat briefings to the Board or ITSC

IS audit

  • IS Audit Policy and approvals
  • Risk-based audit plan
  • Audit reports and action tracking

Areas that often need attention

  • Policies approved once but not reviewed on schedule
  • CISO reporting lines that conflict with the independence requirements
  • Critical systems not formally identified, so the stricter requirements cannot be shown
  • VA/PT findings open with no quarterly closure reporting
  • DR drills that never run the DR site as primary for a full day
  • Incident detection times not recorded, so six-hour reporting cannot be shown
  • Third-party contracts without audit or inspection rights
  • Evidence scattered across email and shared drives at inspection time

How Netra helps

Where each part of the work lives in Netra

Netra loads the Credit Information Companies Direction as requirements, tasks and policies. Each part of the work then lives in the module built for it, on one record.

Every requirement owned and tracked

Task Engine

Requirements arrive as tasks with owners and due dates. Recurring tasks cover quarterly, half-yearly and annual obligations so that evidence stays current.

Live status for each chapter and requirement

Compliance Centre

Status is derived from completed tasks and evidence, never typed in, so every figure traces back to the work.

Board-approved policies and annual reviews

Policy Hub

A policy library generated at onboarding, with review dates and a policy score that rises as the work behind each policy is done.

IT and information security risk register

Risk Manager

Inherent and residual heatmaps, with risks reduced as the linked tasks are completed.

Third-party arrangements

Third-Party Risk

Find vendors from what Accounts and Purchase pay, assess them through a vendor portal and record each decision with a rating.

IS audit and supervisory reviews

Audit Centre

Run internal and regulatory audits end to end, with findings and corrective actions, using evidence held in a tamper-evident vault.

Reporting to the Board and committees

Dashboard & Reports

A live Posture Score and a one-click board report for the Direction.

Knowing which systems a requirement touches

Asset Management

Assets linked to tasks, so teams know where to act and which evidence applies.

Netra organises the work, evidence and reviews. It does not process credit information, is not a SIEM, an operations centre or a reporting channel to RBI or CERT-IN, and does not by itself establish compliance. The company remains responsible for implementation and regulatory interpretation.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Financial services

RBI CTRRAF 2026 - Non-Banking Financial Companies

Build an NBFC compliance programme around your actual scope

Financial services

RBI CTRRAF 2026 - Commercial Banks

Connect bank-wide cyber governance with reviewable evidence

Privacy

GDPR

Make privacy accountability easier to demonstrate

See RBI CTRRAF 2026 - Credit Information Companies in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.