Financial servicesIndia

RBI CTRRAF 2026 - Small Finance Banks

Keep security assurance aligned with your SFB operations

Connect risk, policy and audit work across the teams supporting your small finance bank.

Full title
Reserve Bank of India (Small Finance Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026
Issued by
Reserve Bank of India, Department of Supervision
Issued and in force
31 July 2026, with immediate effect. Text updated as on 1 October 2026.
Applies to
Small Finance Banks. Commercial banks, Payments Banks and other regulated entities have their own Directions.
Nature
Binding regulatory Directions, reviewed through RBI supervision and the bank’s own information systems audit
Structure
Eight chapters, with 31 baseline cybersecurity and resilience requirement areas in Chapter V

Overview

What the Directions require

These Directions set out how a Small Finance Bank must govern its technology, manage IT and cyber risk, run baseline security and resilience controls, respond to incidents and obtain independent assurance. They were issued by the Reserve Bank of India’s Department of Supervision on 31 July 2026, took effect immediately, and replace the earlier directions on the cybersecurity framework and IT governance for Small Finance Banks, with a saving clause for anything already done under them.

The Small Finance Bank text follows the same eight-chapter design RBI used across its 2026 CTRRAF Directions, and its governance rules are as demanding as those for commercial banks: a Board-level IT Strategy Committee chaired by an independent director with IT expertise, a CISO at or near General Manager level reporting to the Executive Director in charge of risk, and fixed testing and drill frequencies for critical systems. There is no comply-or-explain route. Flexibility comes through risk-based treatment of non-critical systems and controls sized to the bank’s scale and threat environment.

The update as on 1 October 2026 substituted paragraph 7 following the Small Finance Banks Governance Amendment Directions, 2026. The Board approves the IT, information security, cybersecurity and business continuity strategies and policies; it may delegate their review to the IT Strategy Committee, but material amendments still need Board approval, and the review happens at least annually.

Many Small Finance Banks run lean technology and security teams across a wide branch and digital footprint. The practical challenge is keeping every quarterly, half-yearly and annual obligation running with an owner and current evidence, so that the Board, the committees and RBI’s supervisors see the same picture.

Who it applies to

Paragraph 3 makes the Directions applicable to Small Finance Banks. In practice that brings into scope:

  • The bank’s Board, IT Strategy Committee and Audit Committee of the Board
  • Senior management, the IT Steering Committee, the Information Security Committee, the Head of IT and the CISO
  • All information systems, with stricter requirements for systems the bank identifies as critical
  • IT and cybersecurity third-party arrangements that fall outside the Small Finance Banks Managing Risks in Outsourcing Directions, 2025
  • Any third-party ATM Switch Application Service Provider the bank uses, through contractual baseline controls

Other regulated entities have their own Directions. See Commercial Banks, Payments Banks, Urban Co-operative Banks, NBFCs, Credit Information Companies and All India Financial Institutions. CERT-IN obligations apply alongside: see CERT-IN guidelines.

Structure

How the Directions are organised

Eight chapters. Chapter V holds the 31 baseline requirement areas, lettered A to EE in the text and grouped here by theme.

Chapter I

Preliminary

Short title and commencement, applicability to Small Finance Banks, and 32 defined terms, most drawn from the FSB Cyber Lexicon.

Chapter II

Role of the Board

Board-approved policies
The Board approves strategies and policies for IT, information assets, business continuity, information security and cybersecurity, including incident response and cyber crisis management. Review is at least annual and may be delegated to the IT Strategy Committee, with material amendments returning to the Board.
Board-level committees
The bank sets up an IT Strategy Committee, and the Audit Committee of the Board oversees information systems audit.
Chapter III

IT governance and oversight

Structures, roles and reporting lines for technology and security.

IT governance framework
Covers strategic alignment, risk, resources, performance and business continuity, and defines structures, roles and oversight. Periodic IT risk assessment sits within the enterprise risk policy.
Information security and cybersecurity policies
An information security policy, and a separate Board-approved cybersecurity policy.
IT Strategy Committee
At least three directors. The chair is an independent director with substantial IT expertise, meaning at least seven years in managing information systems or leading technology or cybersecurity initiatives. Members must be technically competent. Meets at least quarterly.
IT Steering Committee
Senior management from IT and business functions. Meets at least quarterly and reports to the IT Strategy Committee and the MD and CEO.
Information Security Committee
Works under the IT Strategy Committee, which decides its membership. Includes the CISO and is headed by an official from the risk management vertical.
Head of IT function
A senior, technically competent official who acts as the first line of defence for IT controls.
Chief Information Security Officer
Preferably General Manager rank or equivalent, for a reasonable minimum term, with no direct reporting line to the Head of IT and no business targets. A permanent invitee to the IT Strategy and IT Steering Committees, reporting directly to the Executive Director overseeing risk, and reviewing cyber risk and preparedness before the Board, RMCB or ITSC at least quarterly.
Projects, architecture and services
Formal IT project management, an enterprise architecture reviewed by the IT Strategy Committee at least annually, service-level management and planned technology refresh away from unsupported systems.
Chapter IV

IT and information security risk management

Periodic review of IT risks
IT-related risks are reviewed periodically as part of the bank’s risk management.
Risk management framework
A framework for IT and information security risk. A separate cyber risk framework is permitted.
Identification, assessment and documentation
Risks are identified, assessed and recorded on a defined scale. The bank may use an alternative categorisation, and risk-cost trade-off decisions are documented.
Chapter V

Baseline controls: assets, configuration and data

Areas A to K, R and S of Chapter V.

Information asset inventory
A maintained inventory of information assets.
Data leak prevention and data migration
A data leak prevention strategy and controls over data migration.
Unauthorised software
Controls to stop unauthorised software from running.
Physical and environmental controls
Protection of facilities and equipment, with data centre and disaster recovery sites geographically well separated.
Capacity management
IT capacity requirements assessed annually or more often.
Secure configuration and network security
Hardened configurations and managed, protected networks.
Application security life cycle
Security across design, build, testing and operation of applications.
Audit logs
Maintenance, monitoring and analysis of audit logs.
Patch, vulnerability and change management
Controlled patching and change, with vulnerabilities tracked.
Cryptography and straight through processing
Cryptographic controls, and controls over automated transaction processing.
Chapter V

Baseline controls: access, channels and threats

Areas L to P and T to X, DD and EE of Chapter V.

User access and teleworking
Need-based user access, two-factor or multi-factor authentication based on risk, logging and monitoring of privileged access to critical systems, and controls for remote working.
Customer authentication
An authentication framework for customers across the bank’s channels.
Secure mail and removable media
Protection of mail and messaging systems, and controls on removable media.
Surveillance, threat defence and anti-phishing
Continuous surveillance, advanced real-time threat defence and anti-phishing measures.
Vulnerability assessment and penetration testing
Critical systems and customer-facing DMZ systems: vulnerability assessment at least every six months and penetration testing at least every 12 months. Other systems on a risk basis. Closure status goes to the IT Strategy Committee and Information Security Committee at least quarterly.
Red teaming
Optional. The bank may conduct red team exercises.
Transaction monitoring
Risk-based transaction monitoring across all delivery channels as part of fraud risk management, and alerts to customers through an alternate channel for payments above a limit the customer sets.
Forensics
Network forensics, forensic investigation and DDoS mitigation support arranged and kept on standby.
Chapter V

Baseline controls: third parties, resilience and people

Areas Q, Y, Z and AA to CC of Chapter V.

Third-party arrangements
Paragraphs 125 to 134 apply to IT and cybersecurity third-party arrangements not covered by the Small Finance Banks Managing Risks in Outsourcing Directions, 2025. They address risks such as concentration risk. Contracts give the bank a right to audit and RBI a right of inspection, RBI has access to the information resources the bank uses, the geographical location of infrastructure is addressed, and background checks and non-disclosure agreements are mandated.
ATM Switch Application Service Providers
A list of baseline controls the provider must implement, including PCI DSS and PCI SSF compliance where applicable to its IT ecosystem.
Business continuity and disaster recovery
Good practice such as ISO 22301. Drills for critical systems at least half-yearly, running the recovery site as primary for at least a full working day. Backups periodically restored to check usability. Minimal recovery time approved by the IT Strategy Committee and near-zero data loss for critical systems.
Cyber incident response and recovery
Response and recovery arrangements. Cyber incidents are reported to RBI on the DAKSH platform within six hours of detection, and CERT-IN is notified proactively.
Cyber Crisis Management Plan
Part of the Board-approved cybersecurity framework, covering detection, containment, response and recovery.
Metrics
Key performance and key risk indicators, and recovery metrics including recovery time and recovery point objectives for all critical systems.
Awareness and customer education
Annual training for the Board and senior management, annual training for lower and middle management, mandatory awareness for new recruits, and customer education on cyber risks.
Chapter VI

Cyber Security Operations Centre

Governance
A framework proportionate to the bank’s risk profile, with threat briefings and dashboards for the Board or IT Strategy Committee.
Capabilities
Proactive monitoring, SIEM-based correlation, malware analysis and honeypot services, among others.
Staff
Three levels: round-the-clock monitoring, specialist analysis and advanced analysis, with staffing for 24x7 operation. The bank may use in-house staff or a managed service.
Chapter VII

Information systems audit

IS Audit Policy
Approved by the Audit Committee of the Board and reviewed at least annually.
Function
A separate IS audit function, or suitably skilled resources within internal audit.
Continuous auditing
The bank may consider continuous auditing for critical systems, wherever possible.
Chapter VIII

Repeal and other provisions

Earlier directions on the cybersecurity framework and IT governance for Small Finance Banks are repealed through a circular of the same date, with a saving clause. Other laws continue to apply.

Implementation roadmap

How to implement it, step by step

A workable order for a Small Finance Bank moving onto the 2026 Directions.

  1. 1

    Map the old programme to the new text

    Most banks already ran controls under the earlier cybersecurity and IT governance directions. Map each existing control and policy to the new chapters and lettered areas, and list what is new or stricter.

    OutputsMapping to new paragraphsList of new obligations
  2. 2

    Settle governance and the policy review route

    Confirm the IT Strategy Committee’s composition and chair, the IT Steering and Information Security Committees, and the CISO’s rank, term and reporting line. Decide whether the Board will delegate policy review to the IT Strategy Committee and record how material amendments return to the Board.

    OutputsCommittee chartersBoard resolution on review
  3. 3

    Fix the critical systems list

    Identify critical systems through risk assessment, together with customer-facing DMZ systems, since these drive the testing, drill and recovery objectives.

    OutputsCritical systems registerRisk assessment record
  4. 4

    Sort third parties into the right regime

    Separate arrangements covered by the outsourcing directions from other IT and cybersecurity arrangements, apply the CTRRAF third-party clauses to the latter, and check any ATM switch provider against the baseline control list.

    OutputsClassified vendor listContract gap list
  5. 5

    Close baseline control gaps

    Work through the 31 areas by risk, starting with critical systems. Build the six-monthly VA, annual PT and half-yearly DR drills into the operating calendar.

    OutputsRemediation planTesting and drill calendar
  6. 6

    Prove detection and response

    Confirm the operations centre model and staffing levels, approve the Cyber Crisis Management Plan and rehearse the six-hour DAKSH report and the CERT-IN notification.

    OutputsCSOC operating modelCCMPReporting runbook
  7. 7

    Set up assurance and committee reporting

    Have the Audit Committee approve the IS Audit Policy and a risk-based plan. Put quarterly CISO and VA/PT closure reports on the committee calendar.

    OutputsIS Audit PolicyCommittee reporting pack
  8. 8

    Keep evidence current

    Run the annual reviews and training, watch for amendments such as the October 2026 update, and keep evidence for each requirement current between supervisory reviews.

    OutputsEvidence libraryAmendment log

Audit and evidence guide

What auditors look for, and the evidence to keep

Compliance is examined through RBI’s supervision of the bank and through the bank’s own IS audit under the Audit Committee of the Board. Both look for proof that each requirement works at the frequency the Directions set.

What reviewers look for

  • Committee composition, the IT Strategy Committee chair’s IT expertise and meeting records
  • Annual policy review records, and Board approval of any material amendment
  • The CISO’s rank, independence from the Head of IT and direct line to the Executive Director overseeing risk
  • Basis for classifying critical systems
  • VA and PT reports for critical and customer-facing DMZ systems, and quarterly closure reporting
  • DR drills that ran the recovery site as primary for a full working day
  • Incident logs showing detection time and DAKSH reporting within six hours
  • Which third-party arrangements were treated under the outsourcing directions and which under CTRRAF
  • ATM switch provider controls, where the bank uses one
  • IS Audit Policy approval, audit coverage and follow-up of findings

Recurring obligations and timelines

Review of IT, security, cyber and BCP policiesAt least annually
IT Strategy Committee meetingsAt least quarterly
IT Steering Committee meetingsAt least quarterly
CISO review before the Board, RMCB or ITSCAt least quarterly
VA of critical and customer-facing DMZ systemsAt least every 6 months
Penetration testing of the same systemsAt least every 12 months
VA/PT closure status to ITSC and ISCAt least quarterly
DR drills for critical systemsAt least half-yearly
IT architecture review by the ITSCAt least annually
Capacity assessmentAnnually or more often
IS Audit Policy reviewAt least annually
Board and senior management trainingAnnually
Cyber incident report to RBI on DAKSHWithin 6 hours of detection

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Governance

  • Board and committee minutes
  • Committee charters and membership
  • Delegation and policy review records
  • CISO appointment and reporting line

Risk

  • IT and information security risk register
  • Critical systems register
  • Risk-cost trade-off decisions

Baseline controls

  • Asset inventory
  • Configuration baselines
  • Patch and change records
  • Access reviews
  • Log review records

Testing and recovery

  • VA and PT reports
  • Closure tracker
  • DR drill reports
  • Backup restoration tests

Incidents

  • Incident register with detection times
  • DAKSH and CERT-IN submissions
  • Cyber Crisis Management Plan

Third parties

  • Vendor classification
  • Contracts with audit and inspection rights
  • ATM switch provider control evidence

IS audit

  • IS Audit Policy and approval
  • Audit plan and reports
  • Action tracking

Areas that often need attention

  • Committees constituted but not meeting quarterly
  • Policy review delegated without a record of how material amendments reach the Board
  • CISO combined with IT or carrying business targets
  • Critical systems never formally identified, so stricter requirements cannot be shown
  • DR drills that stop short of a full working day on the recovery site
  • Third parties not sorted between the outsourcing and CTRRAF regimes
  • No record of detection time for incidents
  • Evidence gathered only when an inspection is announced

How Netra helps

Where each part of the work lives in Netra

Netra loads the Small Finance Banks Direction as requirements, tasks and policies, so each obligation has an owner and each piece of evidence sits on one record.

Owners and dates for every paragraph

Task Engine

Requirements arrive as tasks with owners and due dates. Recurring tasks carry the quarterly, half-yearly and annual work.

Status by chapter and baseline area

Compliance Centre

Status is derived from completed tasks and evidence, never typed in. Work done for ISO 27001 or CERT-IN can count here too where it applies.

Board-approved policies and annual review

Policy Hub

A policy library generated at onboarding, with review dates and a policy score tied to the work behind each policy.

IT and information security risk register

Risk Manager

Inherent and residual heatmaps, with risks reduced as linked tasks are completed.

IT and cybersecurity third parties

Third-Party Risk

Vendors found from what Accounts and Purchase pay, assessed through a vendor portal, with each decision and rating recorded.

IS audit and supervisory reviews

Audit Centre

Internal and regulatory audits run end to end, with findings and corrective actions, using evidence held in a tamper-evident vault.

Critical systems in view

Asset Management

Assets linked to tasks, so the stricter requirements for critical systems are visible against the right systems.

Board and committee reporting

Dashboard & Reports

A live Posture Score and a one-click board report for the Direction.

Netra organises the work, evidence and reviews. It is not a SIEM, an operations centre or a channel for reporting incidents to RBI or CERT-IN, and it does not by itself establish compliance. The bank remains responsible for implementation and regulatory interpretation.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Financial services

RBI CTRRAF 2026 - Commercial Banks

Connect bank-wide cyber governance with reviewable evidence

Financial services

RBI CTRRAF 2026 - Payments Banks

Keep payments-bank resilience work connected

Security

CERT-IN Guidelines

Keep incident-readiness and record-keeping work organised

See RBI CTRRAF 2026 - Small Finance Banks in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.