For Indian banks, cyber security became a board matter in June 2016.

In June 2016 the Reserve Bank of India (RBI) issued a circular titled Cyber Security Framework in Banks to scheduled commercial banks. It asked each bank for a board-approved cyber security policy, separate from its general IT policy, a cyber crisis management plan, and a security operations centre. Later RBI directions have extended and consolidated these expectations.

The 2016 circular treated cyber risk as different from ordinary IT risk and put it in front of the board. It asked banks to report unusual cyber incidents to RBI, including failed attempts, and set out a baseline of controls in an annex. In November 2023 RBI followed with a Master Direction on IT governance, risk, controls and assurance, in force from April 2024, which pulled IT, cyber and continuity instructions together for a wider set of regulated entities. For a fintech or SaaS vendor, this shows up as bank due diligence: right-to-audit clauses, incident timelines and evidence requests.

The bank's board-approved cyber policy

The document the 2016 circular required to stand apart from the IT security policy.

A cyber crisis management plan

The bank's playbook for detecting, responding to, containing and recovering from attacks.

A vendor onboarding pack

Security questionnaires, audit rights and incident terms a bank passes down to its suppliers.

An RBI inspection

Supervisors review policies, SOC operations and incident records against RBI's directions.

CERT-In directions

Issued under the IT Act and apply across sectors, with their own incident reporting rules. A bank must meet both.

DPDP Act

Covers personal data for all fiduciaries. RBI's framework covers the bank's whole cyber posture, personal data or not.

SEBI CSCRF

SEBI's cyber framework for securities market entities. Different regulator, different scope.

• If you are regulated by RBI, read the 2016 circular and the 2023 Master Direction that applies to your type of entity.
• If you sell to banks, map their contract schedules to your existing controls before you sign.
• Agree incident notice timings that let the bank meet its own reporting duties.
• Keep evidence ready for audits by the bank and, where the contract allows, by RBI.

• GuideISO 27001 and RBI expectationsBanks, NBFCs and RBI requirements, mapped to the ISMS.
• GuideDPDP for banks, NBFCs and fintechsWhere the Act meets RBI rules and customer records.
• GuideISO 27001 across Indian regulatorsOne table of who asks for what, and how the ISMS answers.

Sources: RBI circular Cyber Security Framework in Banks, DBS.CO/CSITE/BC.11/33.01.001/2015-16, 2 June 2016; RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 7 November 2023. Not legal advice.