RBI Cybersecurity Framework Practitioner Certification

The 7 November 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices as it operates in production. Applicability perimeter (SCBs excluding RRBs, LABs, PBs, SFBs, Cooperative Banks; NBFCs in Top, Upper and Middle Layers; CICs; AIFIs). The IT Strategy Committee composition and cadence.

The CISO independence rule (no operational reporting through the CTO / Head of IT). The Information Systems Audit annual cadence. Chapter-by-chapter walkthrough with practitioner examples of how CSITE inspections read against each chapter.

1. 1. ITGRCA applicability perimeter in detail 10 min
2. 2. IT Strategy Committee: composition, cadence, chair independence 12 min
3. 3. CISO independence: the reporting line that actually works 12 min
4. 4. IS Audit: cadence, charter, and auditor competencies 11 min
5. 5. Three management committees that do the actual work 10 min

The cornerstone 31 July 2026 Reserve Bank of India (Commercial Banks — Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, and how they consolidate commercial-bank cyber into a single instrument. DAKSH portal as the current reporting channel with the codified six-hour clock. Security-testing floor (six-monthly VA, annual PT, half-yearly DR drills).

Board-approved cyber, information security and business continuity policies with annual review. What of the 2016 CSF now applies only to non-commercial-bank REs (SFBs, PBs, LABs, Cooperative Banks under the 2019 UCB CSF, AIFIs) as continuing baseline. The Cyber Security Policy vs IT Policy distinction that CSITE inspections continue to enforce.

1. 1. Reading the 2026 Directions chapter by chapter 12 min
2. 2. The 2016 CSF as continuing baseline for non-commercial-bank REs 10 min
3. 3. UCB Graded Framework: picking the right level and staying in it 11 min
4. 4. The Cyber Security Policy vs the IT Policy: two documents, one Board 10 min
5. 5. The security-testing floor: VA every six months, PT annually, DR half-yearly 11 min

The 8 June 2017 Master Direction on IT Framework for the NBFC Sector, and how the Scale-Based Regulation Framework (22 October 2021) layers ITGRCA on top for Top, Upper and Middle Layer NBFCs. Base Layer NBFCs (asset size below ₹1,000 crore, plus specific NBFC types) sit under the 2017 IT Framework only. Middle Layer, Upper Layer and Top Layer NBFCs sit under both the 2017 IT Framework and the 2023 ITGRCA Master Direction.

Reconciling apparent conflicts across the two instruments. Which of the 2017 IT Framework provisions are the operational floor and which are governance provisions that ITGRCA now supersedes for the overlaid NBFCs.

1. 1. The 2017 NBFC IT Framework: what it still does 11 min
2. 2. SBR layer mapping and the NBFC IT overlay 12 min
3. 3. Reconciling apparent conflicts between the 2017 IT Framework and the 2023 ITGRCA MD 10 min
4. 4. NBFC-specific enforcement: IIFL Finance and JM Financial Products 10 min
5. 5. Proportionality for sub-₹500 crore NBFCs: a documented risk statement, not a licence 9 min

The Master Direction on Digital Payment Security Controls (18 February 2021) for SCBs, SFBs, PBs and credit-card-issuing NBFCs. The Payment Aggregators Directions (RBI/DPSS/2025-26/141 dated 15 September 2025) creating the three PA sub-categories (PA-Physical, PA-Online, PA-Cross Border). The 6 April 2018 Storage of Payment System Data Direction and the 26 June 2019 FAQ.

The April 2026 Digital Payment Authentication Framework and the Card-on-File Tokenisation regime live from 1 October 2022. The acquirer-bank relay that pulls non-bank PAs into DPSC obligations indirectly. Escrow account, settlement timelines, KYC and Cash Handling for PAs.

Cross-border payments compliance.

1. 1. The DPSC Master Direction: scope and application 12 min
2. 2. The 2025 Payment Aggregators Directions: three sub-categories and one repeal list 12 min
3. 3. Payment data storage 2018: end-to-end in India, foreign leg permitted 11 min
4. 4. The April 2026 Digital Payment Authentication Framework 10 min
5. 5. The payments compliance stack for a non-bank PA: the eight-instrument register 9 min

The 10 April 2023 Master Direction on Outsourcing of IT Services (RBI/2023-24/102). The 3 November 2006 Guidelines on Managing Risks and Code of Conduct in Outsourcing of Financial Services that HDFC Bank was penalised under in November 2025. Cloud governance in the absence of a standalone RBI cloud framework, through the 2023 IT Outsourcing MD and the 2023 ITGRCA MD.

IFTAS's Indian Financial Services (IFS) Cloud initiative as a future service option, not a current compliance obligation. Vendor risk playbook: due diligence, minimum contract clauses, audit and inspection rights, sub-contracting rules, business continuity, breach notification, exit management, right of RBI to examine service providers. Material outsourcing test.

1. 1. The 2023 IT Outsourcing Master Direction in one page 12 min
2. 2. The 2006 Financial Services Outsourcing Guidelines that HDFC was penalised under 9 min
3. 3. Cloud without a standalone cloud framework 11 min
4. 4. Vendor-risk playbook: due diligence to exit management 10 min
5. 5. Pooled audits of common third-party providers 8 min

The full incident-reporting fan-out an RBI RE has to hit on a cyber incident. RBI DAKSH within six hours under the 31 July 2026 Directions for commercial banks; RBI CSITE reporting continuing for non-commercial-bank REs. Parallel CERT-In reporting within six hours under the 28 April 2022 Directions with log retention of 180 days on Indian territory.

DPDP Board reporting within 72 hours under DPDP Rules 2025 Rule 7. Fraud Risk Management Master Directions of 15 July 2024 (three MDs consolidating 36 legacy circulars): Early Warning Signal framework, Red-Flagged Account reporting within seven days, penal action principles, and Board oversight. Worked example: a ransomware event at a bank-cum-PA that is also NCIIPC-designated, showing every clock and every artefact.

1. 1. The DAKSH portal: six-hour clock for commercial banks 11 min
2. 2. The CERT-In Directions 2022 obligation in practice 10 min
3. 3. DPDP Rule 7: the 72-hour clock for personal data breaches 10 min
4. 4. The 2024 Fraud Risk Management Master Directions: EWS, RFA, and seven-day reporting 11 min
5. 5. The single incident record that satisfies four parallel regulator clocks 12 min
6. 6. A worked example: ransomware at a bank-cum-PA that is also NCIIPC-designated 12 min

The 13 August 2025 FREE-AI Framework Report and how a Regulated Entity should operationalise it at Board level pending future binding RBI notifications. The 15 July 2026 Draft Guidance on Regulatory Expectations for Data Governance, its scope and the consultation close on 17 August 2026. The RBI enforcement pattern 2022-2026 as a working model for CISOs: the Kotak Mahindra Bank supervisory business restrictions of 24 April 2024; the IIFL Finance gold-loan and JM Financial Products IPO-financing restrictions of March 2024; the HDFC Bank penalty of November 2025 that cited a 20-year-old instrument; the FY25 aggregate of 353 penalties totalling ₹54.78 crore.

Single-view crosswalk of the RBI stack with SEBI CSCRF, IRDAI 2026 Cyber Security Guidelines, NCIIPC Protected System obligations, and CERT-In. Capstone: design an end-to-end compliance programme for a mid-size private-sector bank that is also a corporate agent for insurance and holds an ARC subsidiary; identify every applicable instrument and the incident-reporting fan-out; draft the IT Strategy Committee agenda.

1. 1. The FREE-AI Framework and Board-level AI governance 11 min
2. 2. The 15 July 2026 Draft Data Governance Guidance: reading the direction of travel 10 min
3. 3. Reading the 2022-2026 RBI enforcement pattern 11 min
4. 4. Crosswalk: RBI stack with SEBI CSCRF, IRDAI 2026 Guidelines, NCIIPC and CERT-In 11 min
5. 5. Capstone: end-to-end compliance programme for a multi-regulated RE 14 min

Final certification exam covering all eight content modules. Every question is anchored to a specific RBI instrument, RBI press release, adjacent regulator instrument, or case study cited in the course. Randomised order, shuffled options, explanations shown after each question cite the source.

Lessons coming soon.