{"id":1235,"date":"2026-09-14T09:30:43","date_gmt":"2026-09-14T09:30:43","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1235"},"modified":"2026-09-14T09:30:43","modified_gmt":"2026-09-14T09:30:43","slug":"rbi-cybersecurity-compliance-for-nbfcs","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/rbi-cybersecurity-compliance-for-nbfcs\/","title":{"rendered":"RBI Cybersecurity Compliance for NBFCs: A Complete Guide"},"content":{"rendered":"\n\n\n\n\n\n\n\n<style>\n  :root{\n    --ink:#0e1330;\n    --brand:#1c267a;\n    --brand-2:#3a46c0;\n    --accent:#00c2a8;\n    --accent-soft:#e6f7f4;\n    --paper:#ffffff;\n    --mist:#f4f6fb;\n    --line:#e3e7f2;\n    --muted:#5a6284;\n    --danger:#e2564d;\n    --radius:16px;\n    --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n    --maxw:860px;\n  }\n  *{box-sizing:border-box}\n  html{scroll-behavior:smooth}\n  body{\n    margin:0;\n    font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n    color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n  }\n  a{color:var(--brand-2);text-decoration:none}\n  a:hover{text-decoration:underline}\n\n  .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n  .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n  .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n  .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n  .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n  .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n  .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n  .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n  .breadcrumb a{color:var(--muted)}\n  .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n  h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n  .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n  .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n  .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n  .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n  .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n  .tldr p{margin:0 0 10px;font-size:16.5px}\n  .tldr p:last-child{margin:0}\n\n  h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n  h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n  p{margin:0 0 16px;font-size:16.5px}\n  .lead-in{color:var(--muted)}\n  em{font-style:italic}\n\n  .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n  .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n  .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n  .jump li{margin:6px 0;font-size:15px}\n  @media(max-width:560px){.jump ol{columns:1}}\n\n  .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n  .analogy strong{color:var(--brand)}\n\n  ul.clean{padding-left:0;list-style:none;margin:16px 0}\n  ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n  ul.clean li:last-child{border-bottom:none}\n  ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n  ul.warn li::before{background:var(--danger)}\n\n  \/* TSC cards *\/\n  .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n  .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n  .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n  .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n  .tsc-card.req .tag{color:var(--brand)}\n  .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n  .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n  @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n  @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n  \/* stat band *\/\n  .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n  .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n  .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n  .fig-head .src{font-size:11.5px;color:#b9c0f0}\n  .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n  .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n  .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n  .stat-cell:last-child{border-right:none}\n  .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n  .stat-cell .num.accent{color:var(--accent)}\n  .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n  @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n  \/* timeline *\/\n  .timeline{padding:8px 24px 4px}\n  .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n  .tl-item:last-child{border-bottom:none}\n  .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n  .tl-what{font-size:14.5px}\n  .tl-what b{display:block;margin-bottom:2px}\n  @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n  .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n  table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n  thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n  thead th.osto{background:var(--brand);color:#fff}\n  tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n  tbody tr:last-child td{border-bottom:none}\n  tbody td:first-child{font-weight:600;color:var(--ink)}\n  td.osto{background:#f6f8ff;font-weight:600}\n  .yes{color:var(--accent);font-weight:700}\n  .no{color:var(--danger);font-weight:700}\n\n  .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n  .callout h3{margin:0 0 8px;color:#fff}\n  .callout p{color:#cfd4f5;margin:0 0 18px}\n  .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n  .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n  .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n  .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n  details{border-bottom:1px solid var(--line);padding:6px 0}\n  summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n  summary::-webkit-details-marker{display:none}\n  summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n  details[open] summary::after{content:\"\u2013\"}\n  details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n  footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n  .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n  .foot-inner .logo{font-size:17px}\n\n  .related{margin:42px 0 0}\n  .related h3{margin-bottom:14px}\n  .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n  .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n  .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n  .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n  @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n  \/* --- bright, clean additions --- *\/\n  .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n  .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n  .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n  .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n  .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n  .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n  .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n  @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n  .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n  .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n  .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n  .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n  .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n  .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n  .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n  .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n  @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n  .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n  .keyrow>div{padding:20px 22px}\n  .keyrow .k1{background:#eef0ff}\n  .keyrow .k2{background:var(--accent-soft)}\n  .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n  .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n  .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n  .keyrow .sm{font-size:13.5px;color:var(--muted)}\n  @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n  .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n  .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n  .flow .step .t{font-weight:800;font-size:14px}\n  .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n  .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n  .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n  .bbox strong{color:var(--brand)}\n  .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n  .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n  .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n  .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n  .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n  .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n  .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n  .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n  .checkarea ul{margin:0;padding:0;list-style:none}\n  .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n  .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n  @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n  .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n  .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n  .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n  .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n  .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n  .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n  @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n  .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n  .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n  .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n  .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n  \/* Osto branded comparison table *\/\n  .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n  table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n  table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n  table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n  table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n  table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n  table.regtable tr:last-child td{border-bottom:none}\n  table.regtable td:first-child{font-weight:700;color:#0e1330}\n  table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n  table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n  table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n\n\n<div class=\"wrap\">\n  <p class=\"dek\">RBI cybersecurity compliance for NBFCs now depends on one thing above all: your layer. This guide explains which rules bind your NBFC, what the core obligations are, and how a lean team can meet them without a large security function.<\/p>\n\n  <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>RBI Compliance<\/span><\/div>\n\n  <div class=\"tldr\">\n    <h2>TL;DR<\/h2>\n    <p>RBI cybersecurity compliance for NBFCs is tiered by Scale-Based Regulation layer. Every NBFC registered with the RBI is covered, but the chapter that applies depends on your layer and asset size. Base Layer NBFCs below 500 crore and Core Investment Companies get the lightest obligations, Base Layer NBFCs at 500 crore and above get a fuller set, and Middle, Upper, and Top Layer NBFCs face requirements close to a bank.<\/p>\n    <p>Across the heavier layers, compliance means board-level governance, an independent Chief Information Security Officer, a VAPT programme, six-hour incident reporting on the DAKSH platform, security monitoring, and data protection. Because the RBI extends bank rules to NBFCs on a delay, even lighter-obligation NBFCs should prepare early.<\/p>\n  <\/div>\n\n  <div class=\"jump\">\n    <h4>On this page<\/h4>\n    <ol>\n      <li><a href=\"#what\">What the framework is<\/a><\/li>\n      <li><a href=\"#layers\">Which rules apply to your NBFC<\/a><\/li>\n      <li><a href=\"#obligations\">The core obligations<\/a><\/li>\n      <li><a href=\"#sixhour\">The six-hour reporting rule<\/a><\/li>\n      <li><a href=\"#roadmap\">The NBFC roadmap<\/a><\/li>\n      <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n    <\/ol>\n  <\/div>\n\n  <h2 class=\"sec\" id=\"what\">What RBI cybersecurity compliance for NBFCs is<\/h2>\n  <p>RBI cybersecurity compliance for NBFCs is defined by the Reserve Bank of India (NBFC Cybersecurity and Technology Risk) Directions, a consolidated framework that replaced a scattered set of earlier circulars. It applies to all non-banking financial companies registered with the <a href=\"https:\/\/www.rbi.org.in\/\" target=\"_blank\" rel=\"noopener\">Reserve Bank of India<\/a>, and it turns cybersecurity into a board-owned, legally binding responsibility rather than a purely technical function. The framework covers board-approved IT and cybersecurity policies, IT governance, risk management, vulnerability assessment and penetration testing, business continuity, disaster recovery, information systems audit, and cyber incident response. In short, NBFC cybersecurity is now a governance obligation the board is accountable for, not a checklist the IT team quietly maintains.<\/p>\n\n  <h2 class=\"sec\" id=\"layers\">Which rules apply to your NBFC<\/h2>\n  <p>The single most important thing to understand is that these rules are not one uniform rulebook. The obligations are tiered by your Scale-Based Regulation layer, and the chapters are mutually exclusive, so you need to know exactly which one binds your NBFC before you plan anything.<\/p>\n\n  <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n  <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Who is covered<\/div>\n  <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Your layer decides your obligations<\/div>\n  <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The framework is not applied uniformly. Every NBFC registered with the RBI is covered, but the specific chapter that binds you depends on your Scale-Based Regulation layer and asset size. The bands are mutually exclusive, so a small change in asset size can move an NBFC into a materially heavier set of rules.<\/div>\n  <svg viewBox=\"0 0 800 276\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Which RBI cybersecurity compliance chapter applies to each NBFC layer\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Which rules apply depends on your NBFC layer<\/text>\n <rect x=\"16\" y=\"60\" width=\"248\" height=\"196\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <circle cx=\"52\" cy=\"98\" r=\"20\" fill=\"#fff\" stroke=\"#0a7d6c\" stroke-width=\"1.4\"\/><g transform=\"translate(42.40,88.40) scale(0.8)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"5\" y=\"3\" width=\"14\" height=\"18\" rx=\"1\"\/><path d=\"M9 7h2M13 7h2M9 11h2M13 11h2M9 15h2M13 15h2\"\/><\/g>\n <text x=\"84\" y=\"96\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Base Layer<\/text>\n <text x=\"84\" y=\"114\" fill=\"#5b6178\" font-size=\"11\">below 500 crore + CICs<\/text>\n <line x1=\"40\" y1=\"130\" x2=\"240\" y2=\"130\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"40\" y=\"154\" fill=\"#20463f\" font-size=\"12\" font-weight=\"700\">Chapter III (lightest)<\/text>\n <text x=\"40\" y=\"176\" fill=\"#4a5170\" font-size=\"11.5\">Board-approved policy and<\/text>\n <text x=\"40\" y=\"194\" fill=\"#4a5170\" font-size=\"11.5\">basic controls. No VAPT<\/text>\n <text x=\"40\" y=\"212\" fill=\"#4a5170\" font-size=\"11.5\">mandate, no SOC, no six-<\/text>\n <text x=\"40\" y=\"230\" fill=\"#4a5170\" font-size=\"11.5\">hour incident deadline.<\/text>\n <rect x=\"276\" y=\"60\" width=\"248\" height=\"196\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <circle cx=\"312\" cy=\"98\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.4\"\/><g transform=\"translate(302.40,88.40) scale(0.8)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 7h16M8 7l-2.5 6a2.5 2.5 0 0 0 5 0L8 7zM16 7l-2.5 6a2.5 2.5 0 0 0 5 0L16 7zM12 4v13M8 20h8\"\/><\/g>\n <text x=\"344\" y=\"96\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">Base Layer<\/text>\n <text x=\"344\" y=\"114\" fill=\"#5b6178\" font-size=\"11\">500 crore and above<\/text>\n <line x1=\"300\" y1=\"130\" x2=\"500\" y2=\"130\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"300\" y=\"154\" fill=\"#1c267a\" font-size=\"12\" font-weight=\"700\">Chapter IV (mid)<\/text>\n <text x=\"300\" y=\"176\" fill=\"#4a5170\" font-size=\"11.5\">Fuller governance, testing,<\/text>\n <text x=\"300\" y=\"194\" fill=\"#4a5170\" font-size=\"11.5\">and incident-reporting<\/text>\n <text x=\"300\" y=\"212\" fill=\"#4a5170\" font-size=\"11.5\">obligations than the<\/text>\n <text x=\"300\" y=\"230\" fill=\"#4a5170\" font-size=\"11.5\">smallest NBFCs.<\/text>\n <rect x=\"536\" y=\"60\" width=\"248\" height=\"196\" rx=\"16\" fill=\"#1c267a\"\/>\n <circle cx=\"572\" cy=\"98\" r=\"20\" fill=\"#2b3596\"\/><g transform=\"translate(562.40,88.40) scale(0.8)\" fill=\"none\" stroke=\"#aeb6ee\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M12 3l9 5-9 5-9-5 9-5z\"\/><path d=\"M3 13l9 5 9-5\"\/><\/g>\n <text x=\"604\" y=\"96\" fill=\"#fff\" font-size=\"14\" font-weight=\"800\">Middle, Upper,<\/text>\n <text x=\"604\" y=\"114\" fill=\"#aeb6ee\" font-size=\"11\">and Top Layer<\/text>\n <line x1=\"560\" y1=\"130\" x2=\"760\" y2=\"130\" stroke=\"#39439a\" stroke-width=\"1\"\/>\n <text x=\"560\" y=\"154\" fill=\"#fff\" font-size=\"12\" font-weight=\"700\">Chapter V (heaviest)<\/text>\n <text x=\"560\" y=\"176\" fill=\"#c3c9ee\" font-size=\"11.5\">Close to bank-level:<\/text>\n <text x=\"560\" y=\"194\" fill=\"#c3c9ee\" font-size=\"11.5\">VAPT cadence, six-hour<\/text>\n <text x=\"560\" y=\"212\" fill=\"#c3c9ee\" font-size=\"11.5\">DAKSH reporting, and<\/text>\n <text x=\"560\" y=\"230\" fill=\"#c3c9ee\" font-size=\"11.5\">continuous monitoring.<\/text>\n<\/g><\/svg>\n  \n<\/div>\n\n  <p>Chapter III applies to Base Layer NBFCs below 500 crore in asset size, and to Core Investment Companies, whose requirements are the lightest: a board-approved policy, basic controls, and incident-reporting capability. Chapter IV applies to Base Layer NBFCs at 500 crore and above, with a fuller set of obligations. Chapter V applies to Middle, Upper, and Top Layer NBFCs, where the requirements come closest to bank-level expectations. Because the bands are mutually exclusive, two NBFCs on either side of the 500 crore line can sit under materially different rules, so the asset-size test genuinely matters.<\/p>\n\n  <div class=\"bbox teal\"><div class=\"bt\">Small does not mean exempt<\/div>Even the smallest Base Layer NBFC carries baseline obligations: a board-approved cybersecurity policy, basic controls, and incident-reporting capability, plus the CERT-In incident-reporting and log-retention directions that apply to every body corporate. The lighter chapter is lighter, not empty.<\/div>\n\n  <h2 class=\"sec\" id=\"obligations\">The core obligations of RBI cybersecurity compliance for NBFCs<\/h2>\n  <p>For NBFCs in the Middle Layer and above, and to a large extent for larger Base Layer NBFCs, compliance involves a recognisable core set of security obligations. These formalise what well-run financial entities already do, and make them mandatory and evidenced.<\/p>\n\n  <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n  <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The obligations<\/div>\n  <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What mid and upper-layer NBFCs must do<\/div>\n  <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">For Middle, Upper, and Top Layer NBFCs, the obligations move close to bank-level. These are the core requirements most of these NBFCs must meet, from board governance down to incident reporting.<\/div>\n  <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Core RBI cybersecurity compliance obligations for NBFCs\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Core obligations for mid and upper-layer NBFCs<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"4\" width=\"18\" height=\"13\" rx=\"2\"\/><path d=\"M8 21h8M12 17v4\"\/><path d=\"M7 12l2.5-3 2 2L15 8\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Board governance<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">IT Strategy and Info Security<\/text><text x=\"136\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Committees<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"9\" cy=\"8\" r=\"3\"\/><path d=\"M3.5 20a5.5 5.5 0 0 1 11 0\"\/><path d=\"M16 6a3 3 0 0 1 0 6\"\/><path d=\"M17 14.5a5.5 5.5 0 0 1 3.5 5.5\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Independent CISO<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Not reporting to the head of IT<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"7\"\/><path d=\"M12 2v4M12 18v4M2 12h4M18 12h4\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">VAPT programme<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Vulnerability assessment and pen<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">testing<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Six-hour reporting<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Cyber incidents on DAKSH within<\/text><text x=\"136\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">six hours<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"4\" width=\"18\" height=\"14\" rx=\"2\"\/><path d=\"M6 14l3-4 2 2 3-5 4 7\"\/><path d=\"M8 21h8\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Monitoring and SOC<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Security operations for higher<\/text><text x=\"394\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">layers<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M12 21s7-6.2 7-11a7 7 0 0 0-14 0c0 4.8 7 11 7 11z\"\/><circle cx=\"12\" cy=\"10\" r=\"2.5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Data and DR<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Data protection, BCP, and DR<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">testing<\/text><\/svg>\n  \n<\/div>\n\n  <p>In practice that means board-level governance through an IT Strategy Committee and an Information Security Committee, a Chief Information Security Officer whose role is independent of the head of IT, a vulnerability assessment and penetration testing programme, cyber incident reporting on the DAKSH platform within six hours, security monitoring through a security operations capability for the higher layers, and data protection with business continuity and disaster-recovery testing. If you are unsure where to begin, a structured <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">VAPT programme<\/a> is usually the fastest way to show real security to an inspection.<\/p>\n\n  <div class=\"bbox indigo\"><div class=\"bt\">CISO independence is now structural<\/div>A specific and often-missed point: the Chief Information Security Officer must not report into the head of IT. If your organisation chart does not reflect that separation, it is a governance gap an inspection will find, and it takes a board-level decision, not an email, to fix.<\/div>\n\n  <h2 class=\"sec\" id=\"sixhour\">The six-hour incident reporting rule<\/h2>\n  <p>One requirement deserves singling out because it is operationally demanding. Under the framework, cyber incidents must be reported on the DAKSH platform within six hours of detection. That runs alongside the separate CERT-In six-hour clock that already applies to every body corporate, so for many NBFCs it means two reports, to two recipients, on the same deadline. The clock starts at detection, not after investigation, which means an NBFC that learns of an incident from a customer has already missed it. Meeting this is less about paperwork and more about having monitoring good enough to detect and confirm an incident quickly.<\/p>\n\n  <div class=\"bbox teal\"><div class=\"bt\">Six hours is a detection problem<\/div>You cannot report what you have not detected. The six-hour rule is, underneath, a demand for continuous monitoring that catches incidents early. For lean NBFC teams, that detection capability, not the reporting form, is usually the real gap.<\/div>\n\n  <h2 class=\"sec\" id=\"roadmap\">The NBFC roadmap: prepare before you are told<\/h2>\n  <p>There is a strategic point every NBFC should internalise. Even if a specific requirement is not yet mandatory for your layer, the RBI has consistently extended requirements introduced for banks to NBFCs within roughly 12 to 18 months. The bank framework is therefore an effective preview of where these NBFC rules are heading. Elements like continuous monitoring, the CISO independence structure, third-party exit strategies, and DAKSH incident reporting are widely expected to reach more NBFCs over time.<\/p>\n\n  <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n  <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The roadmap<\/div>\n  <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Prepare even if you are not yet in scope<\/div>\n  <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Even where a requirement is not yet mandatory for your layer, the rules tend to follow the bank framework on a delay. Reading the bank rules as a preview is how well-run NBFCs get ahead.<\/div>\n  <svg viewBox=\"0 0 800 244\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The RBI cybersecurity compliance roadmap for NBFCs\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Today&#8217;s bank rule is tomorrow&#8217;s NBFC rule<\/text>\n <rect x=\"40\" y=\"70\" width=\"300\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"64\" y=\"104\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">Banks today<\/text>\n <line x1=\"64\" y1=\"116\" x2=\"316\" y2=\"116\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"64\" y=\"140\" fill=\"#4a5170\" font-size=\"12\">CISO independence, 24&#215;7<\/text>\n <text x=\"64\" y=\"160\" fill=\"#4a5170\" font-size=\"12\">monitoring, third-party exit<\/text>\n <text x=\"64\" y=\"180\" fill=\"#4a5170\" font-size=\"12\">strategies, and continuous<\/text>\n <text x=\"64\" y=\"200\" fill=\"#4a5170\" font-size=\"12\">monitoring obligations.<\/text>\n <g transform=\"translate(354,137)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"2.6\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M0 8h30M22 1l8 7-8 7\"\/><\/g>\n <rect x=\"404\" y=\"70\" width=\"356\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"428\" y=\"104\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">NBFCs in 12 to 18 months<\/text>\n <line x1=\"428\" y1=\"116\" x2=\"736\" y2=\"116\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"428\" y=\"140\" fill=\"#4a5170\" font-size=\"12\">RBI has consistently extended<\/text>\n <text x=\"428\" y=\"160\" fill=\"#4a5170\" font-size=\"12\">bank requirements to NBFCs on<\/text>\n <text x=\"428\" y=\"180\" fill=\"#4a5170\" font-size=\"12\">a delay. Build toward them now,<\/text>\n <text x=\"428\" y=\"200\" fill=\"#0a6558\" font-size=\"12\" font-weight=\"700\">and the next circular is a head start.<\/text>\n<\/g><\/svg>\n  \n<\/div>\n\n  <p>NBFCs that treat the bank framework as their roadmap, and begin building toward it now, will be far better placed than those that wait for the NBFC-specific circular. Getting ahead of these rules turns a future scramble into a controlled, well-evidenced programme. Vendors selling into NBFCs face the same pressure, much like startups preparing for a <a href=\"https:\/\/www.osto.one\/resources\/blog\/soc-2-for-startups\/\">SOC 2 audit<\/a> before their first enterprise deal.<\/p>\n\n  <h2 class=\"sec\" id=\"osto\">The lean-team path to RBI cybersecurity compliance for NBFCs<\/h2>\n  <p>Meeting these obligations, a VAPT programme, six-hour-ready incident detection, governance evidence, vendor risk, and continuous monitoring, is a heavy lift for a lean NBFC without a dedicated security function. Assembling it from separate tools and consultants is slow and hard to keep audit-ready. The efficient path is a single platform that runs the security work and organises the evidence together.<\/p>\n\n  <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups and lean financial teams. It runs the VAPT cadence RBI expects, correlates security events for fast incident detection and reporting, supports data protection and vendor-risk controls, and keeps organised, audit-ready evidence, mapped across the RBI expectations, DPDP, and 200+ frameworks on one platform. Meeting a board-level, continuously-evidenced standard, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n  <div class=\"callout\">\n    <h3>Meet RBI cybersecurity compliance for NBFCs without a big team.<\/h3>\n    <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean financial teams. Run the required testing, speed up incident detection, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n    <a href=\"https:\/\/www.osto.one\/book-demo\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo &rarr;<\/a>\n  <\/div>\n\n  <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n  <details><summary>Does RBI cybersecurity compliance for NBFCs apply to every NBFC?<\/summary><p>Yes. The framework applies to all non-banking financial companies registered with the RBI. However, the specific obligations depend on your Scale-Based Regulation layer, so which chapter binds you varies by layer and asset size.<\/p><\/details>\n  <details><summary>Which RBI cybersecurity chapter applies to my NBFC?<\/summary><p>Chapter III applies to Base Layer NBFCs below 500 crore and Core Investment Companies, Chapter IV to Base Layer NBFCs at 500 crore and above, and Chapter V to Middle, Upper, and Top Layer NBFCs. The bands are mutually exclusive, so your layer and asset size decide the chapter.<\/p><\/details>\n  <details><summary>What is the six-hour incident reporting rule?<\/summary><p>Cyber incidents must be reported on the DAKSH platform within six hours of detection. It runs alongside the CERT-In six-hour clock, so many NBFCs file two reports on the same deadline, measured from detection, not investigation.<\/p><\/details>\n  <details><summary>Do small Base Layer NBFCs have to comply?<\/summary><p>Yes, though lightly. Even the smallest Base Layer NBFC needs a board-approved cybersecurity policy, basic controls, and incident-reporting capability, plus the CERT-In directions that apply to every body corporate. Small does not mean exempt.<\/p><\/details>\n  <details><summary>Does an NBFC CISO have to be independent of IT?<\/summary><p>For the applicable layers, yes. The framework requires the Chief Information Security Officer to be independent of the head of IT, mirroring the bank rule. It is a structural governance requirement that an inspection will check.<\/p><\/details>\n  <details><summary>How can a lean NBFC meet these requirements quickly?<\/summary><p>The efficient path is one platform that runs VAPT, provides continuous monitoring for fast incident detection, and keeps audit-ready evidence, rather than stitching together separate tools and consultants.<\/p><\/details>\n<\/div>\n\n\n","protected":false},"excerpt":{"rendered":"<p>RBI cybersecurity compliance for NBFCs now depends on one thing above all: your layer. This guide explains which rules bind\u2026<\/p>\n","protected":false},"author":8,"featured_media":1238,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[636,638,635,455,637],"class_list":["post-1235","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-nbfc-cybersecurity-framework","tag-nbfc-cybersecurity-requirements","tag-rbi-compliance-for-nbfc","tag-rbi-cybersecurity-compliance-for-nbfcs","tag-rbi-nbfc-directions"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1235","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1235"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1235\/revisions"}],"predecessor-version":[{"id":1239,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1235\/revisions\/1239"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1238"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1235"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1235"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}