IndiaRBI Commercial Banks Cybersecurity Directions, Cyber Incident Reporting
Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions 2026, paras. 181 to 183
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds a commercial bank, meaning a banking company other than a small finance bank, payments bank or local area bank, a corresponding new bank or the State Bank of India (reached by declaring that you are a bank). A foreign bank operating through branches is bound on a comply-or-explain basis for the chapters and paragraphs paragraph 4 of the Directions lists.
- Report cyber incidents to the Reserve Bank within six hours of detection on its DAKSH platform (paragraph 182).
- Notify CERT-In proactively about cyber incidents (paragraph 182); the Directions state no clock for that notice.
- Keep clear communication plans for escalating incidents and reporting them to your Board and Senior Management and to customers, as required (paragraph 183).
- Analyse cyber incidents, including through forensic analysis where necessary, for severity, impact and root cause, and take corrective and preventive measures to mitigate their adverse impact on business operations (paragraph 181).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Reserve Bank of India, which issues these Directions in exercise of the powers conferred by sections 27 and 35-A of the Banking Regulation Act, 1949.
Settledness
- As of
- Open questions
- What counts as detection of a cyber incident for the six-hour clock in paragraph 182, given that the Directions define a cyber incident as a cyber event that adversely affects the cybersecurity of an information asset?
What this law does
Paragraph 182 requires a commercial bank to report cyber incidents within six hours of detection on the DAKSH platform, the Reserve Bank's Advanced Supervisory Monitoring System, and to notify CERT-In proactively about cyber incidents. Paragraph 183 requires a commercial bank to have clear communication plans for escalation and reporting of incidents to the Board and Senior Management and to customers, as required.
Paragraph 181 requires a commercial bank to analyse cyber incidents for their severity, impact and root cause, and to take corrective and preventive measures. Paragraph 3 applies the Directions to commercial banks. The Reserve Bank of India issues the Directions in exercise of the powers conferred by Section 27 and Section 35-A of the Banking Regulation Act, 1949.
Paragraph 233 makes the interpretation of any provision of the Directions by the Reserve Bank final and binding on all concerned entities. Paragraph 2 brings the Directions into effect immediately upon issuance.
When LexLint raises it
When your app profile says your app is a bank.