India-specific depth,
alongside global frameworks

Netra holds the RBI CTRRAF 2026 Directions, NISPG 2019 v5.0 and the CERT-IN Guidelines next to ISO 27001, SOC 2, PCI DSS and others. It is built in India for regulated organisations.

Find your frameworks
India frameworks
The RBI variants, NISPG and CERT-IN
By entity class
The RBI Direction for your kind of entity
Global too
ISO, SOC, PCI and more share the work
Built for the regulated
By veterans and security industry experts

The regulatory picture

What Indian organisations answer to

Several authorities, each with its own expectations.

RBI-regulated entities

Banks, NBFCs, payments banks, credit information companies and AIFIs.

Government and PSUs

NISPG for classified information.

CERT-IN obligations

Applicable to many Indian organisations.

Customers abroad

ISO 27001 and SOC 2 asked by international buyers.

Personal data

Privacy expectations alongside security.

Audit and inspection

Evidence on request.

The difference

India-first, not India-only

One platform that handles local and global expectations together.

The usual way

  • Domestic and international frameworks tracked separately
  • Regulator documents interpreted by hand
  • Evidence reproduced per framework
  • Audit prepared from scratch

In Netra

  • Local and global frameworks on one record
  • Requirements loaded as controls with owners
  • Evidence counted across overlapping controls
  • Audit from the record

From regulation to evidence

The same path for every Indian framework.

  1. 1

    Select frameworks

    RBI, NISPG, CERT-IN and others.

  2. 2

    Assign owners

    Controls become tasks.

  3. 3

    Evidence the work

    Held in storage you choose.

  4. 4

    Derive status

    From completed work.

  5. 5

    Audit

    Internal, IS and regulatory.

Quiet audits. Loud confidence.

Inspection and audit begin with answers on file, so the conversation is about findings and not about gathering evidence.

See the Audit Centre

Outcomes

What changes

Regulatory work you can trace.

Clear obligations

Each requirement owned.

Less duplication

Evidence counted across frameworks.

Defensible reports

Traceable to the work.

Frameworks

India frameworks in the library

Each opens a page on what it covers.

RBI CTRRAF 2026: Urban Co-operative Banks

Direction for UCBs.

RBI CTRRAF 2026: NBFCs

Direction for NBFCs.

RBI CTRRAF 2026: Small Finance Banks

Direction for SFBs.

RBI CTRRAF 2026: Payments Banks

Direction for Payments Banks.

RBI CTRRAF 2026: Commercial Banks

Direction for Commercial Banks.

RBI CTRRAF 2026: Credit Information Companies

Direction for CICs.

RBI CTRRAF 2026: AIFIs

Direction for AIFIs.

NISPG 2019 v5.0

For government and PSUs.

CERT-IN Guidelines

Cyber security obligations.

MeitY CSA

Security audit checklist for government applications.

In the platform

The modules behind this page

Every module works on the same record, so a task done once is counted wherever it applies.

Compliance Centre

Status for every framework, derived from the work.

Task Engine

Every requirement as an owned task with evidence.

Audit Centre

Internal, external, certification and regulatory audits end to end.

Third-Party Risk

Vendors discovered, assessed and reported to the board.

Policy Hub

Policies generated, scored and kept current.

Dashboard and Reports

A live posture score and one-click board reports.

The detail: reporting, engagement and what to prepare

Questions we are asked

Is DPDPA a separate framework in Netra?

No. It is not a separate framework in the library. Netra's Security and Privacy hub supports data-subject rights such as erasure and export, which helps in DPDPA conversations.

Which RBI Direction applies to us?

It depends on your entity class. Netra holds variants for commercial banks, small finance banks, payments banks, urban co-operative banks, AIFIs, credit information companies and NBFCs.

Can the same evidence also serve ISO 27001?

Where controls overlap, yes.

See Netra for India

A demo built around your frameworks and your kind of organisation, not a generic tour.