IndiaRBI Commercial Banks Cybersecurity Directions, Cybersecurity Policy, Testing and Security Operations Centre
Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions 2026, paras. 15, 149 to 153 and 212 to 216
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a commercial bank, meaning a banking company other than a small finance bank, payments bank or local area bank, a corresponding new bank or the State Bank of India (reached by declaring that you are a bank). A foreign bank operating through branches is bound on a comply-or-explain basis for the chapters and paragraphs paragraph 4 of the Directions lists.
- Put in place a Cybersecurity Policy, approved by your Board, that sets out your strategy to combat cyber threats and is distinct and separate from your broader IT and information security policy (paragraph 15).
- Conduct vulnerability assessment and penetration testing periodically for all critical and internet-facing systems: for critical information systems and systems in the demilitarised zone with a customer interface, vulnerability assessment at least once in every six months and penetration testing at least once in 12 months (paragraphs 149 to 151).
- Fix identified vulnerabilities and their associated risks in a time-bound manner, and keep the fixes in place so that known vulnerabilities do not recur (paragraph 153).
- Put in place a framework for establishing and operating a Cyber Security Operations Centre, commensurate with your technology risk profile, scale and complexity of operations (paragraph 212).
- Make your security-monitoring systems collect logs from deployed systems and network activity, correlate them through SIEM tools, keep SIEM dashboards under continuous monitoring and generate alerts for abnormal activity (paragraph 215).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Reserve Bank of India, which issues these Directions in exercise of the powers conferred by sections 27 and 35-A of the Banking Regulation Act, 1949.
Settledness
- As of
- Open questions
- How far does a bank's technology risk profile, scale and complexity shape the Cyber Security Operations Centre framework that paragraph 212 requires?
What this law does
Paragraph 15 requires a commercial bank to put in place a Cybersecurity Policy, approved by its Board and distinct from its broader IT and information security policy. Paragraph 151 requires vulnerability assessment of critical information systems and systems in the demilitarised zone with a customer interface at least once in every six months, and penetration testing at least once in 12 months.
Paragraph 153 requires a commercial bank to fix identified vulnerabilities and associated risks in a time-bound manner. Paragraph 212 requires a commercial bank to put in place a framework for establishment and operation of a Cyber Security Operations Centre. Paragraph 215 requires the systems for monitoring security operations to enable collection of logs, their correlation through SIEM tools and the generation of alerts. Paragraph 3 applies the Directions to commercial banks.
The Reserve Bank of India issues the Directions in exercise of the powers conferred by Section 27 and Section 35-A of the Banking Regulation Act, 1949. Paragraph 233 makes the interpretation of any provision of the Directions by the Reserve Bank final and binding on all concerned entities. Paragraph 230 repeals the existing directions on Cybersecurity Framework and IT Governance as applicable to commercial banks. Paragraph 2 brings the Directions into effect immediately upon issuance.
When LexLint raises it
When your app profile says your app is a bank.