RBI cyber security and IT governance compliance
VAPT, secure SDLC, third-party risk and crypto controls for banks, NBFCs and payment operators.
Published Last reviewed
On 31 July 2026, RBI's Department of Supervision repealed 628 circulars and replaced them with 64 consolidated Directions, several of them entity-specific "Cybersecurity, Technology: Risk, Resilience and Assurance Framework" Directions covering commercial banks, small finance banks, payments banks, urban co-operative banks, NBFCs, credit information companies and the all-India financial institutions. RBI framed the exercise as a structural consolidation, but the entity-specific cybersecurity instruments carry materially stricter, quantified controls than the rules they replace, including a CISO-independence mandate, a 6-hour DAKSH incident-reporting window, and semi-annual vulnerability assessments. This page has been updated to reflect it, alongside the Master Direction on IT Governance, Risk, Controls and Assurance Practices (RBI/2023-24/107, dated 7 November 2023, effective 1 April 2024), the 2016 Cyber Security Framework in Banks (DBS.CO/CSITE/BC.11/33.01.001/2015-16), and the 2021 Master Direction on Digital Payment Security Controls (RBI/2020-21/74).
Together these directions require board-owned IT policy, vulnerability assessment and penetration testing, a secure SDLC, cryptographic controls, third-party and outsourcing risk management, and incident reporting to RBI and CERT-In within prescribed timelines. This page explains how to meet each requirement and the official RBI sources to cite.
A board-accountable mandate that turns application and supply-chain risk into a supervisory obligation.
The 2023 IT Governance Master Direction consolidated RBI's expectations on technology risk into a single, board-owned framework. It applies to Scheduled Commercial Banks (with limited exclusions), Small Finance Banks, Payments Banks, upper- and middle-layer NBFCs, Credit Information Companies and the all-India financial institutions (EXIM, NABARD, NHB, SIDBI). The board and a board-level IT Strategy Committee carry direct accountability for IT and cyber risk (RBI/2023-24/107).
Application security is now explicit. The Direction requires a secure software development life cycle, rigorous change and project management, vulnerability assessment and penetration testing, cryptographic controls and audit trails. Chapter III adds detailed controls for IT service management, third-party and outsourcing arrangements, and data-migration projects, so dependency and vendor risk is supervised, not optional.
For payment operators, the 2021 Digital Payment Security Controls Master Direction layers on a board-approved policy covering Functionality, Security and Performance, secure development and testing before rollout, and ongoing risk assessment of the technology stack and third-party dependencies. The 2016 Cyber Security Framework continues to mandate VAPT of critical infrastructure, a Security Operations Centre, and incident reporting to RBI and CERT-In within prescribed timelines.
Find it before attackers do. Catch it if they try. Fix it fast.
Across these requirements, O3 runs one continuous loop on your own software so issues surface, get caught, and get fixed before they become an incident.
Test like an AI-assisted attacker
An agentic pentest probes your app across 50+ vulnerability classes the way a real attacker chains them, so exploitable flaws surface in your build before someone outside finds them.
Detect and block exploitation at runtime
A kernel-level eBPF agent watches process trees and syscalls, recognises an attack sequence as it unfolds, and restricts the offending process on the spot rather than taking down the host.
Auto-patch what is reachable
Reachability ranks what genuinely matters, then autofix opens a pull request with the change, so remediation starts inside tight fix windows instead of sitting in a queue.
What changed under RBI's new Cybersecurity Directions, 2026
RBI's 31 July 2026 consolidation replaced entity-specific IT circulars (including the 2017 NBFC IT Framework) with a common "Cybersecurity, Technology: Risk, Resilience and Assurance Framework" Direction, issued separately per entity type and in force immediately on issuance. RBI describes the wider 628-to-64 exercise as a structural, as-is consolidation, but the cybersecurity-specific instruments carry real, quantified controls that go beyond what they replace. Confirm the exact reference number and effective date for your entity type directly on RBI's Master Directions index before treating any control below as settled.
O3's DAST/pentest, SAST and SCA scans run on a schedule that already exceeds semi-annual VA, and reachability-ranked findings give a CISO the evidence trail an independent reporting line needs to defend remediation priorities to the board.
How to establish board-owned IT and cyber security governance
RBI makes the board, not the CISO alone, accountable for technology and cyber risk. The IT Governance Master Direction requires a documented governance structure with clear roles before any control activity is judged adequate.
How to implement a secure SDLC and change management
Both the IT Governance MD and the 2021 payment controls require security to be built into development, not bolted on. Secure SDLC, code review and pre-release testing are named obligations.
O3 runs interprocedural SAST (code-property-graph, source-to-sink taint), SCA against OSV, and secret scanning directly in CI, with autofix and auto-PR so issues are closed inside the SDLC rather than logged for later.
How to meet RBI VAPT and vulnerability management expectations
VAPT of critical infrastructure, applications and networks is a recurring requirement across the 2016 framework, the IT Governance MD and the payment controls. Findings must be tracked to closure with risk-based prioritisation.
O3's agentic DAST/pentest covers 50+ vulnerability classes, while function-level reachability plus EPSS and KEV ranking show which findings are actually exploitable, so banks remediate the few that matter first.
How to manage third-party, outsourcing and dependency risk
Chapter III of the IT Governance MD and the DPSC 2021 both require ongoing risk assessment of vendors, outsourced services and the wider technology stack, including open-source dependencies.
O3 produces a CycloneDX SBOM (with deps.dev and VEX enrichment) and runs malicious-dependency detection for typosquats, malicious post-install scripts and compromised maintainers, giving auditable evidence of third-party software risk.
How to implement and inventory cryptographic controls
The IT Governance MD requires cryptographic controls for data in transit and at rest, and the payment controls require strong cryptography for digital payment channels. Knowing what crypto you run is the first step.
O3 generates a Cryptographic Bill of Materials (CBOM) and a quantum readiness QBOM in CycloneDX, surfacing weak or deprecated algorithms in code and giving banks an evidence base for crypto-agility planning. Key management itself stays a bank responsibility.
How to run monitoring and report incidents to RBI and CERT-In
A Security Operations Centre, continuous monitoring, and timely incident reporting are mandatory. CERT-In's 28 April 2022 Directions impose a 6-hour reporting window that banks must hit alongside RBI reporting.
O3's eBPF runtime agent (kayo) builds kernel process trees and detects attack chains with per-PID enforcement, and its L7 deep packet inspection (ecapture) flags exfiltration and DNS-tunnelling, surfacing incidents fast enough to meet the 6-hour CERT-In window. Full SIEM/SOC tooling remains separate.
How to satisfy IS audit and assurance practices
The IT Governance MD's assurance pillar requires periodic, independent information systems audit and continuous control testing, with results escalated to the board and available to RBI.
O3 produces machine-readable evidence (SBOM/CBOM, reachability-ranked findings, scan and fix history) that maps cleanly into IS-audit and RBI inspection workpapers.
Every RBI requirement mapped to a practical, vendor-neutral way to meet it.
All 24 requirement areas, each with the reference and a vendor-neutral note on how teams meet it.
| Requirement area | Ref | How teams meet it |
|---|---|---|
| CISO independence from IT operations | Cybersecurity Directions, 2026 (31 Jul) | Separate CISO reporting line from IT ops |
| 6-hour DAKSH incident reporting | Cybersecurity Directions, 2026 (31 Jul) | Report reportable incidents via DAKSH within 6h |
| MFA for privileged users | Cybersecurity Directions, 2026 (31 Jul) | Explicit MFA mandate for all privileged access |
| Semi-annual vulnerability assessment | Cybersecurity Directions, 2026 (31 Jul) | VA every 6 months, annual pentest of critical systems |
| Board-level IT governance structure | IT Gov MD, Ch. II | IT Strategy & Steering Committees, CISO mandate |
| Board-approved IT & cyber security policy | IT Gov MD, Ch. II | Annual policy with risk appetite and roles |
| IT and digital asset inventory | IT Gov MD, Ch. II | Maintain current asset and risk register |
| Secure SDLC | IT Gov MD, Ch. III | Security gates, code review, SAST/SCA in CI |
| Change & project management | IT Gov MD, Ch. III | Formal change control, segregation of duties |
| Vulnerability Assessment & Penetration Testing | 2016 Framework; IT Gov MD | Annual VAPT of critical and internet-facing systems |
| Risk-based vulnerability prioritisation | IT Gov MD, Ch. III | Rank by exploitability, track to closure |
| Cryptographic controls | IT Gov MD, Ch. III | Approved algorithms, key lifecycle, crypto inventory |
| Audit trails & logging | IT Gov MD; CERT-In Directions | Tamper-evident logs, 180-day India retention |
| Third-party & outsourcing risk | IT Gov MD, Ch. III | Vendor due diligence, contracts, exit plans |
| Technology-stack & dependency risk | DPSC 2021 | Ongoing SBOM and dependency assessment |
| Security Operations Centre & monitoring | 2016 Framework, SOC Annex | Real-time monitoring and log correlation |
| Cyber incident response & recovery | IT Gov MD; 2016 Framework | Runbooks, BCP/DR, post-incident review |
| Incident reporting to RBI | 2016 Framework | Report within RBI prescribed timelines |
| CERT-In 6-hour incident reporting | CERT-In Directions, 28 Apr 2022 | Notify CERT-In within 6 hours of detection |
| Functionality-Security-Performance policy | DPSC 2021 | Board-approved policy for payment operators |
| Secure development & testing before rollout | DPSC 2021 | Pre-release security testing of payment apps |
| Digital payment app & API security | DPSC 2021 | App hardening, authentication, fraud controls |
| Information Systems (IS) audit | IT Gov MD (Assurance) | Annual independent audit, board oversight |
| Data-migration project controls | IT Gov MD, Ch. III | Integrity, validation and rollback controls |
Turn RBI VAPT, secure SDLC and third-party risk into evidence
O3 Security helps banks, NBFCs and payment operators meet the technical core of RBI's directions: SAST, SCA and reachability for secure SDLC and VAPT, SBOM and malicious-dependency detection for third-party risk, CBOM for cryptographic controls, and eBPF runtime and L7 monitoring to surface incidents inside the CERT-In 6-hour window. Governance, IAM and full SOC stay yours; O3 generates the audit-ready evidence.
Read it on rbi.org.inSee O3 Security in Action
See why security and engineering leaders trust O3
to secure their entire software supply chain.