RBI Cybersecurity Compliance: Guide for Regulated Financial Companies | Osto<\/title>\n<meta name=\"description\" content=\"A complete guide to RBI cybersecurity compliance for banks, NBFCs, payment aggregators, and fintechs: who is covered, the core obligations, and how to comply.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<style>\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">RBI cybersecurity compliance now reaches almost every regulated financial company, and the rules have tightened significantly in recent years. This guide gives you the full picture: what is required, who it applies to, and how banks, non-banking financial companies, payment aggregators, and the fintechs serving them can approach compliance.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>12 min read<\/span><span class=\"dot\"><\/span><span>RBI Compliance<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>RBI cybersecurity compliance rests on three things: protection (real security controls), compliance (the governance and evidence that prove it), and cyber insurance (the financial backstop). The rules have become legally binding and board-owned, with a framework for commercial banks and a separate one for non-banking financial companies, while payment aggregators stay under their own directions and fintech vendors are scoped through the partners they serve.<\/p>\n <p>Across almost every entity, the common obligations are board-level governance with an independent Chief Information Security Officer, a fixed VAPT cadence, six-hour incident reporting via DAKSH, round-the-clock monitoring, and data localisation. This page maps the whole landscape so you can see how the pieces fit together.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#pillars\">The three pillars<\/a><\/li>\n <li><a href=\"#who\">Who is covered<\/a><\/li>\n <li><a href=\"#changed\">What recently changed<\/a><\/li>\n <li><a href=\"#core\">The core obligations<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"pillars\">The three pillars of RBI cybersecurity compliance<\/h2>\n <p>It helps to start with the shape of the problem. RBI cybersecurity compliance is really three connected obligations, and treating them as one is where teams go wrong. Protection is the security itself, the controls, testing, and monitoring that actually defend your systems. Compliance is the proof, the governance, policies, audits, and evidence that show a regulator your protection is real. Cyber insurance is the backstop, financial cover for the risk that gets through despite everything else. The order matters: real protection comes first, compliance documents it, and insurance covers the remainder.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">The three pillars<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">What RBI compliance really asks of you<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">RBI cybersecurity compliance is not one thing. It is protection, the security itself, compliance, the proof of it, and increasingly cyber insurance as the backstop. Getting the balance right matters.<\/div>\n <svg viewBox=\"0 0 800 276\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The three pillars of RBI cybersecurity compliance\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Three things RBI compliance actually asks of you<\/text>\n <rect x=\"20\" y=\"58\" width=\"244\" height=\"200\" rx=\"16\" fill=\"#1c267a\"\/>\n <circle cx=\"52\" cy=\"96\" r=\"20\" fill=\"#2b3596\"\/><g transform=\"translate(41.80,85.80) scale(0.85)\" fill=\"none\" stroke=\"#aeb6ee\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M12 3l7 3v5c0 4.4-3 8.2-7 9-4-.8-7-4.6-7-9V6l7-3z\"\/><\/g>\n <text x=\"84\" y=\"94\" fill=\"#fff\" font-size=\"14.5\" font-weight=\"800\">Protection<\/text>\n <text x=\"84\" y=\"112\" fill=\"#aeb6ee\" font-size=\"10.5\">the security itself<\/text>\n <line x1=\"44\" y1=\"130\" x2=\"240\" y2=\"130\" stroke=\"#39439a\" stroke-width=\"1\"\/>\n <text x=\"44\" y=\"154\" fill=\"#c3c9ee\" font-size=\"11.5\">Controls, testing, monitoring,<\/text>\n <text x=\"44\" y=\"172\" fill=\"#c3c9ee\" font-size=\"11.5\">and incident response across<\/text>\n <text x=\"44\" y=\"190\" fill=\"#c3c9ee\" font-size=\"11.5\">your systems. VAPT, SIEM,<\/text>\n <text x=\"44\" y=\"208\" fill=\"#c3c9ee\" font-size=\"11.5\">encryption, access control.<\/text>\n <text x=\"44\" y=\"236\" fill=\"#8fa0e8\" font-size=\"10.5\" font-style=\"italic\">The bulk of the work<\/text>\n\n <rect x=\"278\" y=\"58\" width=\"244\" height=\"200\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <circle cx=\"310\" cy=\"96\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.4\"\/><g transform=\"translate(299.80,85.80) scale(0.85)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M12 4v16M7 20h10\"\/><path d=\"M12 6l-6 2 6-2 6 2-6-2z\"\/><path d=\"M6 8l-2.5 5a2.5 2.5 0 0 0 5 0L6 8z\"\/><path d=\"M18 8l-2.5 5a2.5 2.5 0 0 0 5 0L18 8z\"\/><\/g>\n <text x=\"342\" y=\"94\" fill=\"#1c267a\" font-size=\"14.5\" font-weight=\"800\">Compliance<\/text>\n <text x=\"342\" y=\"112\" fill=\"#5b6178\" font-size=\"10.5\">the proof<\/text>\n <line x1=\"302\" y1=\"130\" x2=\"498\" y2=\"130\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"302\" y=\"154\" fill=\"#4a5170\" font-size=\"11.5\">Governance, policies, audits,<\/text>\n <text x=\"302\" y=\"172\" fill=\"#4a5170\" font-size=\"11.5\">and evidence that satisfy an<\/text>\n <text x=\"302\" y=\"190\" fill=\"#4a5170\" font-size=\"11.5\">RBI inspection. Mapped to the<\/text>\n <text x=\"302\" y=\"208\" fill=\"#4a5170\" font-size=\"11.5\">the Directions and DPDP.<\/text>\n <text x=\"302\" y=\"236\" fill=\"#2b3596\" font-size=\"10.5\" font-style=\"italic\">Proving the protection is real<\/text>\n\n <rect x=\"536\" y=\"58\" width=\"244\" height=\"200\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <circle cx=\"568\" cy=\"96\" r=\"20\" fill=\"#fff\" stroke=\"#0a7d6c\" stroke-width=\"1.4\"\/><g transform=\"translate(557.80,85.80) scale(0.85)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M12 3a9 9 0 0 1 9 9H3a9 9 0 0 1 9-9z\"\/><path d=\"M12 12v7a2.5 2.5 0 0 0 5 0\"\/><\/g>\n <text x=\"600\" y=\"94\" fill=\"#0a6558\" font-size=\"14.5\" font-weight=\"800\">Cyber insurance<\/text>\n <text x=\"600\" y=\"112\" fill=\"#5b6178\" font-size=\"10.5\">the backstop<\/text>\n <line x1=\"560\" y1=\"130\" x2=\"756\" y2=\"130\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"560\" y=\"154\" fill=\"#4a5170\" font-size=\"11.5\">Financial cover for residual<\/text>\n <text x=\"560\" y=\"172\" fill=\"#4a5170\" font-size=\"11.5\">risk. Insurers increasingly<\/text>\n <text x=\"560\" y=\"190\" fill=\"#4a5170\" font-size=\"11.5\">expect the same controls<\/text>\n <text x=\"560\" y=\"208\" fill=\"#4a5170\" font-size=\"11.5\">that RBI does.<\/text>\n <text x=\"560\" y=\"236\" fill=\"#0a6558\" font-size=\"10.5\" font-style=\"italic\">The safety net, not a control<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <div class=\"bbox teal\"><div class=\"bt\">Compliance proves protection, it does not replace it<\/div>The most expensive mistake in regulated finance is chasing the certificate while the underlying security stays thin. RBI inspections increasingly test whether controls actually work, not just whether a policy document exists. Build the protection, and let the compliance evidence follow from it.<\/div>\n\n <h2 class=\"sec\" id=\"who\">Who these rules apply to<\/h2>\n <p>RBI cybersecurity rules are not a single framework applied uniformly. Different kinds of regulated entities sit under different, sometimes overlapping, sets of directions, and knowing which apply to you is the first step.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">Who is covered<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Different entities, different frameworks<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">A frequent mistake is assuming one rulebook covers everyone. Banks, non-banking financial companies, payment aggregators, and the fintechs serving them each sit under different, overlapping rules.<\/div>\n <svg viewBox=\"0 0 800 232\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Who RBI cybersecurity rules apply to\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Who these rules apply to<\/text><rect x=\"16\" y=\"60\" width=\"182\" height=\"152\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"107\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(96.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 10h16M5 10l7-5 7 5M6 10v7M10 10v7M14 10v7M18 10v7M4 20h16\"\/><\/g><text x=\"107\" y=\"144\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"12.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Commercial banks<\/text><text x=\"107\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Cybersecurity Directions,<\/text><text x=\"107\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">the State Bank of<\/text><text x=\"107\" y=\"194\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">India<\/text><rect x=\"214\" y=\"60\" width=\"182\" height=\"152\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"305\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(294.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"5\" y=\"3\" width=\"14\" height=\"18\" rx=\"1\"\/><path d=\"M9 7h2M13 7h2M9 11h2M13 11h2M9 15h2M13 15h2\"\/><\/g><text x=\"305\" y=\"144\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"12.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">NBFCs<\/text><text x=\"305\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Own framework,<\/text><text x=\"305\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">framework, tiered by<\/text><text x=\"305\" y=\"194\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">layer<\/text><rect x=\"412\" y=\"60\" width=\"182\" height=\"152\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"503\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(492.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 9l1.5-4h13L20 9M4 9v10h16V9M4 9h16M9 19v-5h6v5\"\/><\/g><text x=\"503\" y=\"144\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"12.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Payment aggregators<\/text><text x=\"503\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">PA-PG Direction,<\/text><text x=\"503\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">annual CERT-In audit<\/text><rect x=\"610\" y=\"60\" width=\"182\" height=\"152\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"701\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(690.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"5\" r=\"2.5\"\/><path d=\"M12 7.5V21M5 13a7 7 0 0 0 14 0M5 13H3m2 0l1.5-1.5M19 13h2m-2 0l-1.5-1.5\"\/><\/g><text x=\"701\" y=\"144\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"12.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Fintech vendors<\/text><text x=\"701\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Scoped through the<\/text><text x=\"701\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">partner they serve<\/text><\/svg>\n \n<\/div>\n\n <p>Commercial banks, including the State Bank of India, fall under the current cybersecurity Directions. Non-banking financial companies are covered by their own separate framework, tiered by regulatory layer and asset size, with heavier obligations on larger entities. Payment aggregators remain under the Payment Aggregator Directions, which require an annual system audit by a CERT-In empanelled auditor. Cooperative banks are graded by levels based on the digital services they offer. And fintech or SaaS vendors that sell into these institutions are scoped indirectly, through the security requirements their regulated partners are obliged to enforce. If you build software for a bank or an NBFC, their compliance becomes your requirement.<\/p>\n\n <h2 class=\"sec\" id=\"changed\">How the rules recently changed<\/h2>\n <p>The latest frameworks were a turning point. They moved cybersecurity from advisory guidance to legally binding requirements, and from a technical, IT-owned function to a board-level governance responsibility. Boards are now expected to own cyber risk on the same footing as credit and market risk. Scattered circulars were consolidated into coherent rulebooks, incident reporting was tightened to a six-hour clock through the named DAKSH platform, and the Chief Information Security Officer was required to be independent of the head of IT. The direction of travel is clear: what applies to commercial banks today tends to reach non-banking financial companies within roughly 12 to 18 months, so even entities not yet in scope should be preparing.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">A parallel data-protection layer<\/div>RBI rules do not sit alone. The Digital Personal Data Protection Act adds a parallel compliance layer for personal data. The obligations are not identical, so most entities map their controls to both at once rather than treating them as separate projects.<\/div>\n\n <h2 class=\"sec\" id=\"core\">The core obligations at a glance<\/h2>\n <p>Depth and timing vary by entity, but a recognisable core runs through the whole framework. If you are in scope in any form, expect to address most of these.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">The core obligations<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">What almost every entity has to do<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">Scope and depth vary by entity, but a common set of obligations runs through the framework. These are the ones nearly every regulated entity has to meet in some form.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core obligations of RBI cybersecurity compliance\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core obligations at a glance<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"4\" width=\"18\" height=\"13\" rx=\"2\"\/><path d=\"M8 21h8M12 17v4\"\/><path d=\"M7 12l2.5-3 2 2L15 8\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Board governance<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">IT Strategy and Info Security<\/text><text x=\"136\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Committees<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"9\" cy=\"8\" r=\"3\"\/><path d=\"M3.5 20a5.5 5.5 0 0 1 11 0\"\/><path d=\"M16 6a3 3 0 0 1 0 6\"\/><path d=\"M17 14.5a5.5 5.5 0 0 1 3.5 5.5\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Independent CISO<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Separated from the head of IT<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"7\"\/><path d=\"M12 2v4M12 18v4M2 12h4M18 12h4\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">VAPT cadence<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">VA every 6 months, PT every year<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">6-hour reporting<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Cyber incidents via the DAKSH<\/text><text x=\"136\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">platform<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"4\" width=\"18\" height=\"14\" rx=\"2\"\/><path d=\"M6 14l3-4 2 2 3-5 4 7\"\/><path d=\"M8 21h8\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">24×7 monitoring<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">A security operations capability<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M12 21s7-6.2 7-11a7 7 0 0 0-14 0c0 4.8 7 11 7 11z\"\/><circle cx=\"12\" cy=\"10\" r=\"2.5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Data localisation<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Payment data stored inside India<\/text><\/svg>\n \n<\/div>\n\n <p>In practice that means board-level governance through an IT Strategy Committee and an Information Security Committee, a Chief Information Security Officer independent of the head of IT, a fixed testing cadence with vulnerability assessments roughly every six months and <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">penetration testing at least annually<\/a> on critical systems, incident reporting within six hours through DAKSH, round-the-clock security monitoring through a security operations capability, and data localisation for payment data. Around these sit supporting requirements like encryption, access control, vendor and third-party risk management, business continuity and disaster-recovery testing, and secure software development.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to RBI compliance<\/h2>\n <p>Meeting all of this, protection, compliance, and insurance readiness at once, is a heavy lift, especially for smaller regulated entities and the fintechs that serve them. The obligations span testing, monitoring, data handling, governance evidence, and vendor risk, and assembling that from separate tools and consultants is slow and hard to keep audit-ready. The efficient path is a single platform that delivers the security work and organises the evidence together.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. It runs the VAPT cadence RBI expects, correlates security events for fast incident detection and reporting, supports data localisation and encryption controls, covers vendor risk and secure development, and keeps organised, audit-ready evidence, mapped across the RBI expectations, DPDP, SOC 2, ISO 27001, and 200+ frameworks on one platform. Meeting a board-level, continuously-evidenced standard, and being ready to prove it, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Meet RBI cybersecurity compliance without a big team.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the required testing, speed up incident detection, secure your data, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is RBI cybersecurity compliance?<\/summary><p>It is the set of security, governance, and reporting obligations the Reserve Bank of India requires of regulated financial entities. These are now legally binding and board-owned, and they span protection (real controls), compliance (governance and evidence), and increasingly cyber insurance as a backstop.<\/p><\/details>\n <details><summary>Who has to comply with RBI cybersecurity rules?<\/summary><p>Commercial banks, non-banking financial companies, payment aggregators, and cooperative banks, each under their own directions. Fintech and SaaS vendors selling into these institutions are scoped indirectly, through the security requirements their regulated partners must enforce on them.<\/p><\/details>\n <details><summary>What are the main RBI cybersecurity requirements?<\/summary><p>Board-level governance with an independent Chief Information Security Officer, a fixed VAPT cadence (vulnerability assessment roughly every six months, penetration testing at least annually on critical systems), six-hour incident reporting via DAKSH, round-the-clock monitoring, data localisation, and supporting controls like encryption, access control, and vendor-risk management.<\/p><\/details>\n <details><summary>How have the RBI cybersecurity rules recently changed?<\/summary><p>Cybersecurity became legally binding and board-owned rather than advisory and IT-owned. Commercial banks and non-banking financial companies came under separate frameworks, incident reporting was tightened to six hours via DAKSH, and the Chief Information Security Officer was required to be independent of the head of IT.<\/p><\/details>\n <details><summary>How does RBI compliance relate to the DPDP Act?<\/summary><p>They are parallel. RBI rules govern cybersecurity and technology risk for financial entities, while the Digital Personal Data Protection Act governs personal data more broadly. The obligations overlap but are not identical, so most entities map controls to both together rather than separately.<\/p><\/details>\n <details><summary>Can Osto make my company RBI compliant?<\/summary><p>Osto gets you compliance-ready, it runs the required security work (VAPT, monitoring, data controls) and organises the audit-ready evidence, mapped to the RBI expectations and other frameworks. Formal audits, such as the payment aggregator system audit, are performed by the relevant accredited or CERT-In empanelled auditor. Osto complements that work rather than replacing the auditor.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>RBI Cybersecurity Compliance: Guide for Regulated Financial Companies | Osto RBI cybersecurity compliance now reaches almost every regulated financial company,\u2026<\/p>\n","protected":false},"author":8,"featured_media":1233,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[632,633,451,634],"class_list":["post-1232","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-rbi-compliance-for-banks-and-nbfcs","tag-rbi-compliance-guide","tag-rbi-cybersecurity-compliance","tag-rbi-cybersecurity-requirements"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1232","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1232"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1232\/revisions"}],"predecessor-version":[{"id":1234,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1232\/revisions\/1234"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1233"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1232,"date":"2026-09-14T07:31:36","date_gmt":"2026-09-14T07:31:36","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1232"},"modified":"2026-09-14T07:31:36","modified_gmt":"2026-09-14T07:31:36","slug":"rbi-cybersecurity-compliance","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/rbi-cybersecurity-compliance\/","title":{"rendered":"RBI Cybersecurity Compliance: A Complete Guide for Regulated Financial Companies"},"content":{"rendered":"\n\n\n\n\n\nRBI Cybersecurity Compliance: Guide for Regulated Financial Companies | Osto<\/title>\n<meta name=\"description\" content=\"A complete guide to RBI cybersecurity compliance for banks, NBFCs, payment aggregators, and fintechs: who is covered, the core obligations, and how to comply.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<style>\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">RBI cybersecurity compliance now reaches almost every regulated financial company, and the rules have tightened significantly in recent years. This guide gives you the full picture: what is required, who it applies to, and how banks, non-banking financial companies, payment aggregators, and the fintechs serving them can approach compliance.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>12 min read<\/span><span class=\"dot\"><\/span><span>RBI Compliance<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>RBI cybersecurity compliance rests on three things: protection (real security controls), compliance (the governance and evidence that prove it), and cyber insurance (the financial backstop). The rules have become legally binding and board-owned, with a framework for commercial banks and a separate one for non-banking financial companies, while payment aggregators stay under their own directions and fintech vendors are scoped through the partners they serve.<\/p>\n <p>Across almost every entity, the common obligations are board-level governance with an independent Chief Information Security Officer, a fixed VAPT cadence, six-hour incident reporting via DAKSH, round-the-clock monitoring, and data localisation. This page maps the whole landscape so you can see how the pieces fit together.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#pillars\">The three pillars<\/a><\/li>\n <li><a href=\"#who\">Who is covered<\/a><\/li>\n <li><a href=\"#changed\">What recently changed<\/a><\/li>\n <li><a href=\"#core\">The core obligations<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"pillars\">The three pillars of RBI cybersecurity compliance<\/h2>\n <p>It helps to start with the shape of the problem. RBI cybersecurity compliance is really three connected obligations, and treating them as one is where teams go wrong. Protection is the security itself, the controls, testing, and monitoring that actually defend your systems. Compliance is the proof, the governance, policies, audits, and evidence that show a regulator your protection is real. Cyber insurance is the backstop, financial cover for the risk that gets through despite everything else. The order matters: real protection comes first, compliance documents it, and insurance covers the remainder.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">The three pillars<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">What RBI compliance really asks of you<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">RBI cybersecurity compliance is not one thing. It is protection, the security itself, compliance, the proof of it, and increasingly cyber insurance as the backstop. Getting the balance right matters.<\/div>\n <svg viewBox=\"0 0 800 276\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The three pillars of RBI cybersecurity compliance\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Three things RBI compliance actually asks of you<\/text>\n <rect x=\"20\" y=\"58\" width=\"244\" height=\"200\" rx=\"16\" fill=\"#1c267a\"\/>\n <circle cx=\"52\" cy=\"96\" r=\"20\" fill=\"#2b3596\"\/><g transform=\"translate(41.80,85.80) scale(0.85)\" fill=\"none\" stroke=\"#aeb6ee\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M12 3l7 3v5c0 4.4-3 8.2-7 9-4-.8-7-4.6-7-9V6l7-3z\"\/><\/g>\n <text x=\"84\" y=\"94\" fill=\"#fff\" font-size=\"14.5\" font-weight=\"800\">Protection<\/text>\n <text x=\"84\" y=\"112\" fill=\"#aeb6ee\" font-size=\"10.5\">the security itself<\/text>\n <line x1=\"44\" y1=\"130\" x2=\"240\" y2=\"130\" stroke=\"#39439a\" stroke-width=\"1\"\/>\n <text x=\"44\" y=\"154\" fill=\"#c3c9ee\" font-size=\"11.5\">Controls, testing, monitoring,<\/text>\n <text x=\"44\" y=\"172\" fill=\"#c3c9ee\" font-size=\"11.5\">and incident response across<\/text>\n <text x=\"44\" y=\"190\" fill=\"#c3c9ee\" font-size=\"11.5\">your systems. VAPT, SIEM,<\/text>\n <text x=\"44\" y=\"208\" fill=\"#c3c9ee\" font-size=\"11.5\">encryption, access control.<\/text>\n <text x=\"44\" y=\"236\" fill=\"#8fa0e8\" font-size=\"10.5\" font-style=\"italic\">The bulk of the work<\/text>\n\n <rect x=\"278\" y=\"58\" width=\"244\" height=\"200\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <circle cx=\"310\" cy=\"96\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.4\"\/><g transform=\"translate(299.80,85.80) scale(0.85)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M12 4v16M7 20h10\"\/><path d=\"M12 6l-6 2 6-2 6 2-6-2z\"\/><path d=\"M6 8l-2.5 5a2.5 2.5 0 0 0 5 0L6 8z\"\/><path d=\"M18 8l-2.5 5a2.5 2.5 0 0 0 5 0L18 8z\"\/><\/g>\n <text x=\"342\" y=\"94\" fill=\"#1c267a\" font-size=\"14.5\" font-weight=\"800\">Compliance<\/text>\n <text x=\"342\" y=\"112\" fill=\"#5b6178\" font-size=\"10.5\">the proof<\/text>\n <line x1=\"302\" y1=\"130\" x2=\"498\" y2=\"130\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"302\" y=\"154\" fill=\"#4a5170\" font-size=\"11.5\">Governance, policies, audits,<\/text>\n <text x=\"302\" y=\"172\" fill=\"#4a5170\" font-size=\"11.5\">and evidence that satisfy an<\/text>\n <text x=\"302\" y=\"190\" fill=\"#4a5170\" font-size=\"11.5\">RBI inspection. Mapped to the<\/text>\n <text x=\"302\" y=\"208\" fill=\"#4a5170\" font-size=\"11.5\">the Directions and DPDP.<\/text>\n <text x=\"302\" y=\"236\" fill=\"#2b3596\" font-size=\"10.5\" font-style=\"italic\">Proving the protection is real<\/text>\n\n <rect x=\"536\" y=\"58\" width=\"244\" height=\"200\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <circle cx=\"568\" cy=\"96\" r=\"20\" fill=\"#fff\" stroke=\"#0a7d6c\" stroke-width=\"1.4\"\/><g transform=\"translate(557.80,85.80) scale(0.85)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M12 3a9 9 0 0 1 9 9H3a9 9 0 0 1 9-9z\"\/><path d=\"M12 12v7a2.5 2.5 0 0 0 5 0\"\/><\/g>\n <text x=\"600\" y=\"94\" fill=\"#0a6558\" font-size=\"14.5\" font-weight=\"800\">Cyber insurance<\/text>\n <text x=\"600\" y=\"112\" fill=\"#5b6178\" font-size=\"10.5\">the backstop<\/text>\n <line x1=\"560\" y1=\"130\" x2=\"756\" y2=\"130\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"560\" y=\"154\" fill=\"#4a5170\" font-size=\"11.5\">Financial cover for residual<\/text>\n <text x=\"560\" y=\"172\" fill=\"#4a5170\" font-size=\"11.5\">risk. Insurers increasingly<\/text>\n <text x=\"560\" y=\"190\" fill=\"#4a5170\" font-size=\"11.5\">expect the same controls<\/text>\n <text x=\"560\" y=\"208\" fill=\"#4a5170\" font-size=\"11.5\">that RBI does.<\/text>\n <text x=\"560\" y=\"236\" fill=\"#0a6558\" font-size=\"10.5\" font-style=\"italic\">The safety net, not a control<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <div class=\"bbox teal\"><div class=\"bt\">Compliance proves protection, it does not replace it<\/div>The most expensive mistake in regulated finance is chasing the certificate while the underlying security stays thin. RBI inspections increasingly test whether controls actually work, not just whether a policy document exists. Build the protection, and let the compliance evidence follow from it.<\/div>\n\n <h2 class=\"sec\" id=\"who\">Who these rules apply to<\/h2>\n <p>RBI cybersecurity rules are not a single framework applied uniformly. Different kinds of regulated entities sit under different, sometimes overlapping, sets of directions, and knowing which apply to you is the first step.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">Who is covered<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Different entities, different frameworks<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">A frequent mistake is assuming one rulebook covers everyone. Banks, non-banking financial companies, payment aggregators, and the fintechs serving them each sit under different, overlapping rules.<\/div>\n <svg viewBox=\"0 0 800 232\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Who RBI cybersecurity rules apply to\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Who these rules apply to<\/text><rect x=\"16\" y=\"60\" width=\"182\" height=\"152\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"107\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(96.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 10h16M5 10l7-5 7 5M6 10v7M10 10v7M14 10v7M18 10v7M4 20h16\"\/><\/g><text x=\"107\" y=\"144\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"12.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Commercial banks<\/text><text x=\"107\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Cybersecurity Directions,<\/text><text x=\"107\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">the State Bank of<\/text><text x=\"107\" y=\"194\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">India<\/text><rect x=\"214\" y=\"60\" width=\"182\" height=\"152\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"305\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(294.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"5\" y=\"3\" width=\"14\" height=\"18\" rx=\"1\"\/><path d=\"M9 7h2M13 7h2M9 11h2M13 11h2M9 15h2M13 15h2\"\/><\/g><text x=\"305\" y=\"144\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"12.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">NBFCs<\/text><text x=\"305\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Own framework,<\/text><text x=\"305\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">framework, tiered by<\/text><text x=\"305\" y=\"194\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">layer<\/text><rect x=\"412\" y=\"60\" width=\"182\" height=\"152\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"503\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(492.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 9l1.5-4h13L20 9M4 9v10h16V9M4 9h16M9 19v-5h6v5\"\/><\/g><text x=\"503\" y=\"144\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"12.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Payment aggregators<\/text><text x=\"503\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">PA-PG Direction,<\/text><text x=\"503\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">annual CERT-In audit<\/text><rect x=\"610\" y=\"60\" width=\"182\" height=\"152\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"701\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(690.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"5\" r=\"2.5\"\/><path d=\"M12 7.5V21M5 13a7 7 0 0 0 14 0M5 13H3m2 0l1.5-1.5M19 13h2m-2 0l-1.5-1.5\"\/><\/g><text x=\"701\" y=\"144\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"12.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Fintech vendors<\/text><text x=\"701\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Scoped through the<\/text><text x=\"701\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">partner they serve<\/text><\/svg>\n \n<\/div>\n\n <p>Commercial banks, including the State Bank of India, fall under the current cybersecurity Directions. Non-banking financial companies are covered by their own separate framework, tiered by regulatory layer and asset size, with heavier obligations on larger entities. Payment aggregators remain under the Payment Aggregator Directions, which require an annual system audit by a CERT-In empanelled auditor. Cooperative banks are graded by levels based on the digital services they offer. And fintech or SaaS vendors that sell into these institutions are scoped indirectly, through the security requirements their regulated partners are obliged to enforce. If you build software for a bank or an NBFC, their compliance becomes your requirement.<\/p>\n\n <h2 class=\"sec\" id=\"changed\">How the rules recently changed<\/h2>\n <p>The latest frameworks were a turning point. They moved cybersecurity from advisory guidance to legally binding requirements, and from a technical, IT-owned function to a board-level governance responsibility. Boards are now expected to own cyber risk on the same footing as credit and market risk. Scattered circulars were consolidated into coherent rulebooks, incident reporting was tightened to a six-hour clock through the named DAKSH platform, and the Chief Information Security Officer was required to be independent of the head of IT. The direction of travel is clear: what applies to commercial banks today tends to reach non-banking financial companies within roughly 12 to 18 months, so even entities not yet in scope should be preparing.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">A parallel data-protection layer<\/div>RBI rules do not sit alone. The Digital Personal Data Protection Act adds a parallel compliance layer for personal data. The obligations are not identical, so most entities map their controls to both at once rather than treating them as separate projects.<\/div>\n\n <h2 class=\"sec\" id=\"core\">The core obligations at a glance<\/h2>\n <p>Depth and timing vary by entity, but a recognisable core runs through the whole framework. If you are in scope in any form, expect to address most of these.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">The core obligations<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">What almost every entity has to do<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">Scope and depth vary by entity, but a common set of obligations runs through the framework. These are the ones nearly every regulated entity has to meet in some form.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core obligations of RBI cybersecurity compliance\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core obligations at a glance<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"4\" width=\"18\" height=\"13\" rx=\"2\"\/><path d=\"M8 21h8M12 17v4\"\/><path d=\"M7 12l2.5-3 2 2L15 8\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Board governance<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">IT Strategy and Info Security<\/text><text x=\"136\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Committees<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"9\" cy=\"8\" r=\"3\"\/><path d=\"M3.5 20a5.5 5.5 0 0 1 11 0\"\/><path d=\"M16 6a3 3 0 0 1 0 6\"\/><path d=\"M17 14.5a5.5 5.5 0 0 1 3.5 5.5\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Independent CISO<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Separated from the head of IT<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"7\"\/><path d=\"M12 2v4M12 18v4M2 12h4M18 12h4\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">VAPT cadence<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">VA every 6 months, PT every year<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">6-hour reporting<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Cyber incidents via the DAKSH<\/text><text x=\"136\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">platform<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"4\" width=\"18\" height=\"14\" rx=\"2\"\/><path d=\"M6 14l3-4 2 2 3-5 4 7\"\/><path d=\"M8 21h8\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">24×7 monitoring<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">A security operations capability<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M12 21s7-6.2 7-11a7 7 0 0 0-14 0c0 4.8 7 11 7 11z\"\/><circle cx=\"12\" cy=\"10\" r=\"2.5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Data localisation<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Payment data stored inside India<\/text><\/svg>\n \n<\/div>\n\n <p>In practice that means board-level governance through an IT Strategy Committee and an Information Security Committee, a Chief Information Security Officer independent of the head of IT, a fixed testing cadence with vulnerability assessments roughly every six months and <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">penetration testing at least annually<\/a> on critical systems, incident reporting within six hours through DAKSH, round-the-clock security monitoring through a security operations capability, and data localisation for payment data. Around these sit supporting requirements like encryption, access control, vendor and third-party risk management, business continuity and disaster-recovery testing, and secure software development.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to RBI compliance<\/h2>\n <p>Meeting all of this, protection, compliance, and insurance readiness at once, is a heavy lift, especially for smaller regulated entities and the fintechs that serve them. The obligations span testing, monitoring, data handling, governance evidence, and vendor risk, and assembling that from separate tools and consultants is slow and hard to keep audit-ready. The efficient path is a single platform that delivers the security work and organises the evidence together.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. It runs the VAPT cadence RBI expects, correlates security events for fast incident detection and reporting, supports data localisation and encryption controls, covers vendor risk and secure development, and keeps organised, audit-ready evidence, mapped across the RBI expectations, DPDP, SOC 2, ISO 27001, and 200+ frameworks on one platform. Meeting a board-level, continuously-evidenced standard, and being ready to prove it, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Meet RBI cybersecurity compliance without a big team.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the required testing, speed up incident detection, secure your data, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is RBI cybersecurity compliance?<\/summary><p>It is the set of security, governance, and reporting obligations the Reserve Bank of India requires of regulated financial entities. These are now legally binding and board-owned, and they span protection (real controls), compliance (governance and evidence), and increasingly cyber insurance as a backstop.<\/p><\/details>\n <details><summary>Who has to comply with RBI cybersecurity rules?<\/summary><p>Commercial banks, non-banking financial companies, payment aggregators, and cooperative banks, each under their own directions. Fintech and SaaS vendors selling into these institutions are scoped indirectly, through the security requirements their regulated partners must enforce on them.<\/p><\/details>\n <details><summary>What are the main RBI cybersecurity requirements?<\/summary><p>Board-level governance with an independent Chief Information Security Officer, a fixed VAPT cadence (vulnerability assessment roughly every six months, penetration testing at least annually on critical systems), six-hour incident reporting via DAKSH, round-the-clock monitoring, data localisation, and supporting controls like encryption, access control, and vendor-risk management.<\/p><\/details>\n <details><summary>How have the RBI cybersecurity rules recently changed?<\/summary><p>Cybersecurity became legally binding and board-owned rather than advisory and IT-owned. Commercial banks and non-banking financial companies came under separate frameworks, incident reporting was tightened to six hours via DAKSH, and the Chief Information Security Officer was required to be independent of the head of IT.<\/p><\/details>\n <details><summary>How does RBI compliance relate to the DPDP Act?<\/summary><p>They are parallel. RBI rules govern cybersecurity and technology risk for financial entities, while the Digital Personal Data Protection Act governs personal data more broadly. The obligations overlap but are not identical, so most entities map controls to both together rather than separately.<\/p><\/details>\n <details><summary>Can Osto make my company RBI compliant?<\/summary><p>Osto gets you compliance-ready, it runs the required security work (VAPT, monitoring, data controls) and organises the audit-ready evidence, mapped to the RBI expectations and other frameworks. Formal audits, such as the payment aggregator system audit, are performed by the relevant accredited or CERT-In empanelled auditor. Osto complements that work rather than replacing the auditor.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>RBI Cybersecurity Compliance: Guide for Regulated Financial Companies | Osto RBI cybersecurity compliance now reaches almost every regulated financial company,\u2026<\/p>\n","protected":false},"author":8,"featured_media":1233,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[632,633,451,634],"class_list":["post-1232","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-rbi-compliance-for-banks-and-nbfcs","tag-rbi-compliance-guide","tag-rbi-cybersecurity-compliance","tag-rbi-cybersecurity-requirements"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1232","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1232"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1232\/revisions"}],"predecessor-version":[{"id":1234,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1232\/revisions\/1234"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1233"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}