ISO 27001 in India
RBI's IT directions are prescriptive. An ISMS is the system that delivers them.
The Reserve Bank of India (RBI) sets detailed rules on how regulated entities govern technology, test it and outsource it. ISO 27001 is a risk-based standard that leaves most choices to you. The two fit well when the ISMS is used to run and evidence RBI's requirements, and badly when a certificate is offered in place of them.
Back to ISO 27001 services01 · The instruments
Two master directions do most of the work
One on IT governance and assurance, one on IT outsourcing.
- IT governance directions
- Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023, dated 7 November 2023, in force from 1 April 2024. It consolidated earlier instructions on IT governance, risk, assurance and continuity.
- IT outsourcing directions
- Master Direction on Outsourcing of Information Technology Services, dated 10 April 2023, in force from 1 October 2023. It covers material outsourcing of IT services.
The governance directions apply to commercial banks, NBFCs in the top, upper and middle layers, credit information companies and all-India financial institutions, and exclude local area banks and core investment companies. Payment system operators, co-operative banks and smaller NBFCs may fall under other RBI instructions. Check the current consolidated text for your entity type.
02 · IT governance
Governance: where the ISMS fits, and where RBI is more specific
ISO asks for leadership commitment. RBI names the committees.
| RBI expectation | What the ISMS contributes | What RBI adds |
|---|---|---|
| A board-level IT Strategy Committee | Clause 5 leadership records and management review outputs as committee inputs | At least three directors, chaired by an independent director with IT expertise, meeting at least quarterly |
| An IT Steering Committee | ISMS operating meetings and metrics | Senior IT and business management, meeting at least quarterly |
| A chief information security officer | Clause 5.3 assigned roles | Senior rank, no direct reporting to the head of IT, no business targets, quarterly risk reporting to the board or a committee |
| Board-approved policies reviewed yearly | Approved security policy and topic policies with review dates | Board approval and annual board review of IT, cyber and continuity policies |
| IT and cyber risk in enterprise risk | Risk method, register and treatment plan | Yearly review by the board's risk committee with the steering committee |
03 · Testing and audit
Testing, continuity and IS audit
RBI sets frequencies that ISO leaves to your risk assessment.
- Vulnerability assessment
- 6 months
- At least this often for critical and customer-facing internet systems
- Penetration testing
- 12 months
- At least yearly for the same systems
- DR drills
- Half-yearly
- For critical systems; others by risk
The directions also expect a risk-based IS audit overseen by the board's audit committee, an IS audit policy reviewed at least yearly, and IS audit resources within internal audit. Your ISO internal audit can be planned to feed this, but it is not the same function unless it meets RBI's structure. Disaster recovery drills are expected to run the recovery site as primary for a meaningful period, with recovery objectives defined for every critical system.
04 · IT outsourcing
IT outsourcing: the supplier controls, made binding
Annex A supplier controls are a good start; RBI adds contract and access terms.
- Accountability stays with you. The board and senior management remain responsible for any outsourced activity.
- Risk-based due diligence. Financial, operational, legal and reputational factors, scaled to materiality.
- Right to audit. Over the provider and its sub-contractors, with regulator access to systems and data written into the contract.
- Incident notice. The provider must report cyber incidents fast enough for you to report to RBI within six hours of the provider detecting them.
- Concentration risk. Assess dependence on a single provider or on a few providers for critical functions.
- Exit strategy. A planned exit that keeps services running, with data returned or destroyed safely.
Where a supplier's ISO certificate helps
The outsourcing directions let an entity rely on globally recognised third-party certifications in place of its own audit of a provider, depending on its risk assessment. A provider's ISO 27001 certificate can serve that purpose if its scope covers the service you buy. Check the scope statement; a certificate for another business unit proves nothing about yours.
05 · Evidence
How the ISMS evidences RBI items, and what it cannot
Use one evidence set, labelled for both readers.
The ISMS can evidence
- Risk assessment and treatment
- Policies with approval and review history
- Access, change and logging controls in operation
- Supplier assessments and contract reviews
- Incident and continuity records
RBI still expects
- Committee structures and their minutes
- Testing and drill frequencies as written
- A risk-based IS audit function
- Reporting to RBI and CERT-In on its timelines
- Outsourcing contract terms the directions list
Neither direction mentions ISO 27001 as a route to compliance. Treat the certificate as evidence of a working ISMS, not as a regulatory answer.
Sources: Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023 (RBI/2023-24/107, 7 November 2023) and Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102, 10 April 2023), read on RBI's site; CERT-In directions of 28 April 2022 under section 70B of the IT Act, named only; ISO/IEC 27001:2022 clause titles and Annex A names. Check RBI's site for amendments.
Questions from banks, NBFCs and fintechs
Does RBI accept ISO 27001 certification as compliance?
No. The directions do not offer it as a route.
Neither the IT governance nor the IT outsourcing directions name ISO 27001 as satisfying them. A certificate shows your ISMS met the standard; RBI's structural, testing and reporting requirements still need to be met and shown separately.
We are a fintech serving a bank. Do these directions bind us?
Usually through your contract with the bank.
If your service is material IT outsourcing for a regulated entity, the bank must impose audit rights, incident reporting and exit terms on you. Your ISO 27001 certificate, scoped to the service, is often what the bank's due diligence asks for first.
Can the ISO internal audit double as the RBI IS audit?
It can feed it, but rarely replaces it.
RBI expects an IS audit function within internal audit, overseen by the audit committee and planned on risk. An ISO internal audit run by that function and covering the RBI areas can serve both purposes, if the reports address each set of requirements.
Are the VAPT and DR frequencies the same for every system?
No. They apply to critical and customer-facing systems.
The fixed frequencies apply to critical systems and internet-facing systems with customer interfaces. Other systems follow your risk assessment, which is exactly where the ISMS risk method does the work.
Map the ISMS to RBI's directions.
Auditify can map your ISO 27001 controls to RBI's IT directions, test the systems the frequencies apply to, and list what remains. Your compliance team or counsel should confirm how the directions apply to your entity.