Tool
Which chapter of the RBI cyber Directions applies to your NBFC?
RBI’s 2026 cybersecurity Directions for NBFCs give each company one obligation chapter, III, IV or V, set by its layer and asset size. Answer a few questions to see which is likely to apply.
Answer all the questions to see the result.
The three chapters
| Chapter | Applies with | Who it covers |
|---|---|---|
| Chapter III | Chapter II | Base Layer NBFCs with assets below ₹500 crore, and Core Investment Companies. Focus: basic IT systems, a Board-approved IT/IS policy, business continuity and tested backups. |
| Chapter IV | Chapter II | Base Layer NBFCs with assets of ₹500 crore and above. Focus: IT governance, information security, IS audit, business continuity and outsourcing. |
| Chapter V | Chapter II | Middle, Upper and Top Layer NBFCs, excluding Core Investment Companies. Focus: governance structures, a CISO, risk management, testing, disaster recovery drills and an IS audit policy. |
Source: RBI Non-Banking Financial Companies Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, RBI/DoS/2026-27/461, issued 31 July 2026. This tool is a reading aid and not a regulatory determination.
Run your chapter as owned work
Requirements, tasks and policies scoped to your chapter, with status derived from evidence.