Inspection-ready security,
for banks and co-operative banks

The RBI Cybersecurity Directions, 2026 are in force. Netra turns the Direction for your entity class into owned tasks with evidence, so inspection and IS audit start from the record.

All solutions
7 variants
RBI Direction variants in the library, from Urban Co-operative Banks to NBFCs
Control by control
Each requirement an owned task with evidence
Audit-ready
IS audit and inspection evidence kept in a tamper-evident vault
Board-ready
One-click reports from live work

What you are asked for

What inspectors, auditors and your board ask for

The questions are consistent. The effort lies in answering them from many places, under time pressure.

Control by control status

Which requirements are in place, who owns each one and what proves it.

Evidence for IS audit

Policies, logs, reviews and approvals, produced for the period under audit.

Vendor and partner assurance

Which third parties touch your systems, how they were assessed and who accepted the risk.

Audit observations closed

Proof that last year's observations were corrected, not just replied to.

Incident readiness

Policies and owners for incident response and CERT-IN reporting obligations.

Board and IT Strategy Committee reporting

A clear position on exposure and improvement, without a month of compilation.

The difference

From an annual scramble to a standing record

The Direction does not change how often evidence is needed. Netra changes where it comes from.

The usual way

  • Requirements tracked across spreadsheets and email
  • Evidence collected from departments when the auditor asks
  • Observations closed with a reply, status held in a folder
  • Vendor lists maintained separately from what Accounts pays
  • Board report assembled by hand

In Netra

  • The Direction for your entity class loaded as owned tasks
  • Evidence attached to the task as the work is done
  • Findings, management responses and corrective actions in one place
  • Vendor register checked against actual payments, with decisions on record
  • Posture and reports generated from the work

From the Direction to the evidence

You start by assigning owners, not by interpreting a document.

  1. 1

    Direction loaded

    The variant for your entity class, with its requirements as controls.

  2. 2

    Owners assigned

    Each control becomes a task with an owner, a plan and a due date.

  3. 3

    Evidence attached

    Work is done and evidenced once, in the storage you choose.

  4. 4

    Status derived

    Compliance status follows from completed work, not manual entry.

  5. 5

    Audit from the record

    Internal, IS and regulatory audits start from evidence already held.

Quiet audits. Loud confidence.

Evidence from daily work flows into the audit, so inspection and IS audit begin with answers rather than a request list.

See the Audit Centre

Frameworks

The frameworks this sector works to

The RBI Directions are loaded by entity class. Global standards sit alongside them, and work done for one counts towards the others where the controls overlap.

RBI CTRRAF 2026: Urban Co-operative Banks

The Direction for Urban Co-operative Banks, control by control.

RBI CTRRAF 2026: Small Finance Banks

The Direction for Small Finance Banks.

RBI CTRRAF 2026: Payments Banks

The Direction for Payments Banks.

RBI CTRRAF 2026: Commercial Banks

The Direction for Commercial Banks.

CERT-IN Guidelines

Obligations for Indian organisations, held as owned tasks.

ISO 27001:2022

Security controls and requirements, with cross-framework credit.

PCI DSS v4.0.1

For cardholder data environments, where applicable.

Who uses it

One system, the people who answer for it

CISO and Head of Security

A live view of which controls are done, what is overdue and what the auditor will see.

Head of IT and CIO

Tasks assigned to the people who do the work, with evidence held where they already store it.

Compliance and Internal Audit

Audits planned, run and closed in one place, with findings traced to corrective action.

Chief Risk Officer

A risk register that moves as treatment tasks are completed.

Board and IT Strategy Committee

A short report and a posture score, with decisions on record.

Procurement and Legal

Vendor due diligence and decisions kept with the vendor record.

In the platform

The modules behind this page

Every module works on the same record, so a task done once is counted wherever it applies.

Compliance Centre

Status for every framework, derived from the work.

Task Engine

Every requirement as an owned task with evidence.

Audit Centre

Internal, external, certification and regulatory audits end to end.

Third-Party Risk

Vendors discovered, assessed and reported to the board.

Dashboard and Reports

A live posture score and one-click board reports.

Risk Manager

A register where residual risk falls as work is done.

The detail: reporting, third parties and what to prepare

Questions we are asked

Which RBI Directions does Netra hold?

Netra holds the RBI CTRRAF 2026 Directions for Commercial Banks, Small Finance Banks, Payments Banks, Urban Co-operative Banks, All India Financial Institutions, Credit Information Companies and NBFCs. You enable the one that applies to your entity.

Do we have to interpret the Direction ourselves?

No. The requirements are loaded as controls. You start by assigning owners and plans, then attach evidence as the work is done.

Can the same evidence count towards ISO 27001 or PCI DSS?

Yes, where the controls overlap. Work and evidence done for one framework are credited to the others the same control serves.

Can we keep evidence in our own storage?

Yes. Evidence can be held in storage you control, such as your own cloud storage, instead of Netra's default.

Does Netra replace our auditors?

No. It gives internal and external auditors a place to plan, request, review and report. Auditors keep their independence, and evidence they accept is fingerprinted.

Can a partner run this for us?

Yes. An MSSP, vCISO practice or audit firm can deliver Netra to you as a managed service. Many organisations use both models.

See the Direction for your entity class in Netra

We will set up the demo around your entity class and your open audit observations.