RBI's 2026 Cybersecurity Directions: What Changed for VAPT, the SOC and 6-Hour Reporting

India BFSI Regulation

On 31 July 2026 the Reserve Bank of India replaced its cyber security and IT governance instructions with a new family of Directions, one for each class of regulated entity, and they took effect the same day. Here is what applies to commercial banks and NBFCs, what changes in your testing and drill calendar, how the six-hour reporting rule now works, and a 90-day plan for getting your documents to match.

What RBI issued on 31 July 2026

For a decade RBI's technology expectations lived in a stack of instruments: the 2016 Cyber Security Framework in Banks, the 2023 Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, and a long tail of circulars and advisories layered on top. Anyone who has tried to map a bank's controls to "the RBI requirement" knows the problem. There was no single document to map to.

The July 2026 package changes the architecture. Instead of one framework stretched across very different institutions, RBI issued a separate set of Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions for each class of regulated entity, alongside a companion set of Digital Payment Security Controls Directions issued the same day. The commercial bank Direction, for example, covers the full stack in one place: board oversight, IT governance, the CISO, IT and cyber risk management, baseline controls, the security operations centre, vulnerability assessment and penetration testing, business continuity and DR, incident response and reporting, and information systems audit.

Two things about the package matter more than any single control. First, it took effect immediately. The commercial bank Direction says it comes into effect "immediately upon issuance", and the NBFC Direction is effective 31 July 2026 "with immediate effect". There is no glide path. Second, each Direction repeals what came before for its entity class, which means the documents most banks and NBFCs use to evidence compliance are now pointing at the wrong instruments.

Which Direction applies to you

Seven entity classes received their own Direction in this family. Read the one addressed to you, not a summary of another class's: the chapter structure, thresholds and some obligations differ.

If you are a payment aggregator, a prepaid instrument issuer or another non-bank payment system operator, you are not one of the seven classes above. Your obligations sit in the instructions addressed to payment system participants, and the companion Digital Payment Security Controls Directions are the place to check how this package touches you.

For NBFCs the layering is the first thing to settle. Some obligations, including the VAPT cadence quoted below, sit in the provisions for middle layer and above. A base layer NBFC should read its own chapter rather than assume the heavier obligations apply, and should equally not assume they do not.

What was repealed, and why your policy pack is now out of date

The commercial bank notification states that "existing Directions, instructions, and guidelines relating to Cybersecurity Framework and IT Governance as applicable to Commercial Banks stand repealed", by circular DoS.CO.PPG.66/11.01.005/2026-27 of the same date. The NBFC Direction does the same for "existing directions, instructions, and guidelines relating to Information Technology Framework and IT Governance as applicable to Non-Banking Financial Companies" at paragraph 155.

That language is broad enough to reach both the 2016 framework and the 2023 Master Direction for the entity classes the new Directions address. The repeal circular is the document that lists exactly what went, and it is worth reading line by line rather than assuming, because some specific circulars on adjacent topics may survive.

The practical consequence is immediate. Your information security policy, your board-approved cyber policy, your VAPT procedure, your incident response plan, your outsourcing policy and your IS audit plan almost certainly cite the old instruments by name and paragraph. An inspection that asks how a control maps to the regulation will now be asking about the 2026 paragraph numbers. Remapping is not cosmetic: in several places the new text is more specific than the old, and in some it is different.

The requirements that change your calendar

Most of the new Directions restate, consolidate and sharpen familiar expectations. A handful of provisions set a frequency or a deadline, and those are the ones that change what your team does every quarter.

Paragraph numbers are from the Directions as issued. NBFC obligations are layered, so confirm which of the NBFC provisions above sit in the chapter for your layer. Where a cell says to read your chapter, we have not quoted the NBFC wording here; check the text addressed to your layer rather than borrowing the commercial bank wording.

Six-monthly VA and annual PT: the scoping questions that matter

"At least once every six months" and "at least once in 12 months" are easy to schedule. The work is in deciding which systems they apply to, because the cadence attaches to two categories: critical information systems, and systems in the DMZ having a customer interface. Everything else is on a risk-based frequency that you define and must be able to defend.

In practice the six-monthly cycle works best when the annual penetration test is split by surface rather than done once as a single large engagement: internet banking and the APIs behind it in one half, the mobile application and external network perimeter in the other, with vulnerability assessment running across everything in both halves. It spreads the remediation load and gives the board two data points a year instead of one.

Six hours on DAKSH, and CERT-In alongside

For commercial banks, paragraph 182 is specific: cyber incidents are reported "within six hours of detection on DAKSH platform", RBI's supervisory monitoring system, and the bank "shall also pro-actively notify CERT-In". For NBFCs, paragraph 141 sets the same six hours for reporting to RBI. Separately, CERT-In's own directions of April 2022 already require a defined list of incident types to be reported to CERT-In within six hours of noticing them, and that obligation applies to every Indian entity regardless of who regulates it.

So a bank now has two six-hour clocks running from the same event, to two recipients, through two channels. Neither is a replacement for the other. The six hours are short enough that the report has to be an early notification filed with what you know, then updated, which means the decisions about whether something is reportable and who files it have to be made in advance.

• Name the reporters. Who files on DAKSH and who notifies CERT-In, with deputies for nights, weekends and holidays. Test their credentials before you need them.
• Define "detection". The clock starts at detection, so your runbook needs a clear rule for the moment an alert becomes a detected incident. If that moment is not defined, it will be argued about after the fact.
• Keep a pre-filled template. Entity details, contacts and system inventory references filled in already, so the first report is about the incident and nothing else.
• Exercise it. A tabletop exercise that runs the clock from first alert to both submissions finds the gaps cheaply. Paragraph 188's expectation that banks join CERT-In and IDRBT drills is a good forcing function for the same rehearsal.

Our earlier guide to CERT-In's six-hour reporting rule covers the CERT-In side in detail, including which incident types are reportable.

The CSOC and the CISO

Commercial banks must "set up a CSOC to ensure continuous surveillance and keep itself regularly updated on the latest nature of emerging cyber threats" (paragraph 143), and the Direction carries a separate chapter of minimum baseline guidance on how the CSOC should operate. For NBFCs, paragraph 82(4) places the management and monitoring of the SOC with the CISO's office. The paragraphs quoted here do not, by themselves, say the SOC must be staffed entirely in-house; read the CSOC chapter and your outsourcing obligations together before deciding how to deliver it, and remember that if a provider runs part of it, overseeing that provider is still your job.

The CISO provisions for commercial banks settle a long-running argument. The CISO is a senior executive, preferably at General Manager rank or equivalent, with no direct reporting relationship with the head of IT (paragraph 27), and reports directly to the executive director or equivalent overseeing risk management (paragraph 28(6)). If your organisation chart still has the CISO inside the technology function, it is now out of line with the text.

If you are deciding between building, co-managing or outsourcing the monitoring function, our comparison of managed and in-house SOC models sets out the trade-offs, and a SOC maturity assessment against the CSOC chapter is the fastest way to find out how far your current operation is from the baseline.

DR drills that count

Half-yearly DR drills for critical information systems are a frequency. Paragraph 167 for commercial banks sets the standard: the drill involves switching over to the DR or alternate site and using it as the primary site for a sufficiently long period, covering at least a full working day of normal operations from beginning of day to end of day.

That is a much higher bar than a weekend failover test that proves the DR site starts. A full business day on the DR site exercises batch jobs, interfaces to payment systems and partners, reconciliations and the people who run them. It also exposes the difference between the recovery time you have written down and the one you can actually achieve. Two things are worth doing before the first drill under the new text:

• Revisit recovery objectives with the business. Recovery time and recovery point objectives set years ago are often set for infrastructure failure. Check them against a scenario where the primary site is unavailable because of a cyber attack, not a power cut. A business impact analysis is the structured way to do it.
• Include the cyber scenario in the plan. Ransomware does not fail over cleanly: replication will happily copy encrypted data to the DR site. The continuity plan needs a path for recovering from known-clean backups, not only for switching sites. Our ransomware defence playbook covers the recovery side.

A 90-day plan

The Directions took effect on issue, so the honest position for most regulated entities is that there is already a gap between the text and the documents. This is the order we would close it in.

Frequently Asked Questions

Click any question to expand the answer.

Related reading

Our earlier articles describe the instruments these Directions replaced, and remain useful background on how RBI's expectations developed: the 2023 Master Direction on IT governance, RBI's SOC expectations for banks and NBFCs and a beginner's guide to RBI cyber requirements. Read them for context, and this article for what applies now.

For the parallel regime in capital markets, see our guide to SEBI's Cybersecurity and Cyber Resilience Framework.

About Adayptus

Adayptus Consulting Private Limited is a cybersecurity consultancy based in Noida, India. We work with banks, NBFCs and fintechs on RBI and SEBI cyber compliance, the testing that evidences it, and the security operations that keep it true between audits.

What we can do for you:

• A gap assessment against the 2026 Direction that applies to you. Control by control, mapped to the new paragraph numbers, with the policy pack updated so it cites the instruments that are actually in force. Part of our BFSI security practice.
• The VAPT calendar the Directions describe. Manual web, API, mobile and network testing scheduled across the six-monthly cycle, with every finding reproduced by hand and a remediation retest included.
• The CSOC and the clocks. Managed or co-managed SOC operations, a six-hour reporting runbook, and a tabletop exercise that rehearses it, plus the cyber metrics the board will now expect to see.

Sources