RBI's 2026 Cybersecurity Directions for NBFCs: What Applies to Your Layer, and the Six-Hour Clock
RBI's 2026 cybersecurity directions for NBFCs apply from the day they were issued, scale their demands by regulatory layer, and start a six-hour clock on incident reporting. What each layer must have in place, what changed from the 2017 framework, and a 90-day plan for closing the gaps.
Regulatory Compliance
On 31 July 2026 the Reserve Bank of India replaced the 2017 IT framework for NBFCs with a new set of cybersecurity directions that took effect the same day. They apply to every NBFC, including housing finance companies, but they do not ask the same of everyone: the directions are split into chapters by regulatory layer and asset size, so a small base layer lender and an upper layer company read different rulebooks. What every layer has in common is a six-hour clock for reporting cyber incidents to RBI. Here is how to find your chapter, what it requires, what changed, and how to close the gaps in 90 days.
In short. The Reserve Bank of India (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 came into force with immediate effect on 31 July 2026 and repealed the earlier IT framework and IT governance instructions for NBFCs. Base layer NBFCs below ₹500 crore and core investment companies follow Chapter III, a short list of basics. Base layer NBFCs at ₹500 crore and above follow Chapter IV, which adds an IT strategy committee, a cybersecurity policy, a crisis management plan, training, outsourcing controls and six-hour incident reporting on DAKSH. Middle, upper and top layer NBFCs follow Chapter V, the full set: a CISO reporting outside IT, a SOC run from the CISO's office, vulnerability assessment every six months and penetration testing every twelve, half-yearly DR drills with near-zero data loss targets, and notification of CERT-In as well as RBI. There is no transition period.
What the directions are, and who they cover
The instrument is RBI/DoS/2026-27/461, issued by the Department of Supervision on 31 July 2026, the same day RBI issued parallel directions for commercial banks, all-India financial institutions and other classes of regulated entity. Paragraph 2 says it plainly: "These Directions shall come into force with immediate effect." Paragraph 3(1) applies them to all non-banking financial companies registered under the RBI Act, the Factoring Regulation Act and the National Housing Bank Act, which brings housing finance companies inside.
Paragraph 155 repeals "the existing directions, instructions, and guidelines relating to Information Technology Framework and IT Governance as applicable to NBFCs", with a saving clause for anything done under them. In practice that means the Master Direction on the Information Technology Framework for the NBFC Sector of June 2017, which already had a ₹500 crore split, and the November 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices as it applied to the middle, upper and top layers from April 2024. If your policies still cite those documents, they are citing repealed instruments.
Two companion points. The same day, RBI issued separate Digital Payment Security Controls Directions, 2026 (RBI/DoS/2026-27/462), which apply only to credit-card-issuing NBFCs. And our earlier article on the 2026 directions for commercial banks and NBFCs covers the family as a whole; this one goes clause by clause through the NBFC text.
Find your chapter
The directions use RBI's scale-based regulation layers, with one asset-size cut inside the base layer. Everything else in this article depends on which row you are in.
| You are | Chapter | What it adds |
|---|---|---|
| Base layer NBFC with assets below ₹500 crore, or a core investment company | Chapter III | Board-approved IT and information security policy, basic cybersecurity controls, backups with periodic testing |
| Base layer NBFC with assets of ₹500 crore and above | Chapter IV | IT strategy committee, information security function separate from IT, cybersecurity policy, cyber crisis management plan, vulnerability management, training, outsourcing controls, six-hour incident reporting on DAKSH, annual BCP testing |
| Middle, upper or top layer NBFC (excluding core investment companies) | Chapter V | Everything in Chapter IV at a higher standard, plus a CISO, a SOC, defined VA and PT frequencies, half-yearly DR drills, RTO and RPO targets, privileged access controls, CERT-In notification and more |
Chapters I and II apply to everyone: Chapter II sets the board's role, and paragraph 6 requires the board to approve the strategies and policies for technology and cybersecurity and review them at least once a year. A board that has not seen a cybersecurity policy since the directions were issued has a gap regardless of layer.
Chapter III: the basics for smaller NBFCs
Chapter III is short by design. It asks for a board-approved IT and information security policy, "robust information security and cybersecurity controls" in paragraph 8(4), and backups "with periodic testing" in paragraph 8(9). It does not set testing frequencies, name a CISO or require a SOC. That is a floor, not a recommendation to stop there: the attackers described in CERT-In's recent advisories on payment API abuse have targeted small lenders precisely because their controls are thinner, and a ₹400 crore NBFC with a disbursement API has the same exposure as a larger one. Our analysis of the Crafty Falcon advisory explains what that exposure looks like.
Chapter IV: base layer at ₹500 crore and above
| Requirement | Paragraph | What the direction says |
|---|---|---|
| IT strategy committee | 15 | Chaired by an independent director, with the CIO or CTO as members; "not more than six months should elapse between two meetings" |
| Information security function | 21(2) | "Adequately resourced" and separate from the IT function; no CISO is mandated at this layer |
| Cybersecurity policy | 22 | Board-approved and distinct from the IT policy |
| Vulnerability management | 23 | A vulnerability management process; no fixed VA or PT frequency is set at this layer |
| Cyber crisis management plan | 25 | Covering detection, response, recovery and containment |
| Incident reporting | 28 | Report cyber incidents to RBI "within six hours of detection on DAKSH platform" |
| Board awareness and training | 29, 35, 36 | A "robust, ongoing information security training and awareness program for all users", with effectiveness tracked |
| Customer-facing apps | 33, 34 | Safeguard information assets used by mobile applications, with end-to-end encryption; watch for impersonation on social media |
| Business continuity | 59(4) | BCP tested at least annually |
| Outsourcing | 60–64 | Risk assessment, written contracts with audit and RBI access rights, board responsibility, continuity planning |
Chapter V: the full set for middle layer and above
Chapter V is where most of the supervisory attention will fall, and where the gaps are usually largest. Grouped by theme:
Governance and the CISO
- IT strategy committee (paragraphs 70–72). At least three directors including the chair, an independent chair with substantial IT expertise, meeting quarterly.
- CISO (paragraphs 81–82). A senior executive who "shall not have any direct reporting relationship with the Head of IT Function" and carries no business targets. The CISO "shall directly report to the Executive Director or equivalent executive overseeing the risk management function", presents a cyber risk review to the board, risk committee or IT strategy committee every quarter, and, under 82(4), "shall manage and monitor Security Operations Centre (SOC) and drive cybersecurity related projects." Many NBFCs have a CISO who reports to the CTO; that structure no longer complies.
- Policies (paragraphs 83–84). An information security policy, and separately "a Cybersecurity Policy and a Cyber Crisis Management Plan (CCMP)".
Testing
- Frequencies (paragraph 121). For critical information systems and systems in the demilitarised zone with a customer interface, "vulnerability assessment (VA) at least once in every six months" and "penetration testing (PT) at least once in 12 months", with testing through the system lifecycle.
- Who tests (paragraph 122). Independent, trained testers. The NBFC directions do not require CERT-In empanelled auditors; some other instruments do, and our guide to testing frequency across regulators sets out which.
- Where and when (paragraphs 123–126). Risk-based testing for non-critical systems, penetration testing in production after upgrades, time-bound fixes, and a documented approach that "shall also apply to the NBFC's information systems hosted in a cloud environment." Cloud penetration testing is in scope, not an optional extra.
Access, logging and third parties
- Privileged access (paragraph 115). Multi-factor authentication for privileged users.
- Logging and monitoring (paragraphs 109–111). Audit logging and monitoring across systems. The directions do not set a retention period; CERT-In's 2022 directions, which apply in parallel, require logs to be kept for a rolling 180 days within India.
- Vendors and software (paragraphs 104–106, 117). Source code escrow for critical applications, written vendor confirmation that applications are free of known vulnerabilities and covert channels, and risk assessment of IT and cyber third-party arrangements that sit outside the separate outsourcing directions.
Resilience and recovery
- DR drills (paragraph 129). For critical systems, "at least on a half-yearly basis", and under paragraph 131 with the DR site running as primary for a full working day.
- Recovery targets (paragraphs 133–136). Backups restored periodically, "minimal RTO (as approved by the ITSC) and a near zero RPO for critical information systems", with reconciliation where the RPO is not zero. Our guide to setting RTO and RPO you can meet after ransomware is the practical companion to this clause.
- Crisis communication (paragraph 146). Periodic drills with stakeholders including service providers, and lessons captured from incidents, tests and drills.
Incident reporting
Paragraph 141 carries the same six-hour DAKSH requirement as Chapter IV and adds that the NBFC "shall also pro-actively notify Indian Computer Emergency Response Team (CERT-In) regarding cyber incidents", with housing finance companies also reporting to the National Housing Bank. DAKSH is RBI's supervisory platform, launched in October 2022 for inspection workflow and incident reporting; the 2026 directions are the first instrument to write the six-hour cyber incident clock into it for NBFCs. Note that CERT-In's own directions already required reporting within six hours of noticing an incident, so a Chapter V NBFC has two six-hour clocks running from slightly different start points: detection for RBI, noticing for CERT-In. Our guide to CERT-In six-hour reporting covers the second.
What the NBFC directions do not say
It helps to know where the NBFC text is lighter than the commercial bank version, because consultants and vendors sometimes read the bank requirements across.
| Topic | Commercial banks (RBI/DoS/2026-27/410) | NBFCs (RBI/DoS/2026-27/461) |
|---|---|---|
| SOC | A full cyber SOC chapter: round-the-clock Level 1 monitoring, in-house or managed | One clause: the CISO's office manages and monitors the SOC. No 24x7 wording, no in-house versus outsourced rule |
| Red teaming | "The bank may conduct red teaming exercises" | Not mentioned |
| Cyber drills | Participate periodically in CERT-In and IDRBT drills | Crisis communication drills only; a reference to IDRBT's IB-CART sharing platform |
| Tiering | None; all commercial banks | Three chapters by layer and asset size |
| VA and PT, DR drills, RPO, CISO reporting line, six-hour DAKSH | Same | Same, for Chapter V |
| Log retention, data localisation, API security | Not specified in these directions | Not specified; localisation sits in the digital lending directions, log retention in CERT-In's |
The absence of a 24x7 clause does not make round-the-clock monitoring optional in practice. The attacks CERT-In is reporting against NBFCs are timed for weekends and holidays, and a SOC that is "managed and monitored" by the CISO's office but staffed only in office hours will not see them. A co-managed SOC is the usual answer for a middle layer NBFC that cannot staff three shifts.
The other directions you have to read alongside
- Outsourcing. The Reserve Bank of India (NBFC – Managing Risks in Outsourcing) Directions, 2025, issued on 28 November 2025, replaced the earlier outsourcing instruments for NBFCs. Their IT outsourcing chapter applies to the middle layer and above, and existing IT agreements had to comply at renewal or by 10 April 2026, whichever came first. Our guide to third-party cyber risk covers what to put in those contracts.
- Digital lending. The Digital Lending Directions, 2025 of 8 May 2025 require that lending app data "is stored only in servers located within India", that no biometric data is stored, that apps do not access contacts, call logs or media, and that the NBFC is "fully responsible and liable for all acts and omissions" of its lending service providers.
- Card issuers. Credit-card-issuing NBFCs also follow the Digital Payment Security Controls Directions, 2026.
- CERT-In. The April 2022 directions apply to every NBFC regardless of layer: six-hour reporting, 180-day log retention within India, and synchronised clocks.
- DPDP. The main obligations of the Digital Personal Data Protection Rules commence in May 2027, including breach notification to the Data Protection Board; see our 180-day DPDP readiness plan.
Where NBFCs usually fall short
From assessments of NBFCs and fintechs against the 2023 and now the 2026 instruments, the same gaps recur:
- A CISO who reports into technology, or a CISO title held by the head of IT.
- Penetration testing done once, before launch, and never after the upgrades that followed.
- Cloud environments excluded from the VA and PT scope on the assumption that the provider covers them.
- DR drills that restore a database but never run the business from the DR site for a working day.
- A six-hour reporting process that exists on paper but has no named person, no DAKSH login tested and no template.
- Lending service providers and API partners with production access but no contract clause on incident notification.
- Test environments that are reachable from the internet and share credentials with production, which is exactly the entry route in CERT-In's current advisories.
A 90-day plan
Days 1–30 — Know your chapter and your gaps
Confirm your layer and asset size, map every paragraph of your chapter to an owner and to evidence, and record the gaps. Fix the two that need no budget: the CISO reporting line and the board's approval of the cybersecurity policy. Set up and test DAKSH access and write the six-hour reporting playbook, including the CERT-In notification.
Days 31–60 — Test and monitor
Run the vulnerability assessment and penetration test on critical and customer-facing systems, including cloud, and put the findings on a time-bound closure plan. Decide how the SOC will be staffed outside office hours. Enforce MFA for privileged users and remove shared credentials between environments.
Days 61–90 — Prove recovery and fix the contracts
Run a DR drill with the DR site as primary, measure actual RTO and RPO against the targets the IT strategy committee approved, and run a crisis communication exercise. Review vendor and lending service provider contracts against the outsourcing directions and add incident notification clauses. Present the first quarterly cyber risk review to the board.
Frequently Asked Questions
Click any question to expand the answer.
QWhat are RBI's 2026 cybersecurity directions for NBFCs?
The Reserve Bank of India (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, reference RBI/DoS/2026-27/461, issued on 31 July 2026 with immediate effect. They replace the 2017 IT framework and the IT governance instructions for NBFCs and set cybersecurity, technology risk and resilience requirements by regulatory layer.
QWhich NBFCs do the directions apply to?
All NBFCs registered under the RBI Act, the Factoring Regulation Act and the National Housing Bank Act, which includes housing finance companies. The requirements differ by chapter: Chapter III for base layer NBFCs below ₹500 crore and core investment companies, Chapter IV for base layer NBFCs at ₹500 crore and above, and Chapter V for the middle, upper and top layers.
QIs there a transition period?
No. Paragraph 2 says the directions come into force with immediate effect, and there are no phased compliance dates. The only timings are the periodic ones inside the text, such as six-monthly vulnerability assessment and annual penetration testing.
QWhat is the six-hour reporting requirement?
Chapter IV and Chapter V NBFCs must report cyber incidents to RBI within six hours of detection on the DAKSH platform. Chapter V NBFCs must also proactively notify CERT-In, and housing finance companies report to the National Housing Bank as well. CERT-In's own 2022 directions separately require reporting within six hours of noticing an incident, for every NBFC.
QDoes every NBFC need a CISO?
A CISO is required for the middle layer and above under Chapter V: a senior executive with no direct reporting relationship to the head of IT, reporting to the executive director or equivalent overseeing risk management. Chapter IV requires an information security function that is adequately resourced and separate from IT, but does not mandate a CISO. Chapter III does not require either.
QHow often must NBFCs do vulnerability assessment and penetration testing?
For the middle layer and above, vulnerability assessment at least once every six months and penetration testing at least once in 12 months for critical systems and customer-facing systems in the DMZ, with testing through the lifecycle, after upgrades, and including cloud-hosted systems. Chapter IV requires a vulnerability management process without a fixed frequency; Chapter III sets none.
QDo the directions require a 24x7 SOC?
The NBFC text says only that the CISO's office shall manage and monitor the Security Operations Centre; it has no round-the-clock wording and no rule on in-house versus managed SOCs, unlike the commercial bank directions. In practice, recent attacks on NBFCs have been timed for weekends and holidays, so out-of-hours coverage is a practical necessity.
QWhat are the DR and recovery requirements?
Chapter V requires DR drills for critical systems at least half-yearly, with the DR site operating as primary for a full working day, periodic restore testing of backups, and recovery targets of minimal RTO as approved by the IT strategy committee and a near-zero RPO for critical systems. Chapter IV requires annual BCP testing; Chapter III requires backups with periodic testing.
QDo the directions require CERT-In empanelled auditors?
No. Paragraph 122 requires independent, trained testers but does not mandate empanelment. Some other instruments, such as RBI's payment aggregator and payment system operator directions and SEBI's framework, do require empanelled auditors for certain audits.
QWhat happened to the 2017 IT framework and the 2023 IT governance direction?
Paragraph 155 repeals the existing directions, instructions and guidelines relating to the IT framework and IT governance as they applied to NBFCs. The June 2017 Master Direction and the November 2023 IT Governance Master Direction, as applied to NBFCs, are therefore no longer the instruments to cite.
QWhat other RBI directions apply to NBFC cybersecurity?
The NBFC Managing Risks in Outsourcing Directions, 2025, for vendor and IT outsourcing contracts; the Digital Lending Directions, 2025, for lending apps and data localisation; the Digital Payment Security Controls Directions, 2026, for credit-card-issuing NBFCs; and CERT-In's 2022 directions for reporting and log retention.
QWhere should an NBFC start?
Confirm your layer and chapter, map each paragraph to an owner and evidence, fix the CISO reporting line and board approval of the cybersecurity policy, set up and test DAKSH access with a six-hour playbook, then run the testing, monitoring and DR work in the following two months.
Related reading
For the whole 2026 family of directions, see RBI's 2026 cybersecurity directions: what changed for VAPT, the SOC and six-hour reporting. For the earlier SOC requirement, RBI guidelines requiring banks and NBFCs to establish a SOC. For cloud-hosted NBFCs, cloud security for fintech and NBFC companies in India. For the threat the directions are responding to, CERT-In's Crafty Falcon advisory.
Sources
- Reserve Bank of India, Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (RBI/DoS/2026-27/461).
- Reserve Bank of India, Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (RBI/DoS/2026-27/410).
- Reserve Bank of India, NBFC – Digital Payment Security Controls Directions, 2026 (RBI/DoS/2026-27/462).
- Reserve Bank of India, Master Direction – Information Technology Framework for the NBFC Sector (June 2017).
- Reserve Bank of India, Master Direction on IT Governance, Risk, Controls and Assurance Practices (November 2023).
- Reserve Bank of India, NBFC – Managing Risks in Outsourcing Directions, 2025.
- Reserve Bank of India, Digital Lending Directions, 2025.
- Reserve Bank of India, RBI launches DAKSH, the Reserve Bank's advanced supervisory monitoring system (October 2022).
- CERT-In, Directions under section 70B(6) of the IT Act, 2000 (28 April 2022).
- CERT-In / CSIRT-Fin, Advisory CIAD-2026-0058 on AI-driven attacks on BFSI entities (4 November 2026).
Adayptus Consulting
BFSI Security, Adayptus
Adayptus Consulting Private Limited is a cybersecurity consultancy based in Noida, India, helping banks, NBFCs and fintechs turn RBI directions into controls, evidence and tested response.
On This Page
- What the directions are, and who they cover
- Find your chapter
- Chapter III: the basics for smaller NBFCs
- Chapter IV: base layer at ₹500 crore and above
- Chapter V: the full set for middle layer and above
- What the NBFC directions do not say
- The other directions you have to read alongside
- Where NBFCs usually fall short
- A 90-day plan
- Frequently Asked Questions
- Related reading
- Sources
