RBI’s 2026 cybersecurity Directions for Small Finance Banks: what the Board, the CISO and internal audit have to run
Small Finance Banks have their own cyber Directions, issued 31 July 2026. What they ask of the Board, CISO, CSOC and IS audit, and the evidence for each duty.
Key takeaways
- Small Finance Banks have a text of their own, in force from 31 July 2026, covering governance, risk, 31 baseline control areas, a CSOC and IS audit.
- Cyber incidents are reported to RBI on DAKSH within six hours of detection, with CERT-In notified as well.
- Vulnerability assessment, penetration testing and disaster recovery drills carry fixed frequencies that a reviewer can test.
- The difficulty is rarely reading the text. It is showing, on the day, that each recurring duty ran on time.
On 31 July 2026 the Reserve Bank of India issued the Small Finance Banks Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026. They apply to Small Finance Banks (SFBs), came into force with immediate effect, and the version on the RBI website is updated as on 1 October 2026. They repeal the earlier Cybersecurity Framework and IT Governance instructions that applied to SFBs.
Commercial banks have a separate text with its own scope. If you read our note on the commercial bank Directions, the structure will look familiar. What matters for an SFB is that the obligations now sit in one document addressed to it, and that several of them carry frequencies a supervisor can check.
What do the Directions for Small Finance Banks cover?
The text runs to eight chapters:
- 1Preliminary: commencement, applicability and definitions
- 2Role of the Board: Board-approved policies and Board-level committees
- 3IT Governance and Oversight: the IT Strategy Committee, IT Steering Committee, Information Security Committee, Head of IT, CISO, project management, architecture and IT services
- 4IT and Information Security Risk Management: review, framework and risk identification
- 5Baseline Cybersecurity and Resilience Requirements: sections A to EE, which is 31 control areas
- 6Cyber Security Operation Centre (CSOC)
- 7Information Systems Audit
- 8Repeal and Other Provisions
The Directions are addressed to SFBs alone. They do not set separate thresholds for smaller or larger SFBs, so the same baseline applies across the sector.
Who is accountable for what?
The Board approves the strategies and policies for IT, information assets, business continuity, information security and cybersecurity, including incident response and cyber crisis management. It may delegate their review to the Board-level IT Strategy Committee (ITSC), but material amendments need Board approval, and the review happens at least annually. The cybersecurity policy is kept distinct from the wider IT and information security policy.
| Role | What the Directions ask | Evidence a reviewer will want |
|---|---|---|
| Board | Approves IT, information security, cybersecurity and business continuity strategies and policies; review at least annually | Board minutes approving each policy, with review dates |
| IT Strategy Committee | At least three directors; the Chairperson is an independent director with a minimum of seven years’ experience in managing information systems or guiding technology or cybersecurity initiatives; meets at least quarterly | Composition record, the Chairperson’s experience note, quarterly minutes |
| IT Steering Committee | Senior management from IT and business; meets at least quarterly | Attendance and minutes |
| Information Security Committee | Formed under the ITSC; its head comes from the risk management vertical | Constitution decided by the ITSC, with the committee’s reviews of incidents and IS audit observations |
| CISO | No direct reporting line to the Head of IT and no business targets; reports to the Executive Director or equivalent overseeing risk management; places a review of cyber risks and preparedness before the Board, the Risk Management Committee of the Board or the ITSC at least quarterly | Reporting line on the organisation chart, the quarterly review papers |
| Audit Committee of the Board | Approves the IS Audit Policy and reviews it at least annually | Approved policy and review minutes |
Watch for. The CISO’s quarterly review is a dated, recurring duty. A deck that exists but was never placed before the Board, the Risk Management Committee or the ITSC does not show that it happened.
What do the baseline controls ask for?
Chapter V is the longest part of the text. It covers inventory of information assets, data leak prevention, data migration, preventing unauthorised software, physical and environmental controls, capacity, secure configuration, network security, the application security life cycle, audit logs, patch and change management, user access, teleworking, customer authentication, secure mail, removable media, third-party arrangements, cryptography, straight through processing, continuous surveillance, advanced threat defence, anti-phishing, vulnerability assessment and penetration testing, red teaming, business continuity and disaster recovery, incident response, metrics, awareness, customer education, risk-based transaction monitoring and forensics.
Several carry frequencies:
| Requirement | What is asked | Evidence a reviewer will want |
|---|---|---|
| Vulnerability assessment and penetration test | For critical information systems and DMZ systems with a customer interface: VA at least once every six months, PT at least once in 12 months | Scope list, reports with dates, tester details |
| Closure of findings | Closure status of VA and PT observations put to the ITSC and the Information Security Committee at least quarterly | Open and closed findings by date, committee papers |
| Disaster recovery drills | For critical information systems, at least half-yearly; the drill switches to the DR site and uses it as primary for at least a full working day, beginning of day to end of day | Drill plan, run log, sign-off, issues raised |
| Security infrastructure and policies | Reviewed at least annually | Review record per policy and per device group |
| Capacity | Assessment of IT resources annually or more often | Capacity review with date and owner |
Other controls are stated without a fixed frequency but are routinely asked about: multi-factor authentication for privileged users of critical systems, DMARC on email, removable media prohibited unless specifically authorised, and awareness training for new recruits, staff, management, the Board and senior management.
What do the Directions say about incidents and the CSOC?
A bank must report cyber incidents within six hours of detection on the DAKSH platform, and must also proactively notify CERT-In. Participation in the IDRBT CISO forum and sharing threat intelligence with IB-CART are framed as options, not duties. For the wider incident duties that apply to most organisations in India, see our guide to CERT-In six-hour incident reporting.
The text also requires a documented incident response policy and a Cyber Crisis Management Plan, and a CSOC for continuous surveillance. The CSOC has to be governed, with briefings to the Board or ITSC on threat intelligence, and staffed in levels: round-the-clock Level 1 monitoring, Level 2 specialists in network, data and endpoint security, and Level 3 analysts with advanced skills such as forensic evidence collection and malware reverse engineering.
Watch for. An incident record with no detection time cannot show that a six-hour report was on time. Record who detected it and when, before anything else.
How are third parties treated?
Section Q on third-party arrangements applies where the arrangement is not already covered by the SFB outsourcing Directions of 2025. It asks for risk-proportionate vendor assessment and controls, including rights of audit and inspection. A separate set of paragraphs covers application service providers for ATM switches, including the duty of the provider to inform the bank of cyber incidents in a timely manner. Our third-party risk checklist sets out how to evidence this.
What does IS audit look like?
The Audit Committee of the Board oversees information systems audit and approves the IS Audit Policy, which describes the mandate, purpose, authority, audit universe and periodicity. The bank needs a separate IS audit function or resources with the right skills within Internal Audit. Planning is risk-based. If external resources are used where skills are lacking, accountability stays with Internal Audit. For continuous auditing of critical systems, the text says the bank may consider it.
A readiness checklist
Where the work usually gets stuck
The pattern is familiar from other banks. Policies are approved once and the annual review slips. Findings from penetration tests stay open without a tracked closure date. A DR drill is run at the recovery site for an afternoon, not for a full working day. Committee papers and drill reports sit across email and shared drives when a review begins.
How this runs as owned work in Netra
Treat each requirement as work with an owner and a due date, and let the evidence build as the work is done. Recurring duties, such as quarterly committee reviews and half-yearly drills, should reopen on their own so they do not lapse.
That is the approach Netra, the Compliance & Audit OS, takes. The Direction is loaded as requirements, tasks and policies. Evidence is attached once to the task and carries across to every requirement it supports. Status is derived from completed work and evidence, and the Audit Centre holds the record that a reviewer or internal audit can follow. A fuller breakdown is on the RBI CTRRAF 2026 for Small Finance Banks page.
This article is a summary for general information. It is not legal advice. Small Finance Banks should confirm how the Directions apply to them with their compliance and legal teams, and work from the text on the RBI website.
Frequently asked questions
Do the commercial bank Directions apply to a Small Finance Bank?
No. Small Finance Banks have their own Directions, issued on 31 July 2026, and the commercial bank text has its own scope. A Small Finance Bank works from the text titled for it.
How quickly must a Small Finance Bank report a cyber incident?
Within six hours of detection, on the DAKSH platform. The bank must also proactively notify CERT-In.
How often must vulnerability assessments and penetration tests run?
For critical information systems and DMZ systems with a customer interface, vulnerability assessment at least once every six months and penetration testing at least once in 12 months. Closure status goes to the IT Strategy Committee and the Information Security Committee at least quarterly.
Who approves the cybersecurity policy?
The Board approves the strategies and policies, and may delegate their review to the Board-level IT Strategy Committee. Review happens at least annually, and material amendments go back to the Board.
Sources
The Direction for your entity, loaded as owned work
Requirements, tasks and policies with status derived from evidence.
See it in Netra
A demo on the frameworks that matter to you.
