Financial servicesIndia

RBI CTRRAF 2026 - All India Financial Institutions

Keep institution-wide assurance grounded in completed work

Connect technology governance, resilience evidence and audit remediation for your financial institution.

Full title
Reserve Bank of India (All India Financial Institutions – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026
Issued by
Reserve Bank of India, Department of Supervision
Issued and in force
31 July 2026, with immediate effect. No amendments were shown in the published text as at 15 October 2026.
Applies to
The five All India Financial Institutions: EXIM Bank, NABARD, SIDBI, NHB and NaBFID
Nature
Binding regulatory Directions, reviewed through RBI supervision and the institution’s own information systems audit
Structure
Eight chapters and 227 paragraphs, with 31 baseline cybersecurity and resilience requirement areas in Chapter V

Overview

What the Directions require

These Directions apply RBI’s Cybersecurity, Technology: Risk, Resilience and Assurance Framework to the five All India Financial Institutions it names. They cover the Board’s role, IT governance, IT and information security risk, 31 baseline security and resilience areas, a Cyber Security Operations Centre and information systems audit. Issued by the Department of Supervision on 31 July 2026 with immediate effect, they repeal the institutions’ earlier directions on the cybersecurity framework and IT governance, with a saving clause.

The governance model mirrors the 2026 bank Directions: a Board-level IT Strategy Committee chaired by an independent director with IT expertise, quarterly IT Steering Committee meetings, an Information Security Committee led from the risk function, and a CISO at or near General Manager level who reports to the Executive Director overseeing risk and is kept apart from the Head of IT. Critical systems carry the same VA/PT, disaster recovery and six-hour incident reporting rules.

The AIFI text also differs from the bank Directions in ways that matter for planning. Paragraph 7 simply requires the Board to review the technology and security policies at least annually, with no provision for delegating that review to the IT Strategy Committee. There is no section on ATM Switch Application Service Providers, and no requirement to alert customers about transactions above a set value. Customer authentication, customer awareness and risk-based transaction monitoring still apply. There is no comply-or-explain route; proportionality comes from risk-based treatment of non-critical systems and controls sized to the institution’s profile.

AIFIs are large, often refinancing or development institutions with their own mix of wholesale systems, partner integrations and statutory obligations. The task is to run each requirement as owned, recurring work and to give the Board and the Audit Committee an evidence-backed view between supervisory reviews.

Who it applies to

Paragraph 3 applies the Directions to the following All India Financial Institutions, together called AIFIs:

  • Export-Import Bank of India (EXIM Bank)
  • National Bank for Agriculture and Rural Development (NABARD)
  • Small Industries Development Bank of India (SIDBI)
  • National Housing Bank (NHB)
  • National Bank for Financing Infrastructure and Development (NaBFID)

Third-party paragraphs 125 to 134 apply only to IT and cybersecurity arrangements outside the AIFI Managing Risks in Outsourcing Directions, 2025. Banks, NBFCs and other entities have their own Directions: see Commercial Banks, Small Finance Banks, Payments Banks, Urban Co-operative Banks, NBFCs and Credit Information Companies. See also CERT-IN guidelines.

Structure

How the Directions are organised

Eight chapters and 227 paragraphs. Chapter V’s 31 baseline areas, lettered A to EE, are grouped here by theme.

Chapter I

Preliminary

Commencement with immediate effect, applicability to the five named AIFIs, and 32 definitions drawn mainly from the FSB Cyber Lexicon.

Chapter II

Role of the Board

Strategies and policies
The Board approves strategies and policies on IT, information assets, business continuity, information security and cybersecurity, including incident and crisis management.
Annual Board review
The strategies and policies are placed before the Board for review at least annually. Unlike the 2026 bank Directions as updated, the AIFI text does not provide for delegating this review to the IT Strategy Committee.
Committees
A Board-level IT Strategy Committee, with the Audit Committee of the Board overseeing IS audit.
Chapter III

IT governance and oversight

Governance framework
Structures, roles and oversight for strategic alignment, risk, resources, performance and continuity.
Policies
An information security policy, and a cybersecurity policy that is distinct and separate from the broader IT and information security policy.
IT Strategy Committee
At least three directors, chaired by an independent director with at least seven years’ experience in managing information systems or leading technology or cybersecurity initiatives, who also understands the business processes IT affects. Members must be technically competent. Meets at least quarterly and reviews IT architecture and BCP/DR adequacy at least annually.
IT Steering Committee
Senior management from IT and business. Meets at least quarterly and updates the IT Strategy Committee and the MD or CEO.
Information Security Committee
Constituted by the IT Strategy Committee, including the CISO and business and IT representatives, and headed by an official from the risk management vertical. Reviews incidents and audit observations and reports to the ITSC and MD or CEO.
Head of IT
A senior, technically competent official acting as the first line of defence for IT controls.
CISO
Preferably General Manager rank or equivalent, for a reasonable minimum term, with a team whose expertise matches the institution’s business volume and technology complexity. No direct reporting to the Head of IT, no business targets, direct reporting to the Executive Director overseeing risk, and a review of cyber risk before the Board, RMCB or ITSC at least quarterly.
Projects, architecture and services
IT project management, IT architecture and IT service management.
Chapter IV

IT and information security risk management

Periodic review
IT-related risks reviewed periodically.
Framework
An IT and information security risk framework, with flexibility to define a separate cybersecurity risk framework.
Assessment
Risks rated low, moderate, high or very high, or on a similar scale, with risk-cost trade-off decisions documented for supervisory assessment.
Chapter V

Baseline controls: systems, data and access

Assets and data
Information asset inventory, data leak prevention strategy and data migration controls.
Software and configuration
Preventing unauthorised software, secure configuration, and patch, vulnerability and change management.
Facilities and capacity
Physical and environmental controls with geographically well separated data centre and recovery sites, and capacity assessed annually or more often.
Networks, applications and logs
Network security, application security across its life cycle, and monitoring and analysis of audit logs.
User access and teleworking
Need-based access, two-factor or multi-factor authentication based on risk, and logged and monitored privileged access to critical systems. Controls for teleworking.
Mail, media and cryptography
Secure mail and messaging, removable media controls, cryptographic controls and straight through processing controls.
Chapter V

Baseline controls: detection, testing and recovery

Surveillance and threat defence
Continuous surveillance, advanced real-time threat defence and anti-phishing.
VA and PT
Critical systems and customer-facing DMZ systems: vulnerability assessment at least every six months and penetration testing at least every 12 months. Non-critical systems on a risk basis. Closure reported to the ITSC and ISC at least quarterly.
Red teaming
The AIFI may conduct red team exercises. They are not mandatory.
Business continuity and DR
Practice such as ISO 22301, half-yearly drills for critical systems with the DR site run as primary for at least a full working day, periodic backup restoration, ITSC-approved minimal recovery time and near-zero data loss for critical systems.
Incident response and crisis management
Incidents reported to RBI on DAKSH within six hours of detection, with proactive notice to CERT-IN. The AIFI may share threat intelligence with IDRBT’s IB-CART. A Cyber Crisis Management Plan covers detection, containment, response and recovery.
Metrics and forensics
Key performance and risk indicators, recovery objectives for all critical systems, and forensic and DDoS mitigation support on standby.
Chapter V

Baseline controls: third parties, customers and people

Third-party arrangements
For IT and cybersecurity arrangements outside the outsourcing directions: proportionate controls including concentration risk, an AIFI right to audit, RBI inspection rights and access to information resources even off premises, infrastructure location requirements, and mandatory background checks and non-disclosure agreements.
Customers
A framework for verifying customer identity across channels, customer awareness of cyber risks including warnings on sharing credentials, OTPs and PINs, and risk-based transaction monitoring across delivery channels.
Awareness
Annual training for the Board and senior management and for lower and middle management, and mandatory awareness for new recruits.
Chapter VI

Cyber Security Operations Centre

Governance
A framework matched to the AIFI’s technology risk profile and scale, with threat briefings and dashboards for the Board or ITSC.
Capabilities
SIEM-based monitoring, root-cause analysis, collection of indicators of compromise, honeypots and forensics.
Staffing
Three levels from round-the-clock monitoring to advanced analysis, staffed for 24x7 operation through in-house or managed-service models.
Chapter VII

Information systems audit

Oversight and policy
The Audit Committee of the Board oversees IS audit and approves the IS Audit Policy, reviewing it at least annually.
Function and approach
A separate IS audit function or skilled resources within internal audit. Continuous auditing of critical systems to be considered wherever possible.
Chapter VIII

Repeal and other provisions

Earlier directions, instructions and guidelines on the cybersecurity framework and IT governance for AIFIs stand repealed, with a saving clause, application of other laws and interpretation.

Implementation roadmap

How to implement it, step by step

A sequence for an AIFI moving its existing programme onto the 2026 Directions.

  1. 1

    Map existing controls to the new text

    Trace current policies and controls from the repealed directions to the new chapters and lettered areas, and note where the 2026 text is new or stricter.

    OutputsParagraph mappingList of new obligations
  2. 2

    Set the Board review cycle

    Because the AIFI text keeps the annual policy review with the Board, place every covered strategy and policy on the Board calendar rather than relying on committee review alone.

    OutputsBoard calendarPolicy register
  3. 3

    Confirm committees and the CISO

    Check the IT Strategy Committee’s chair and composition, the IT Steering and Information Security Committees, and the CISO’s rank, term, team and reporting line.

    OutputsCommittee chartersCISO mandate
  4. 4

    Identify critical systems

    Classify critical and customer-facing DMZ systems through risk assessment, since testing, drill and recovery rules attach to them.

    OutputsCritical systems register
  5. 5

    Sort and update third-party arrangements

    Separate arrangements under the outsourcing directions from other IT and cybersecurity arrangements, and bring the latter’s contracts in line with the CTRRAF clauses.

    OutputsClassified vendor listContract updates
  6. 6

    Close baseline gaps

    Work through the 31 areas by risk and build VA every six months, PT every year and DR drills every half-year into the operating calendar.

    OutputsRemediation planTesting and drill calendar
  7. 7

    Prove detection, response and assurance

    Confirm the operations centre model, approve the Cyber Crisis Management Plan, rehearse six-hour DAKSH reporting and have the Audit Committee approve the IS Audit Policy and plan.

    OutputsCCMPIS Audit PolicyReporting runbook
  8. 8

    Report and keep current

    Put quarterly CISO and VA/PT closure reports before the committees, run annual reviews and training, and watch the text for amendments.

    OutputsCommittee packsEvidence library

Audit and evidence guide

What auditors look for, and the evidence to keep

RBI supervision and the AIFI’s own IS audit test whether each requirement operates at the frequency the Directions set. Reviewers will sample records rather than accept policy statements.

What reviewers look for

  • Board minutes showing annual review of each covered strategy and policy
  • A cybersecurity policy distinct from the IT and information security policy
  • IT Strategy Committee composition, chair’s expertise and quarterly meetings
  • CISO rank, independence and direct reporting to the Executive Director overseeing risk
  • Critical systems classification and the stricter controls applied
  • VA and PT reports and quarterly closure reporting
  • DR drills running the recovery site as primary for a full working day
  • Incident detection times and DAKSH reports within six hours
  • Third-party contracts with audit, inspection and personnel clauses
  • IS Audit Policy approval and follow-up of audit findings

Recurring obligations and timelines

Board review of strategies and policiesAt least annually
IT Strategy Committee meetingsAt least quarterly
IT Steering Committee meetingsAt least quarterly
CISO cyber risk reviewAt least quarterly
VA of critical and customer-facing DMZ systemsAt least every 6 months
Penetration testing of the same systemsAt least every 12 months
VA/PT closure status to ITSC and ISCAt least quarterly
DR drills for critical systemsAt least half-yearly
IT architecture review by the ITSCAt least annually
Capacity assessmentAnnually or more often
IS Audit Policy reviewAt least annually
Board and senior management trainingAnnually
Cyber incident report to RBI on DAKSHWithin 6 hours of detection

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Governance

  • Board minutes with annual reviews
  • Committee charters and minutes
  • CISO appointment and reporting line

Risk

  • IT and information security risk register
  • Critical systems register
  • Documented risk-cost trade-offs

Baseline controls

  • Asset inventory
  • Configuration baselines
  • Access and privileged access reviews
  • Patch and change records

Testing and recovery

  • VA and PT reports
  • Closure tracker
  • DR drill reports
  • Backup restoration records

Incidents

  • Incident register with detection times
  • DAKSH and CERT-IN submissions
  • Cyber Crisis Management Plan

Third parties

  • Vendor classification by regime
  • Contracts with audit and inspection rights
  • Background check and NDA records

IS audit

  • IS Audit Policy and approval
  • Audit plan and reports
  • Action tracking

Areas that often need attention

  • Policy reviews handled by a committee with no annual Board record
  • Cybersecurity policy merged into the information security policy
  • CISO placed under the technology function
  • Critical systems not formally classified
  • DR drills that stop short of a full working day on the recovery site
  • Vendors not sorted between the outsourcing directions and CTRRAF
  • Incident detection times not recorded
  • Evidence assembled only when a review is announced

How Netra helps

Where each part of the work lives in Netra

Netra loads the AIFI Direction as requirements, tasks and policies, so that each obligation is owned work and each piece of evidence sits on one record.

Ownership of every requirement

Task Engine

Requirements arrive as tasks with owners and due dates, with recurring tasks for quarterly, half-yearly and annual obligations.

Status the Board can rely on

Compliance Centre

Status derived from completed tasks and evidence, never typed in. One task can also satisfy overlapping frameworks such as ISO 27001.

Annual Board review of policies

Policy Hub

A policy library generated at onboarding, with review dates and a policy score tied to the work behind each policy.

IT and information security risk

Risk Manager

A register with inherent and residual heatmaps, with risks reduced as linked tasks complete.

Third-party arrangements

Third-Party Risk

Vendors found from what Accounts and Purchase pay, assessed through a vendor portal, with decisions and ratings recorded.

IS audit and supervisory reviews

Audit Centre

Internal and regulatory audits run end to end with findings and corrective actions, using evidence held in a tamper-evident vault.

Critical systems

Asset Management

Assets linked to tasks, so the stricter requirements show against the right systems.

Board and committee reporting

Dashboard & Reports

A live Posture Score and a one-click board report for the Direction.

Netra organises the work, evidence and reviews. It is not a SIEM, an operations centre or a channel for reporting incidents to RBI or CERT-IN, and it does not by itself establish compliance. The institution remains responsible for implementation and regulatory interpretation.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Financial services

RBI CTRRAF 2026 - Commercial Banks

Connect bank-wide cyber governance with reviewable evidence

Financial services

DORA

Keep digital resilience work ready for review

Security

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

See RBI CTRRAF 2026 - All India Financial Institutions in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.