RBI Cybersecurity Framework Compliance for Banks, NBFCs, and Cooperative Banks

Every RBI-regulated entity is covered, but not by the same instrument and not to the same depth. The six Directions issued on 31 July 2026 split by entity type: commercial banks, small finance banks, payments banks, urban co-operative banks, NBFCs and credit information companies each have their own. Within them the obligations are tiered. NBFCs are scoped by Scale Based Regulation layer - a Base Layer NBFC below Rs 500 crore carries Chapter III only, while Middle Layer and above carry the full baseline. UCBs are graded into four levels by digital depth and payment-system interconnectedness, so a small co-operative bank with UPI membership sits higher than its size suggests. Local area banks received no cybersecurity Direction in this batch. Payment aggregators and prepaid instrument issuers remain under their own Master Directions, which were not part of this consolidation.

Yes - and under the 2026 Directions there is now a documented reason to insist on it. CERT-In empanelment is required by name for the payment aggregator system audit under the PA-PG Master Direction and for the data-localisation System Audit Report, and SEBI CSCRF requires it as well. Within the RBI (Commercial Banks) Directions, 2026, para 156 requires the bank to assess the qualification, professional expertise, credentials and competency of the testing firm and of the personnel it assigns, at every selection, appointment, engagement and renewal - and empanelment is how that is evidenced. Para 159 then provides that where a CERT-In empanelled auditor is engaged, the bank is guided by CERT-In’s Comprehensive Cyber Security Audit Policy Guidelines, which brings a defined audit-policy regime into the supervisory relationship. Security Brigade has been CERT-In empanelled continuously since 2008.

The RBI cybersecurity audit focuses specifically on cybersecurity controls — VAPT, SOC, incident response, threat management, and cyber resilience. The IS (Information Systems) audit is broader, covering IT governance, application controls, general computing controls, data integrity, and IT risk management. Most RBI-regulated entities require both, and Security Brigade delivers them as a combined engagement to reduce duplication and cost.

For critical information systems and those in the DMZ with a customer interface, the RBI Directions, 2026 require vulnerability assessment at least once every six months and penetration testing at least once in 12 months (para 151). Non-critical systems follow a risk-based approach the entity defines and defends. Testing also runs across the lifecycle - pre-implementation, post-implementation and after changes (para 150) - and is performed on the production environment, with any test-environment deviation documented and approved by the Information Security Committee (para 152). The status of closure of VA/PT observations goes to both the IT Strategy Committee and the Information Security Committee at least quarterly (para 161). On IS audit, the Directions require an IS Audit Policy approved by the Audit Committee of the Board and reviewed at least annually, with risk-based audit planning (paras 225, 228), rather than prescribing a fixed audit frequency. For payment aggregators, the PA Master Direction separately requires an annual system audit including cybersecurity audit. "Annual VAPT" understates the vulnerability assessment leg by a factor of two.

RBI can impose monetary penalties, mandate corrective action plans, restrict business operations, suspend new product launches, and in severe cases direct board-level changes or supersede the board of cooperative banks. Penalties vary by entity type and severity of non-compliance. Beyond regulatory penalties, non-compliant entities face amplified scrutiny during cybersecurity incidents, which can result in additional regulatory action and reputational damage.

Yes, but by layer rather than uniformly. The RBI (NBFC) Directions, 2026 apply Chapter III to Base Layer NBFCs below Rs 500 crore in asset size and to Core Investment Companies, Chapter IV to Base Layer NBFCs at Rs 500 crore and above, and Chapter V to Middle Layer, Upper Layer and Top Layer NBFCs excluding Core Investment Companies. The VA/PT cadence and six-hour incident reporting sit in the Middle Layer and above tier. Housing finance companies report incidents to NHB rather than RBI. Fintechs operating under an NBFC licence are scoped by their layer; those operating under a payment aggregator licence remain under the PA-PG Master Direction, which was not part of this consolidation and which does require an annual system audit by a CERT-In empanelled auditor.

It depends on the bank’s level. The RBI (UCB) Directions, 2026 grade every UCB into one of four levels by digital depth and interconnectedness to the payment systems landscape rather than by asset size. Level I - every UCB, whatever it offers - carries board-approved policies and IT governance. Level II adds the baseline for UCBs that are CPS sub-members offering internet banking, a mobile banking app, or direct CTS, IMPS or UPI membership. Level III adds requirements for direct CPS members and banks running their own ATM switch or SWIFT. Level IV carries the full baseline including a Cyber Security Operations Centre. Across the applicable levels an audit covers board-approved cybersecurity policy, designated security leadership, VA/PT of core banking and digital channels, access controls, network security, log management, incident response and DAKSH reporting, BCP/DR, and vendor risk - including the contractual controls a UCB must impose on its ATM switch provider and the VA/PT it must obtain through a shared core banking provider (para 117).

A typical RBI cybersecurity compliance engagement takes 6 to 8 weeks from scoping to final report delivery. This includes regulatory mapping, policy review, technical assessment (VAPT and IS audit), controls validation, gap assessment, remediation support, and final regulator-ready reporting. Timelines can vary based on entity size, number of applications in scope, and remediation requirements. Security Brigade tracks every milestone through the Lemon platform for full transparency.

Yes, Security Brigade delivers VAPT and IS audit as a combined engagement for RBI-regulated entities. This integrated approach eliminates duplication, reduces coordination overhead, and produces a single coherent report that covers both cybersecurity testing and information systems governance. Most of our banking and NBFC clients prefer the combined engagement because it simplifies vendor management and accelerates compliance timelines.

Security Brigade combines genuine cybersecurity depth with compliance expertise — we validate real systems including applications, APIs, infrastructure, and databases, not just review documents. Our CERT-In empanelment since 2008, proprietary platforms (Lemon for audit management, B-52 for AI-powered testing), and deep BFSI experience across 1,000+ clients means you get a regulator-ready report backed by real technical validation, with faster remediation support and senior attention that larger firms cannot match.