RBI Cybersecurity Compliance for NBFCs

RBI cybersecurity compliance for NBFCs now starts with one question most checklists skip: which NBFC layer are you in? The controls expected from a small Base Layer NBFC are not identical to those expected from a Middle, Upper or Top Layer institution.

What changed for NBFC cybersecurity compliance in 2026?

RBI consolidated the earlier IT framework and IT governance instructions into an entity-specific direction for NBFCs. These RBI cybersecurity guidelines for NBFCs create a clearer structure built around cybersecurity, technology risk, resilience and assurance rather than a disconnected set of circulars. The direction also formally repeals the previous NBFC IT framework instructions while preserving actions and liabilities already created under them.

The board remains the first line of regulatory accountability. It must approve technology and cybersecurity strategies and policies and review them at least annually. For larger NBFCs, the framework becomes more prescriptive about governance committees, information security responsibility, risk management, technical safeguards, resilience testing and independent assurance.

Which RBI cybersecurity rules apply to your NBFC?

Base Layer below ₹500 crore and CICs

The baseline is proportionate, but it is not optional. The NBFC should digitise and secure primary business databases, maintain a board-approved IT/IS policy, define user roles, apply physical and logical access controls, enforce a password policy and use maker-checker controls. Systems should support management reporting and regulatory returns. The board-approved business continuity policy must receive periodic oversight at least annually, and backup arrangements must be tested.

Base Layer at ₹500 crore and above

Chapter IV expects an integrated IT governance framework and defined responsibility across the board, senior management and technology leaders. An IT Strategy Committee must be formed; its chair is an independent director, the CIO and CTO are members, and no more than six months should elapse between meetings. Requirements extend across security policy, access, operations, audit, resilience and outsourcing.

Middle Layer and above

Middle, Upper and Top Layer NBFCs face more developed governance and security requirements. The IT Strategy Committee is board-level, has at least three directors, is chaired by an independent director with substantial IT expertise and meets at least quarterly. A senior executive is designated as CISO with appropriate independence, expertise and resources. The CISO’s office manages and monitors the SOC, drives cyber initiatives and places a cybersecurity review before relevant board-level governance at least quarterly.

The core NBFC cybersecurity requirements to operationalise

Know and classify the technology estate

Maintain a detailed inventory of information assets and map security classification to confidentiality, integrity, availability and business criticality. The inventory should cover on-premise systems, cloud accounts, applications, APIs, databases, endpoints, network devices and material vendor dependencies. A current information security risk assessment should connect these assets to threats, vulnerabilities, impact and treatment decisions.

Control identities and privileged access

Access should exist only for a valid business need. Use defined roles, segregate conflicting duties and log and periodically review elevated activity. For Middle Layer and above, RBI explicitly expects two-factor or multi-factor authentication for privileged users of critical systems and for critical activities based on risk assessment, as well as MFA for enterprise access to critical systems in teleworking environments.

Monitor logs and respond to incidents

Audit trails must be detailed enough for audit, forensic evidence and dispute resolution, and logs should be regularly monitored for unauthorised activity or attack. Incident arrangements need defined classification, escalation, containment, communication, forensic analysis and recovery procedures. For the NBFCs covered by the relevant Chapter V requirement, cyber incidents are reported to RBI through DAKSH within six hours of detection, with proactive notification to CERT-In; HFC reporting continues to NHB as specified by RBI.

Test vulnerabilities throughout the system lifecycle

For Middle Layer and above, critical information systems and customer-facing systems in the DMZ require vulnerability assessment at least once every six months and penetration testing at least once every 12 months. Testing also applies before implementation, after implementation and after changes. It must extend to relevant cloud-hosted systems, use independent and appropriately trained experts, and lead to time-bound remediation that prevents recurrence.

Scanning and penetration testing answer different questions. The Osto guide to VAPT types explains how web, API, mobile, network and cloud testing should be scoped to the real attack surface.

Prove resilience, not just backup completion

Resilience means secure resumption of critical operations, not merely that a backup job displayed “successful.” For Middle Layer and above, critical-system DR drills are required at least half-yearly and should include running normal business operations from the alternate site for at least a full working day. Backups must be restored periodically to test usability, protected from unauthorised access and aligned to approved RTO and RPO.

Key RBI cybersecurity frequencies for NBFCs

Not every control has the same cadence. Treat these as specific requirements where applicable, not a universal schedule for every NBFC layer.

A practical NBFC cyber security compliance checklist

The RBI NBFC cybersecurity framework 2026 is easiest to implement as a continuous programme: establish applicability, translate clauses into controls, operate those controls, collect evidence and independently test the result.

1. Confirm the NBFC classification. Document regulatory layer, asset size, CIC/HFC status, products, digital channels and outsourced activities.
2. Build an applicability register. Map Chapter II and the applicable Chapter III, IV or V provisions, then add digital lending, outsourcing, payment and data-protection requirements.
3. Map obligations to controls. For every clause, identify the control, accountable owner, technology source, review frequency and expected evidence.
4. Establish the governance structure. Approve policies, constitute the required committees and formalise board, ITSC, CISO, CIO, risk and audit responsibilities.
5. Inventory and classify assets. Include cloud, applications, APIs, endpoints, data, identities and vendors; flag critical systems and customer-facing DMZ assets.
6. Implement and tune security controls. Cover access, MFA, endpoints, cloud, applications, data, logs, vulnerabilities, patches, incidents and resilience.
7. Test operation. Run access reviews, VA/PT, restoration tests, DR exercises, incident simulations and independent IS audits at the applicable cadence.
8. Keep a regulatory evidence trail. Store dated, attributable proof and report exceptions, overdue remediation and residual risk to the correct governance forum.

What evidence should an NBFC retain?

The strongest evidence is generated while the control operates. A policy shows design; logs, tickets, approvals, reviews and test results show that the control worked. This is the same principle behind a mature information security management system, but RBI compliance still requires direct mapping to the applicable direction.

Frequently asked questions