Most cybersecurity officers at RBI Regulated Entities can name three or four of the instruments the Reserve Bank has issued on cyber. Fewer can name all ten, in order, with dates. If you cannot, you are advising your Board off out-of-date text. And out-of-date text is precisely the pattern the Reserve Bank has been penalising: HDFC Bank was fined ₹91 lakh on 18 November 2025 for outsourcing, KYC and interest-rate lapses that trace back to instrument-reading failures in the compliance chain. Kotak Mahindra Bank lost the ability to onboard new customers online for nine months (24 April 2024 to 12 February 2025) because IT inspection observations kept coming back with the same root cause: the second line of defence had not internalised the instrument stack.
This lesson gives you the stack in one place. The order is the order the Reserve Bank issued each instrument. The applicability column tells you which set of entities the instrument binds today, after the 31 July 2026 consolidation for commercial banks. Where an instrument has been superseded, we say so; where it continues to run in parallel with a newer one, we say that too. Nothing is discarded silently. A CISO who can walk into a CSITE inspection and recite the ten instruments with dates, applicability, and one live obligation each is a CISO whose entity does not end up in a Kotak-shaped restriction.
A note on scope. Every RBI-supervised entity carries at least one of these ten obligations. Most carry six or seven. A large multi-line commercial bank that also operates as a Payment Aggregator through a subsidiary can carry all ten simultaneously, plus the three near-adjacent instruments this lesson closes with. Do not assume overlap; the Reserve Bank does not read the stack that way in inspection.
The ten instruments
| # | Date | Instrument | Applies to (as of Aug 2026) |
|---|---|---|---|
| 1 | 2 Jun 2016 | Cyber Security Framework in Banks [L1-C1] | Continuing baseline for SFBs, PBs, LABs, AIFIs. Superseded for SCBs by the 31 Jul 2026 Directions. |
| 2 | 8 Jun 2017 | IT Framework for the NBFC Sector [L1-C2] | All NBFCs above ₹500 crore asset size. Layered under the 2023 ITGRCA MD for Top / Upper / Middle Layer NBFCs. |
| 3 | 6 Apr 2018 | Storage of Payment System Data [L1-C3] | Every payment-system operator and every entity in the payment ecosystem. |
| 4 | 31 Dec 2019 | Comprehensive Cyber Security Framework for UCBs (Graded) [L1-C4] | All Urban Cooperative Banks, at Level I, II, III or IV depending on size and digital exposure. |
| 5 | 18 Feb 2021 | Master Direction on Digital Payment Security Controls [L1-C5] | SCBs, SFBs, PBs, credit-card-issuing NBFCs. Non-bank PAs reach DPSC indirectly through acquirer bank. |
| 6 | 10 Apr 2023 | Master Direction on Outsourcing of IT Services [L1-C6] | SCBs (ex-RRB), SFBs, PBs, LABs, UCBs, non-scheduled cooperative banks, AIFIs, NBFCs, CICs, EXIM Bank. |
| 7 | 7 Nov 2023 | Master Direction on IT Governance, Risk, Controls and Assurance Practices [L1-C7] | SCBs (ex-RRB, LAB, PB, SFB, Cooperative Banks), Top / Upper / Middle Layer NBFCs, CICs, AIFIs. Effective 1 Apr 2024. |
| 8 | 15 Jul 2024 | Three Master Directions on Fraud Risk Management [L1-C8] | SCBs / AIFIs / SFBs (MD /47); Cooperative Banks (MD /48); NBFCs including HFCs (MD /49). Supersede 36 legacy circulars. |
| 9 | 15 Sep 2025 | Payment Aggregators Directions [L1-C9] | All non-bank Payment Aggregators, in three sub-categories: PA-Physical, PA-Online, PA-Cross Border. |
| 10 | 31 Jul 2026 | Reserve Bank of India (Commercial Banks — Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 [L1-C10] | Commercial banks: SCBs, corresponding new banks, State Bank of India. Excludes SFBs, PBs, LABs, RRBs. |
Three near-adjacent instruments a practitioner must also carry
These three are not RBI cyber instruments in the strict sense but every RBI Regulated Entity carries obligations under them in parallel with the RBI stack. Missing any of them creates the same operational exposure, and in inspection they get flagged as CSITE observations against your ITGRCA governance controls even though they sit under different statutes.
- CERT-In Directions 2022 (28 April 2022), effective 27 June 2022
[L1-C11]. Six-hour incident reporting to CERT-In from the moment of noticing or being brought to notice about the incident. Log retention 180 days on Indian territory. Time synchronisation to NIC or NPL. The point every CISO misses: the CERT-In clock and the DAKSH clock start at the same moment but run under different statutes (IT Act 2000 Section 70B for CERT-In; the 2026 Directions for DAKSH). One incident record, two parallel filings. If your incident-response runbook does not treat both filings as mandatory, you have a gap that CSITE will find. - DPDP Rules 2025 notified 13 November 2025
[L1-C12]. Rule 7 requires the Data Fiduciary to intimate the DPDP Board of India of a personal data breach within 72 hours, and to notify each affected Data Principal in plain-language terms without delay. Note the asymmetry: 6 hours for CERT-In and DAKSH, 72 hours for the DPDP Board, but "without delay" for the affected Data Principal. Get the third one wrong and the reputational exposure is the biggest of the three, because it lands directly with the customer. - Guidelines on Managing Risks and Code of Conduct in Outsourcing of Financial Services 2006
[L1-C13]. Twenty years old and still enforced. HDFC Bank was penalised ₹91 lakh on 18 November 2025 under these Guidelines read with the KYC Master Direction, for outsourcing KYC-determination to external agents in a way the Reserve Bank found impermissible. The 2023 IT Outsourcing Master Direction does not supersede these Guidelines; the two run in parallel. If your outsourcing contracts and vendor-risk register are built only against the 2023 IT Outsourcing MD, you have a 2006-shaped gap that lawyers and CSITE will both find.
What changed in 2026 that most CISOs have not caught up with
The 31 July 2026 Directions are the biggest change to RBI cyber since 2016. Three practical consequences follow from that Direction:
- Commercial-bank cyber obligations are now in one instrument, not scattered across the 2016 CSF plus subsequent circulars. If your entity is a commercial bank, this is the single instrument that governs day-to-day cyber operations, subject to any parallel obligation under the 2023 IT Outsourcing MD, the 2023 ITGRCA MD, the 2024 Fraud Risk Management MDs and the parallel non-RBI obligations under CERT-In and DPDP.
- DAKSH is the reporting channel, with a codified six-hour clock. Earlier CIMS references and the "immediate" language of the 2016 CSF are superseded for commercial banks. The DAKSH portal is the operational reality now.
- The security-testing floor is explicit: vulnerability assessment every six months, penetration test at least annually for critical internet-facing systems, disaster recovery drills at least half-yearly. If your cadence is looser than any of these three, you are non-compliant on the face of the Directions.
How to hold the whole stack in your head
Ten instruments plus three near-adjacent is a lot to carry. A memory technique that has worked for practitioners I have taught: group the instruments by the CISO problem they solve. Governance sits under the 2023 ITGRCA MD (who chairs what, who reports to whom, how often). Baseline security sits under the 2016 CSF, the 2019 UCB Graded Framework and the 2017 NBFC IT Framework, with the 31 July 2026 Directions taking over for commercial banks. Payments and payment data sit under the 2018 Payment Data Storage Direction, the 2021 DPSC Master Direction, and the 15 September 2025 Payment Aggregators Directions. Outsourcing sits under the 2006 Guidelines and the 2023 IT Outsourcing MD together. Fraud and financial-crime cyber sits under the three 15 July 2024 Fraud Risk Management Master Directions. Incident response cuts across the whole stack via the CERT-In Directions 2022, DPDP Rule 7 and the DAKSH six-hour clock in the 2026 Directions.
Group by problem, not by chronology, when you present to the Board. The Board does not want to be walked through ten dated instruments. It wants to know: are we compliant on governance? On baseline security? On payments? On outsourcing? On fraud? On incident response? Six questions, six one-page answers, each answer citing the relevant instrument(s). That is the report format the ITSC should be running with from Q4 2026 onwards.
Practical filing rule
Every RBI-related document your team produces (Board deck, ITSC minutes, IS Audit report, incident report, outsourcing contract memo) should cite the specific instrument, reference number and date of every provision it relies on. Being able to say "This obligation flows from paragraph 3 of the 31 July 2026 Commercial Banks Cybersecurity Directions, read with Chapter II of the 7 November 2023 ITGRCA Master Direction" is what separates the CISO from the senior engineer. It also protects you when a CSITE inspection asks the same question a year later. The inspector already has the instrument in front of them; what they want to see is that your team has read it as attentively as they have.
One more thing on filing rule: rebuild the compliance register in October 2026, do not patch the pre-consolidation register. The 31 July 2026 Directions changed the shape of what a commercial-bank compliance register must look like. Merging new obligations into a register built for the 2016 CSF layout creates duplication and gaps. Better to spend two weeks in October on a clean rebuild than to spend six months in 2027 explaining to CSITE why the register is inconsistent with the current stack.