Key takeaways
- Most of the Directions share one rhythm: policies approved and reviewed at least annually, committees and the CISO review at least quarterly.
- A paper that was prepared but never tabled does not show that a quarterly duty happened. Keep the date it was placed before the committee, and the minute.
- The urban co-operative bank text is graded by level, so its Board duties start lighter and grow at Level IV.
- Build one pack that follows the calendar, and let each item point to the evidence it rests on.
RBI’s cybersecurity Directions of 31 July 2026 place a good deal of the work on the Board. The wording differs by regulated entity, but a pattern runs through the commercial bank, Small Finance Bank, Payments Bank, Credit Information Company, All India Financial Institution and NBFC (Chapter V) texts: policies approved by the Board and reviewed at least annually, committees that meet at least quarterly, and a CISO who reports on cyber risk at least quarterly.
The Directions do not hand over a Board pack. This guide sets out what they ask to reach each forum, then a structure you can build the pack around. For the segment detail, see our guides for Small Finance Banks, Payments Banks, Credit Information Companies, All India Financial Institutions, NBFCs, urban co-operative banks and commercial banks.
Who has to receive what
| Forum | What the Directions ask | Rhythm |
|---|---|---|
| Board | Approves the IT, information asset, business continuity, information security and cybersecurity strategies and policies, including incident response and cyber crisis management. The cybersecurity policy is kept separate from the wider IT policy | Review at least annually |
| IT Strategy Committee | At least three directors, chaired by an independent director with at least seven years of experience in managing information systems or leading technology or cybersecurity initiatives | Meets at least quarterly |
| IT Steering Committee | Senior management from IT and business | Meets at least quarterly |
| Information Security Committee | Sits under the IT Strategy Committee and is headed from the risk management vertical | As set by the text for your segment |
| CISO | No direct reporting line to the Head of IT, no business targets, reports to the Executive Director or equivalent overseeing risk. Places a review of cyber risks and preparedness before the Board, its Risk Management Committee or the IT Strategy Committee | At least quarterly |
| Audit Committee of the Board | Approves the IS Audit Policy and reviews it at least annually, and oversees IS audit | Annual review of the policy |
Small Finance Banks and Payments Banks may delegate review of the policies to the IT Strategy Committee, but material amendments still need Board approval. In those two segments, closure status of vulnerability assessment and penetration test observations is also put to the IT Strategy Committee and the Information Security Committee at least quarterly.
Where the urban co-operative bank text differs
The urban co-operative bank Directions are graded by level. At Level I the Board or Administrator approves a separate Cybersecurity Policy, the Board is ultimately responsible for information and cybersecurity, and the bank may update its Board on basic IT and cyber risk at least once a year. At Level IV the fuller structure applies: a CISO who presents a cybersecurity review to the IT Strategy Committee or Board every quarter, an Information Security Committee that meets at least quarterly, and an Audit Committee that monitors security and VA-PT findings until they are closed. Use the UCB level finder to see where you sit.
A pack structure to start from
Build the pack around the calendar, not around the Directions. Each item should point to the evidence it rests on.
| Item | Annual or other | Quarterly | What to attach |
|---|---|---|---|
| Policy approvals and reviews: IT, information assets, business continuity, information security, cybersecurity | Yes | Board minute, approved version, review date | |
| Committee composition: ITSC directors, chair’s qualifying experience | Yes | Composition record, experience note | |
| CISO review of cyber risk and preparedness | Yes | The paper, the date it was tabled, the minute | |
| IT Steering Committee and Information Security Committee minutes | Yes | Attendance and minutes | |
| Closure of vulnerability assessment and penetration test findings | Yes | Open and closed findings by date | |
| Disaster recovery drill outcomes for critical systems | Half-yearly | Drill report, retest of any failed items | |
| IS audit findings and corrective actions | As the IS audit cycle sets | Audit Committee papers and follow-up | |
| IS Audit Policy approval and review | Yes | Approved policy, review minute |
Watch for. A review that was prepared but not tabled does not show a quarterly duty happened. Keep the paper, the date it went before the Board, the Risk Management Committee or the ITSC, and the minute.
Questions a Board member can ask
These are our suggestions, not wording from the Directions.
- 1Which requirements were due this quarter, and which were completed with evidence?
- 2Which test findings are still open, and since when?
- 3Did every committee meet within its interval, and is there a minute?
- 4What changed in our systems or services since the last review that could change which requirements apply?
- 5What did the last IS audit find, and who owns each corrective action?
Where the work usually gets stuck
Quarterly dates slip because they depend on a handful of people. Papers are drafted at the last moment from email. The same evidence is rebuilt for the Board, the auditors and the supervisor. And nobody can say, on the day, which item is overdue.
How this runs as owned work in Netra
Give each Board duty an owner and a due date, and let the evidence build as the work is done. Annual, half-yearly and quarterly duties reopen on their own, and a committee paper links to the task and evidence it summarises. Status is derived from completed work and evidence, not typed in. The institution still decides how the Directions apply to it, and remains responsible for implementation. The RBI frameworks in Netra show how each Direction is loaded.
This article is a summary for general information. It is not legal advice. Confirm how the Directions apply to your institution with your compliance and legal teams, and read the Directions themselves.
Frequently asked questions
Does RBI prescribe a format for the Board pack?
No format is prescribed in the Directions we reviewed. What they set is who must approve, review or receive what, and how often. The pack in this guide is a structure to hold the evidence of those duties, not a template RBI requires.
How often does the CISO have to report?
Under the Directions for commercial banks, Small Finance Banks, Payments Banks, Credit Information Companies, All India Financial Institutions and NBFCs under Chapter V, the CISO places a review of cyber risk and preparedness before the Board, its Risk Management Committee or the IT Strategy Committee at least quarterly.
Which committee approves the IS audit policy?
The Audit Committee of the Board, for the segments where the Directions set out an IS Audit Policy. It reviews that policy at least annually.
Do urban co-operative banks follow the same pack?
Only at Level IV. At lower levels the Directions use softer wording, for example that the bank may update its Board on basic IT and cyber risk at least once a year. Check your level first.
Sources
- RBI: Master Directions page, Small Finance Banks (id 13634)
- RBI: Master Directions page, Payments Banks (id 13625)
- RBI: Master Directions page, Credit Information Companies (id 13583)
- RBI: Master Directions page, All India Financial Institutions (id 13597)
- RBI: Master Directions page, NBFCs (id 13592)
- RBI: Master Directions page, Urban Co-operative Banks (id 13616)
Board duties as scheduled work
Recurring approvals, reviews and committee papers reopen on their own, with the evidence attached once.
See it in Netra
A demo on the frameworks that matter to you.
