Reserve Bank of India (Credit Information Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026
UR
- Applies toCredit information companies
- StatusIn force
- ImportanceMUST READ
- IssuedJul 31, 2026
- Amendmentsnone tracked
- Length124 points in 5 sections · 12 min read
The four dates on this rule
- PublishedJul 31, 2026The day RBI put this document out.
- Starts to applyNot statedNot stated separately in this document. Read the rule itself before you assume a start date.
- Time to get readyNot statedCannot be worked out until the day it starts to apply is known.
- Last date to actNot statedNo date to act by was found in this document. Other dates may sit inside single paragraphs.
Kept in your browser only. Your desk
Show me the points for
Nothing is removed from the page.
Numbers to remember
| seven years | Real IT skill here means at least seven years of running or guiding IT work. RBI Para 16(2) |
| three months | The IT Strategy Committee must meet at least once every three months. RBI Para 17 |
| six months | Critical systems need a scan every six months and an attack test every 12 months. RBI Para 146 |
| six hours | A cyber incident must be reported on the DAKSH platform within six hours of detection. RBI Para 177 |
What it says
Chapter I. Preliminary
1. Cyber rules for CICs
This paper sets the cyber and technology risk rules for credit information companies.
2. Start date
These Directions took effect at once.
3. Who is covered
These Directions apply to every credit information company.
Chapter II. Role of the Board
1. Board sees them yearly
These plans and policies must go to the Board for review at least once a year.
2. Set up the IT committee
The credit information company must set up a Board level IT Strategy Committee.
3. Audit committee oversees IS
The audit committee of the Board oversees the audit of information systems.
Chapter III. Information Technology Governance and Oversight
Must know
1. Seven years of skill
Real IT skill here means at least seven years of running or guiding IT work.
2. Committee meets each quarter
The IT Strategy Committee must meet at least once every three months.
3. A steering committee too
A steering group of senior staff must also meet at least once every three months.
4. Keep the two apart
The security officer must not report to the head of IT and gets no business target.
5. Quarterly cyber review
The security officer must place a cyber risk review before the Board every three months.
6. No unsupported software
The credit information company must not run outdated hardware or software that the maker no longer backs.
Do it
7. IT risk sits inside
The wider risk policy must also test IT risk from time to time.
8. Have a security policy
The credit information company must have an information security policy that sets scope, owner and penalty.
9. A separate cyber policy
The cyber security policy must be kept apart from the wider IT policy.
10. Three directors at least
The IT Strategy Committee must have at least three directors as members.
11. Chair must be independent
The chair of that committee must be an independent director with real IT skill.
12. Security committee under it
An information security committee must sit under the IT Strategy Committee.
13. Risk side heads it
The head of that security committee must come from the risk side of the credit information company.
14. Name a head of IT
The credit information company must name a senior officer with real IT skill as head of the IT work.
15. Head of IT duties
The head of IT must keep projects in line with policy and set up the backup site.
16. Name a security officer
A senior officer, best of general manager rank, must be named security officer.
17. Staff and budget for security
The security office must be well staffed and its budget set by the threats seen.
18. Review architecture yearly
The IT Strategy Committee must review the IT design at least once a year.
Background
19. Always invited
The security officer is a standing invitee to both the IT committees.
20. Reports to the top
The security officer reports to the executive director who looks after risk.
21. Plan the technology refresh
The credit information company must plan to replace hardware and software before support runs out.
Chapter IV. IT and Information Security Risk Management
1. Risk committee reviews yearly
The risk committee must review and update the risk policy at least once a year.
2. Security check each year
The credit information company must review its security set up and policies at least once a year.
3. Grade your own risk
The credit information company must grade its own risk as low, moderate, high or very high.
Chapter V. Baseline Cybersecurity and Resilience Requirements
Must know
1. Go beyond the top ten
Application security testing must not stop at the OWASP top 10 list.
2. Put the code in escrow
Where the source code cannot be had, the credit information company must place it in escrow.
3. No admin rights
Staff must not hold admin rights on their own desktop or laptop.
4. Removable media is barred
As a rule, pen drives and like media are barred unless allowed for a set use.
5. No manual data changes
Data moving between critical systems must not be changed by hand on the way.
6. Six months, then a year
Critical systems need a scan every six months and an attack test every 12 months.
BankPulse example. Suppose a scan is run in January and the next in July, six months later. The attack test run in January is next due the following January, 12 months later.
7. Report closure each quarter
The closing of test findings must go to both IT committees every three months.
8. Drill every six months
Recovery drills for critical systems must be held at least once every six months.
9. Six hours to report
A cyber incident must be reported on the DAKSH platform within six hours of detection.
10. Warn customers on passwords
The credit information company must teach customers never to share a password, a one time code or a PIN.
Do it
11. Keep an asset list
The credit information company must keep an up to date list of all its information assets.
12. Keep a data dictionary
The credit information company must keep a data dictionary so that systems share one meaning of data.
13. Stop data leaks
The credit information company must have a full plan to stop the loss or leak of sensitive data.
14. Wipe a lost device
The credit information company must be able to lock or wipe a mobile or a laptop from far away.
15. Data migration policy
The credit information company must have a data migration policy that keeps data whole and correct.
16. List the allowed software
The credit information company must keep one central list of software that is allowed and not allowed.
17. Control what gets installed
The credit information company must control what software can be put on its systems and devices.
18. Watch for new patches
The credit information company must watch patch notices from makers and CERT-In and apply them fast.
19. Guard the data centre
Physical controls must protect the data centre and the backup site from harm.
20. Watch heat and water
The credit information company must watch for breaks in heat, water, smoke, power and access alarms.
21. Keep the sites apart
The data centre and the backup site must be far apart in place.
22. Check capacity each year
The credit information company must check how much IT capacity it needs at least once a year.
23. Set a security baseline
The credit information company must set and apply a base security setting for every kind of device.
24. Review firewalls often
The credit information company must review firewalls, switches and security kit and their patch levels.
25. Keep a network map
The credit information company must keep an up to date map of its wired and wireless networks.
26. List every allowed device
The credit information company must keep one central list of the devices allowed on its network.
27. Secure the wireless
The credit information company must secure wireless networks, access points and client systems.
28. Block strange devices
The credit information company must spot devices that are not allowed on the network and block them.
29. Layer the boundary
Boundary defence must be layered, with firewalls, proxies and intrusion systems.
30. Support IPv6 traffic
Public facing systems of the credit information company must be able to carry IPv6 traffic.
31. Write secure code
The credit information company must use secure coding when it builds software on its own or with others.
32. Keep environments apart
The build, test and live systems must be kept apart from each other.
33. Vendors must support it
The credit information company must tie down software support from its vendors by formal agreement.
34. Get the source code
The credit information company must get the source code for every critical application from the vendor.
35. Written word from the vendor
The vendor must confirm in writing that the software carries no known flaw or malware.
36. Log every critical system
Every system that touches critical or sensitive data must keep an audit trail.
37. Trails must stand as proof
Audit trails must be full enough to serve as proof and to settle a dispute.
38. Watch the audit trails
The credit information company must watch audit trails and system logs to find any attack or misuse.
39. Find the root cause
The credit information company must find the root cause of any incident and patch the weak point.
40. Watch the privileged user
Staff with high system rights must be watched and all their work logged.
41. One place to sign in
Sign in and rights must run from one central system with strong password rules.
42. Close dormant accounts
The credit information company must limit failed sign in tries and switch off accounts nobody uses.
43. Prove who the customer is
The credit information company must be able to prove who a customer is on every channel it runs.
44. Secure the mail system
The credit information company must guard its mail against spoofing, look alike names and bad files.
45. Use DMARC on email
The credit information company must put DMARC in place on its email names to stop spoofing.
46. Scan media first
Removable media must be scanned for malware before read or write access is given.
47. Right to audit the vendor
The vendor agreement must give the credit information company a right to audit and RBI a right to inspect.
48. RBI can see everything
RBI must be able to reach every information resource the credit information company uses.
49. Where the data may sit
The credit information company must follow the law on where systems sit and where data may travel.
50. Use strong encryption
Key length, methods and protocols used to send and hold data must be strong.
51. Whitelist internet sites
The credit information company must whitelist the internet sites and systems that staff may reach.
52. Buy anti phishing help
The credit information company must buy a service that takes down fake sites and rogue apps.
53. Scan and attack tests
The credit information company must run scans and attack tests on all critical and internet facing systems.
54. Independent testers only
Scans and attack tests must be run by trained and independent security experts.
55. Follow the ISO standard
The continuity and recovery policy must follow best practice such as ISO 22301.
56. Run on the backup site
A recovery test must run the backup site as the main site for a full working day.
57. Test your backups
The credit information company must back data up and restore it now and then to prove it works.
58. Near zero data loss
The credit information company must aim for the least recovery time and near zero data loss.
59. Both sites must match
The settings and security patches at the main and backup sites must be the same.
60. Have a response policy
The credit information company must have a written policy on how it answers and recovers from an incident.
61. Train the incident staff
Staff who handle cyber incidents must be given special training.
62. Plan for ransomware
The credit information company must write down how it answers ransomware, data wiping and denial of service.
63. Shut the attack in
The credit information company must hold an attack in by shielding or cutting off the hit systems.
64. Tell CERT-In as well
The credit information company must also tell CERT-In about a cyber incident without being asked.
65. Share threat news
The credit information company must set up ways to gather and share threat news at home and abroad.
66. Join the cyber drills
The credit information company must take part in cyber drills run by CERT-In and IDRBT.
67. Write a crisis plan
The credit information company must write a cyber crisis management plan under the Board approved framework.
68. Four steps in a crisis
The crisis plan must cover four steps: detection, containment, response and recovery.
69. Measure with real numbers
The credit information company must build measures such as patch delay, malware cover and training reach.
70. Teach the staff
The credit information company must set out safe use rules for staff, vendors and partners.
71. Train every new recruit
Cyber awareness training is a must for all new recruits.
72. Board training each year
The Board and senior staff must be trained on IT and cyber risk once a year.
73. Take down fake sites
The credit information company must ask customers to report phishing mail and then act on it.
74. Watch risky transactions
The credit information company must watch transactions on a risk basis across every channel it runs.
75. Keep forensics on standby
The credit information company must keep network forensic and denial of service help on standby.
Background
76. The data stays yours
The credit information company owns the duty to keep customer data safe, even at a vendor site.
77. Access on business need
Access to information assets is allowed only where there is a real business need.
78. Two factor for privilege
A second factor is needed to sign in for privileged users of critical systems.
79. Rules for remote work
Remote work needs safe systems, a second sign in factor and a list of remote devices.
80. Bank is the identity source
The credit information company stands as the identity source when a customer reaches a partner system.
81. The bank stays answerable
The credit information company stays answerable for security risk in work it has given out.
82. Check vendor staff
Background checks and secrecy agreements are needed for all vendor staff.
83. Red team exercises
The credit information company may run red team drills that copy how a real attacker works.
Chapter VI. Cyber Security Operations Centre
1. Framework for the centre
The credit information company must have a framework to set up and run its security operations centre.
2. What the centre must do
The centre must watch, study and escalate incidents and work with outside agencies.
3. Watch round the clock
The credit information company must work out the staff it needs to watch systems 24x7.
4. Level three analysts
Level three analysts need deep packet study, forensic skill and malware knowledge.
Chapter VII. Information Systems Audit
1. Have an IS audit policy
The credit information company must have an information systems audit policy.
2. Audit policy reviewed yearly
The audit committee must approve that policy and review it at least once a year.
3. Separate IS audit function
The credit information company must have a separate information systems audit function with the right skill.
4. Plan audits by risk
Audit planning must follow a risk based approach.
Chapter VIII. Repeal and Other Provisions
1. Old cyber rules go
These Directions repeal the earlier cyber framework and IT governance instructions.
2. Other laws still apply
These Directions add to other laws and rules and do not replace them.
BankPulse example. A bank follows these Directions and thinks the matter is closed. It is not. Any other laws, rules, regulations or directions in force still apply on top. Where another one asks for more, the bank does the more.
3. RBI has the last word
RBI may issue clarifications, and its reading of these Directions is final.
BankPulse example. Two banks read the same clause differently. Neither reading settles it. RBI may issue clarifications, and its interpretation of any provision is final and binding on all concerned entities.
The same subject for other kinds of institution
The same subject for other kinds of institution.
Other RBI rules for credit information companies
RBI internal ombudsman rules for credit information companies 2026
RBI miscellaneous rules for credit information companies 2026
Every rule page on BankPulse · Questions bankers ask, answered