RBI's 2026 Cyber Directions: Technology Architecture Is Now Risk Architecture
RBI Deputy Governor Rohit Jain told bankers on 24 September that technology risk is now a first-order enterprise risk. The 31 July 2026 directions already make that enforceable, with no transition period.
By Intellinative Research Team ·
Key takeaways
- RBI issued seven cyber and technology risk directions on 31 July 2026, one for each type of regulated entity. The commercial-bank version (RBI/DoS/2026-27/410) applied from the day of issue.
- Cyber incidents must be reported on RBI's DAKSH platform within six hours of detection, and CERT-In must also be informed.
- The CISO must report to the Executive Director who oversees risk management, not to the Head of IT, and must review cybersecurity with the Board at least once a quarter.
- For critical and internet-facing systems, vulnerability assessment is due every six months and penetration testing every 12 months. DR drills are half-yearly, and at least one drill must run the bank from the DR site for a full working day.
- The directions contain no explicit SBOM mandate. Vendors must still certify that software is free of known vulnerabilities and malware, and critical applications need source-code escrow.
The Deputy Governor's message: you can outsource the work, not the accountability
On 24 September 2026, RBI Deputy Governor Rohit Jain spoke at the 13th SBI Banking & Economics Conclave in Mumbai. He told banks that technology risk should be treated as "a first-order enterprise risk", and that accountability does not transfer to an outside provider along with the work (Policy Edge, ANI). FinTech BizNews reported ten supervisory expectations from the speech, covering third-party dependencies, identity and access, legacy technology and tested recovery.
Technology architecture is becoming the risk architecture of a bank. — Rohit Jain, Deputy Governor, RBI · 24 Sep 2026
This was a speech, not a new rule. It does, however, tell you how supervisors will read the directions RBI issued on 31 July. On 9 September at Global Fintech Fest, Jain also named speed, concentration and opacity as the main risks of emerging technology. Concentration here means depending on a small number of cloud and technology vendors (BIS, posted 16 Sep 2026).
- 7 directions issued on 31 July 2026, one for each type of regulated entity (BitScore summary)
- 6 hrs to report a cyber incident on DAKSH after detection (para 182) (RBI Directions)
- 4x / yr CISO review before the Board, and IT Strategy Committee meetings (paras 28.7, 18) (RBI Directions)
- 24.9 bn UPI transactions in August 2026, the scale behind the warning (DG speech coverage)
Seven directions, one framework
The commercial-bank instrument is the Reserve Bank of India (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (RBI/DoS/2026-27/410, dated 31 July 2026). Paragraph 2 makes it effective on issue. Paragraph 230 repeals the earlier cybersecurity framework and IT governance instructions for commercial banks. Security Brigade's analysis sums up the timing: there is "no transition period… no glide path" (Security Brigade).
| Regulated entity | Reference | Notes |
|---|---|---|
| Commercial banks (incl. SBI) | RBI/DoS/2026-27/410 | Excludes SFBs, payments banks and local area banks. Foreign bank branches follow comply-or-explain for some chapters. |
| Small finance banks | RBI/DoS/2026-27/419 | Reference per secondary summary |
| Payments banks | RBI/DoS/2026-27/428 | Reference per secondary summary |
| Urban co-operative banks | RBI/DoS/2026-27/437 | Reference per secondary summary |
| All India Financial Institutions | RBI/DoS/2026-27/456 | EXIM Bank, NABARD, SIDBI, NHB, NaBFID |
| NBFCs | RBI/DoS/2026-27/461 | Tiered: base layer below ₹500 crore, base layer at ₹500 crore and above, and middle/upper/top layers |
| Credit information companies | RBI/DoS/2026-27/470 | Reference per secondary summary |
What the commercial-bank directions actually require
Most of the framework will look familiar to banks that complied with the 2016 cybersecurity framework and the 2023 IT governance Master Direction. The difference now is that the requirements are prescriptive, with numbers, and they applied from the day of issue. The table below lists the clauses that most often need a budget line, a new owner or a change in process.
| Area | Requirement | Paragraph |
|---|---|---|
| Incident reporting | Report cyber incidents on DAKSH within six hours of detection, and inform CERT-In proactively. | 182 |
| CISO | A senior executive (preferably General Manager rank) who reports to the ED overseeing risk management, not the Head of IT. | 28.6 |
| Board oversight | The CISO reviews cybersecurity with the Board at least quarterly. The IT Strategy Committee has at least three directors, is chaired by an independent director with seven or more years of IS experience, and meets quarterly. | 17, 18, 28.7 |
| Security operations | A Cyber Security Operations Centre with three levels: L1 monitors 24x7, L2 has specialist skills, L3 has advanced analysts with forensic skills. | 212, 221 |
| Testing | VA at least every 6 months and PT at least every 12 months for critical and DMZ systems. Reports must cover cloud-hosted systems. | 151, 154 |
| Resilience | DR drills for critical systems at least half-yearly. The DR site must run as primary for at least one full working day, from Beginning of Day to End of Day. | 165, 167 |
| Third parties | Vendor risk assessments. Contracts must give the bank audit rights and RBI inspection rights. ATM switch providers must meet 24 baseline control areas. | 126, 132, 136–138 |
| Software assurance | Vendors certify that applications are free of known vulnerabilities, malware and covert channels. Critical applications need source-code escrow. | 90, 92 |
| Red teaming | Optional ("may conduct"). No set frequency. | 162 |
Concentration risk: cloud, SaaS and the vendor you cannot see into
Both of the Deputy Governor's September speeches came back to third-party dependency. For most banks that dependency now sits in three places:
- Hyperscale cloud, where the bank's control plane, identity and logging depend on one provider's regions and services.
- SaaS and fintech partners, where the bank has contract rights but no infrastructure access.
- Packaged banking software, where the bank relies on the vendor's certification that the code is clean (para 92).
Audit and inspection rights (para 132) only help if the bank knows what to ask for. A vendor's statement that software is "free of known vulnerabilities" is only as good as the vendor's own component inventory. SEBI, by contrast, now expects regulated entities to hold SBOMs for critical systems, including COTS and SaaS (see our SEBI CSCRF briefing). RBI does not require SBOMs yet. Banks that ask for one anyway will be better placed to answer the assurance question when supervisors raise it.
Closing the gaps before the first supervisory review
- Days 0–15 · Governance fixes Confirm the CISO reporting line (para 28.6) and put the quarterly Board review on the calendar. Check that the IT Strategy Committee's composition and chair meet paras 17–18. Record any gaps and decisions in Board minutes.
- Days 15–45 · Reporting drill Run a tabletop exercise from detection to DAKSH submission and CERT-In notice. Measure the elapsed time. Pre-approve the reporting templates, name who submits them, and set out when the six-hour clock starts.
- Days 30–60 · Testing calendar Map every critical and DMZ system, including those hosted in the cloud, to the six-month VA and 12-month PT cycle. Plan the half-yearly DR drill, including the full working day run from the DR site.
- Days 45–90 · Vendor assurance Refresh contracts to include audit and RBI inspection rights. Collect vulnerability-free certifications (para 92) and source-code escrow for critical applications. Ask critical vendors for an SBOM and a VEX process, even though RBI does not require them.
Evidence a supervisor is likely to ask for
- Organisation chart showing the CISO reporting to the risk ED
- Board minutes with quarterly cybersecurity reviews
- CSOC operating model covering L1, L2 and L3, with 24x7 rosters
- VA/PT reports for the last cycle, including cloud-hosted systems
- DR drill reports, including the full working-day run from the DR site
- Incident log with detection and DAKSH submission timestamps
- Vendor risk assessments and contracts with audit clauses
Intellinative runs 24x7 managed security and cloud operations for regulated Indian enterprises. Our AWS Hub & Spoke build for a pan-India financial services organisation shows the centralised routing, private connectivity and single point of control that make evidence like this easier to produce.
Frequently asked questions
When do banks have to comply with RBI's 2026 cybersecurity directions?
Immediately. The commercial-bank directions (RBI/DoS/2026-27/410) took effect on issue, 31 July 2026. There is no transition period.
Who must the CISO report to under the new RBI directions?
The Executive Director, or equivalent, who oversees risk management, not the Head of IT (para 28.6). The CISO must also present a cybersecurity review to the Board at least once a quarter.
How quickly must a bank report a cyber incident to RBI?
Within six hours of detection, on RBI's DAKSH platform. CERT-In must be informed as well (para 182). This runs in parallel with CERT-In's own six-hour reporting direction of April 2022.
How often are VAPT and DR drills required?
Vulnerability assessment at least every six months and penetration testing at least every 12 months for critical and internet-facing systems, including cloud-hosted ones. DR drills are at least half-yearly, and the DR site must run as primary for at least one full working day.
Do the RBI directions require an SBOM?
No. Vendors must certify that applications are free of known vulnerabilities, malware and covert channels, and critical applications need source-code escrow. SEBI's CSCRF, by contrast, does require SBOMs for critical systems.
Do the directions apply to NBFCs?
Yes, through a separate direction (RBI/DoS/2026-27/461, 31 July 2026). Obligations are tiered: base-layer NBFCs below ₹500 crore in assets, base-layer NBFCs at ₹500 crore and above, and middle, upper and top-layer NBFCs.
Sources
- RBI (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 · Reserve Bank of India · 31 Jul 2026
- RBI (NBFCs) Cybersecurity and Technology Risk Directions, 2026 · Reserve Bank of India · 31 Jul 2026
- RBI urges banks to treat technology failures as core risk · Policy Edge · 24 Sep 2026
- Banks well placed to deploy liquidity… RBI Dy Governor Rohit Jain · ANI · 24 Sep 2026
- 10 requirements in area of technology & cyber risk management · FinTech BizNews · 24 Sep 2026
- Emerging technologies in finance: imperatives of purpose, prudence and policy · BIS (speech by Rohit Jain) · 16 Sep 2026
- Lowdown: RBI issues new cybersecurity framework for commercial banks · MediaNama · 3 Aug 2026
- RBI's technology-focused master directions issued on 31 July 2026 · KPMG India · 1 Sep 2026
- Brief: RBI Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions 2026 · DSCI · 6 Aug 2026
- RBI Cybersecurity Directions 2026 — All Seven Explained · BitScore · Updated 23 Sep 2026
- RBI Cybersecurity Framework 2026: What Replaced It · Security Brigade · Updated 9 Aug 2026