RBI’s 2026 cybersecurity Directions for commercial banks: what the Board, the CISO and auditors need to know
The new Directions bring IT governance, cyber risk, baseline controls, a security operations centre and IS audit into one text. Here is what they ask of a commercial bank, and where the work usually gets stuck.
Key takeaways
- One text, eight chapters, with frequencies a supervisor can check.
- The Board approves the strategies and policies, and the CISO reports on cyber risk at least quarterly.
- The Directions apply to commercial banks. Other regulated entities have Directions of their own.
- Most friction comes from running the requirements on schedule, not from reading them.
On 31 July 2026 the Reserve Bank of India’s Department of Supervision issued the Commercial Banks Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026. They took effect on issue, and the text was updated as on 1 October 2026. The earlier cybersecurity framework and IT governance instructions for commercial banks stand repealed.
For most banks, the Directions do not introduce an unfamiliar subject. What they change is the shape of the obligation: one text, eight chapters, and clear frequencies that a supervisor can check.
Who the Directions cover
The Directions apply to banking companies other than Small Finance Banks, Payments Banks and Local Area Banks, to corresponding new banks and to the State Bank of India. Foreign banks operating in branch mode follow a comply-or-explain approach for specified chapters. Other regulated entities, including Small Finance Banks, Urban Co-operative Banks and NBFCs, have Directions of their own.
Accountability starts with the Board
The Board approves the IT, information security, cybersecurity and business continuity strategies and policies, and reviews them at least annually. The cybersecurity policy must be distinct from the wider IT and information security policy.
The governance structure is specific:
- An IT Strategy Committee of at least three directors, chaired by an independent director with at least seven years of relevant IT experience, meeting at least quarterly
- An IT Steering Committee of senior management from IT and business, also meeting at least quarterly
- An Information Security Committee under the IT Strategy Committee, headed from the risk management vertical
- A Chief Information Security Officer who does not report directly to the Head of IT, carries no business targets, reports to the Executive Director overseeing risk, and reviews cyber risk before the Board or its committees at least quarterly
Baseline controls, with frequencies that can be tested
Chapter V sets 31 baseline areas, from inventory management and secure configuration to anti-phishing, forensics and customer education. Several come with frequencies a reviewer will look for:
- Vulnerability assessment of critical and customer-facing DMZ systems at least every six months, and penetration testing at least every twelve months
- Closure status of those findings reported to the IT Strategy Committee and the Information Security Committee at least quarterly
- Disaster recovery drills for critical systems at least half-yearly, running the recovery site as primary for at least a full working day
Cyber incidents must be reported to RBI on the DAKSH platform within six hours of detection, with CERT-IN notified as well.
Detection, response and assurance
The Directions expect a Cyber Security Operations Centre sized to the bank’s technology risk profile, staffed round the clock across defined levels. They require a documented Cyber Crisis Management Plan covering detection, containment, response and recovery. Information systems audit sits with the Audit Committee of the Board, under an IS Audit Policy reviewed at least annually and a risk-based audit plan.
Where the work usually gets stuck
Interpreting the text is rarely the hard part. Running it is. In practice the friction tends to come from:
- 1Policies approved once and then not reviewed on schedule
- 2Findings from vulnerability assessments that stay open without tracked closure
- 3Disaster recovery drills that never run the recovery site as primary for a full day
- 4Incident records without a detection time, so six-hour reporting cannot be shown
- 5Evidence spread across email and shared drives when a supervisory review begins
A practical way to run it
Treat each requirement as owned work with a due date, and let the evidence build up as the work is done rather than at inspection time. Recurring obligations, such as quarterly committee reviews and half-yearly drills, should reopen on their own so they do not lapse.
That is the approach Netra takes: the Direction for your entity is loaded as requirements, tasks and policies, status is derived from completed work and evidence, and the Board report is built from live data. You can read a fuller breakdown on the RBI CTRRAF 2026 for Commercial Banks page.
This article is a summary for general information. It is not legal advice. Banks should confirm how the Directions apply to them with their compliance and legal teams.
Frequently asked questions
Who approves cyber strategies and policies under the commercial bank Directions?
The Board approves the strategies and policies, and the CISO reports on cyber risk at least quarterly.
Do these Directions apply to NBFCs and co-operative banks?
No. They apply to commercial banks. Other regulated entities have Directions of their own.
Where do banks find the difficulty?
Most friction comes from running the requirements on schedule, not from reading them.
The Direction for your entity, loaded as owned work
Requirements, tasks and policies with status derived from evidence.
See it in Netra
A demo on the frameworks that matter to you.
