RBI (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026
RBI's binding IT governance, cybersecurity, resilience and IS-audit direction for commercial banks, replacing the 2023 IT Governance Master Direction and the 2016 Cyber Security Framework.
- Issued by
- Reserve Bank of India
- Applies in
- India
- Edition
- RBI/DoS/2026-27/410 (31 Jul 2026), updated 1 Oct 2026
- Area
- Operational resilience & ICT
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- Para 7Board approves IT, information security, cyber and BCP strategies and policiesGovernance
- Para 27Appoint a senior CISO independent of the Head of ITGovernance
- Para 39Include IT and cyber risks in the risk policy, reviewed annuallyRisk management
- Para 126Assess vendor risk in proportion to materialityThird parties
- Para 163Maintain a BCP/DR policy aligned to best practice (e.g. ISO 22301)Resilience
- Para 182Report cyber incidents on DAKSH within six hoursReporting
- Para 212Operate a Cyber Security Operations CentreCybersecurity
- Para 224Audit Committee oversees IS auditAssurance
How Amoreg keeps you on it.
Enable the RBI (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 and the Monitor suggests RBI as a source. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 8 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read rbi.org.in/Scripts/NotificationUser.aspx
- Check the library against 8 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: board approves IT, information security, cyber and BCP strategies and policies
- Rule
- RBI (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, Para 7
- Area
- Governance
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- DORA — Digital Operational Resilience ActICT risk management, incident reporting, resilience testing and third-party risk for financial entities.European Union · 8 controls
- NIS2 DirectiveCybersecurity risk-management measures and incident reporting for essential and important entities.European Union · 4 controls
- UK Operational Resilience (FCA SYSC 15A / PRA SS1/21)Important business services, impact tolerances, mapping and scenario testing.United Kingdom · 5 controls
- UK Outsourcing & Third-Party Risk (SYSC 8 / PRA SS2/21)Requirements for outsourcing and third-party arrangements, including critical third parties.United Kingdom · 5 controls
- CSSF Circular 20/750 — ICT and security risk managementEBA ICT and security risk guidelines applied to Luxembourg entities outside DORA's scope.Luxembourg · 5 controls
- CSSF Circular 22/806 — Outsourcing arrangementsThe single outsourcing framework, now applying to DORA entities for business process outsourcing only.Luxembourg · 5 controls
Also in India
- SEBI (Intermediaries) Regulations, 2008SEBI regulations for all registered intermediaries, covering registration, fit-and-proper criteria, general conduct, inspection and enforcement.India · 8 controls
- SEBI (Prohibition of Insider Trading) Regulations, 2015SEBI regulations preventing insider trading and controlling unpublished price sensitive information (UPSI) at listed companies, intermediaries and fiduciaries.India · 8 controls
- SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015SEBI regulations for the continuing disclosure and corporate governance obligations of listed entities, read with the LODR master circular.India · 8 controls
- SEBI (Investment Advisers) Regulations, 2013SEBI regulations for the registration, qualifications and client-facing conduct of investment advisers, read with the IA master circular.India · 8 controls
- SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)SEBI framework setting cybersecurity and cyber resilience requirements for SEBI-regulated entities, graded by entity category.India · 8 controls
- RBI (Commercial Banks – Know Your Customer) Directions, 2025RBI's binding KYC/AML/CFT direction for commercial banks under the PML Act and Rules, replacing the repealed 2016 KYC Master Direction.India · 8 controls
Questions
Does Amoreg watch for changes to the RBI (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026?
Yes. Enable it and the Monitor suggests Reserve Bank of India as a source; every publication it records keeps its source, stage and date.
Can Amoreg check our policies against the RBI (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records RBI/DoS/2026-27/410 (31 Jul 2026), updated 1 Oct 2026. Editions were last verified in August 2026, and the Monitor records new publications as they appear.