RBI IT Governance Directions for NBFCs: 2026 Board Guide
RBI IT Governance Master Directions: What NBFC Boards and CTOs Must Have in Place
Last reviewed: November 2026
The RBI IT governance directions for NBFCs are the rules on how boards and management govern technology, cyber risk and resilience. Since 31 July 2026 they sit in a new instrument, the NBFC Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026.
This guide is for CTOs, CISOs and members of board IT Strategy Committees at NBFCs. It explains what replaced the old Master Direction, which tier applies to you and what must be in place now.
Key Takeaways
- The RBI issued the NBFC Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 on 31 July 2026, effective immediately.
- They repealed earlier IT framework and IT governance instructions for NBFCs, so policies citing the November 2023 Master Direction need updating.
- Requirements are tiered: Base Layer below ₹500 crore, Base Layer at ₹500 crore and above, and Middle Layer and higher.
- Cyber incidents go on the RBI's DAKSH platform within six hours of detection.
What Replaced the IT Governance Master Direction?
A single NBFC-specific direction now covers IT governance, cybersecurity, resilience and IS audit. It came into force on the day it was issued.
| Instrument | Date | Status for NBFCs |
|---|---|---|
| Master Direction on IT Framework for the NBFC Sector | 2017 | Within the repealed IT framework instructions |
| Master Direction on IT Governance, Risk, Controls and Assurance Practices | 7 November 2023 | Within the repealed IT governance instructions |
| NBFC Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 | 31 July 2026 | In force |
The repeal was communicated through an RBI circular of the same date, with a saving clause for actions already taken. Confirm the exact list of repealed instruments against that circular before updating policy references.
The RBI issued parallel directions for other regulated entity types. The phrase "IT Governance Master Direction" therefore no longer names the current rule for NBFCs, though most of its governance ideas carried over.
Which Chapter Applies to Your NBFC?
Your layer and asset size decide the chapter. Each tier builds on the one below.
| Tier | Who It Covers | Core Expectations |
|---|---|---|
| Chapter III | Base Layer below ₹500 crore, and CICs | Board-approved policies, BCP policy, tested backups, system-generated reports |
| Chapter IV | Base Layer at ₹500 crore and above | IT Strategy Committee, annual IS audit, annual BCP testing, change management, outsourcing controls, MIS |
| Chapter V | Middle, Upper and Top Layer, excluding CICs | Full committee structure, independent CISO, half-yearly DR drills, VAPT cycles, IS audit function |
Chapter IV is not a light version. Base Layer NBFCs at ₹500 crore and above must also report cyber incidents on DAKSH within six hours, and their IT outsourcing contracts must give audit rights and RBI access to records.
Housing finance companies follow the same structure but report cyber incidents to the National Housing Bank. Smaller NBFCs must also scale up their systems as size and complexity grow.
What Must the Board Have in Place?
The board owns technology strategy and risk, and must review key policies at least annually. At Middle Layer and above, it works through three committees.
| Body | Composition | Frequency and Focus |
|---|---|---|
| IT Strategy Committee | At least three directors, chaired by an independent director with seven or more years of technology or cyber experience | At least quarterly, reviews IT and security budgets and BCP/DR at least annually |
| IT Steering Committee | Senior management from IT and business functions | Quarterly, reports to the ITSC and MD/CEO |
| Information Security Committee | CISO plus business and IT representatives, headed from the risk vertical | Periodic, under ITSC oversight |
At Base Layer NBFCs of ₹500 crore and above, the ITSC is chaired by an independent director, includes the CIO and CTO, and meets at least every six months.
Which Policies Need Board Approval?
The board approves the technology and cybersecurity strategy and the policies beneath it. At Middle Layer and above, that set covers IT, information assets, business continuity, information security and cyber crisis management, each reviewed at least annually.
Keep one register that links every policy to its approval date, owner and next review. Inspection teams usually ask for this first.
The CISO's independence is the change boards most often miss. At Middle Layer and above, the CISO reports to the executive director for risk, not the Head of IT, and places a quarterly cyber risk review before the board, its risk committee or the ITSC.
Would your IT Strategy Committee pass a supervisory review against the 2026 directions today?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build lending platforms with security and audit controls designed in.
What Must CTOs and CISOs Run Day to Day?
Most obligations become recurring controls with evidence. These are the ones with hard numbers for Middle Layer and higher NBFCs.
- DR drills. At least half-yearly for critical systems, with the DR site run as primary for at least a full working day.
- Recovery targets. A minimal RTO approved by the ITSC and near-zero RPO for critical systems, with identical DC and DR configurations.
- Vulnerability testing. Vulnerability assessment every six months and penetration testing every 12 months for critical and customer-facing DMZ systems.
- Incident reporting. DAKSH within six hours of detection, plus proactive notification to CERT-In.
- Access and logs. Audit logging for applications touching critical data, and MFA for privileged users of critical systems based on risk.
- Vendors. Source code or escrow for critical applications, and vendor certification that software is free of known vulnerabilities and malware.
- Legacy technology. Tracking of end-of-support dates and a technology refresh plan.
- Data integrity. Automated, tested data transfers between critical applications, with no manual modification in transit and full audit trails.
- IS audit. An audit committee-approved IS audit policy, a dedicated IS audit function and, for critical systems, the option of continuous auditing.
Who Owns What Between IT and Security?
The Head of IT is the first line of defence. That role aligns projects with strategy and puts the DR set-up and business continuity strategy in place.
The CISO and the Information Security Committee sit apart from delivery and challenge it. Write this split into job descriptions and committee charters, so ownership of each control is clear when findings arrive.
Resilience design matters as much as drills. Our guide to multi-region failover and RPO covers the architecture choices behind near-zero data loss.
Vendor risk now includes concentration and supply chain risk. A structured approach to vendor due diligence helps meet that expectation.
What Does a Year of Compliance Look Like?
The workload is easier to resource once it is counted. Consider an illustrative Middle Layer NBFC with 12 critical or customer-facing systems, five of which are classed as critical for DR.
| Control | Frequency | Annual Count |
|---|---|---|
| Vulnerability assessments | Every six months × 12 systems | 24 |
| Penetration tests | Every 12 months × 12 systems | 12 |
| DR drills | Half-yearly × 5 critical systems | 10 |
| ITSC meetings | Quarterly | 4 |
| IT Steering Committee meetings | Quarterly | 4 |
| CISO cyber risk reviews | Quarterly | 4 |
That is 36 security tests and 10 DR drills a year before any change-driven testing. Each needs a report, a remediation tracker and closure evidence.
Now the incident clock. If the security team detects an incident at 11:10 pm, the DAKSH report is due by 5:10 am the next day.
The lesson for leadership: a six-hour window needs an on-call process and pre-approved templates. An IT incident impact assessment agent can draft the first impact view while engineers contain the issue.
Which Gaps Do NBFCs Commonly Leave?
Most gaps come from carrying the old structure forward without checking the new text.
- CISO under the CTO. A reporting line into IT breaches the independence requirement at Middle Layer and above.
- Paper DR drills. Drills that never run production from the DR site for a full working day do not meet the standard.
- Policies citing repealed rules. References to the 2023 Master Direction weaken audit and inspection outcomes.
- Weak vendor contracts. Technology contracts without audit rights, log access or RBI access leave the NBFC unable to evidence control.
- Open findings. Audit and VAPT findings without owners and dates are a recurring supervisory concern.
An internal audit issue tracking agent can keep findings, owners and closure evidence in one place.
What Is Changing Next?
Technology risk now overlaps with data protection. The main obligations under the DPDP Rules, including breach reporting to the Data Protection Board, are due from 13 May 2027.
The RBI has also consulted on folding compliance and risk-based internal audit instructions into the NBFC Governance Directions. Boards that want to quantify exposure across both areas can use a cyber risk quantification agent to put numbers to the risk.
Need a gap assessment against the 2026 directions before your next inspection?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build secure lending platforms and AI agents for NBFCs.
