RBI Cybersecurity Requirements for NBFCs: What to Fix First

Quick answer: RBI cybersecurity requirements for NBFCs come mainly from the 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices, which applies to Top, Middle and Upper Layer NBFCs from 1 April 2024, and the 2023 Master Direction on Outsourcing of IT Services. They require board oversight, a CISO, regular VA/PT, half-yearly DR drills, logging and strict vendor control.

Many NBFCs discover their cybersecurity gaps the hard way: during an RBI inspection, after a vendor incident, or when a fraud is traced to a shared admin password. The policies usually exist. What is missing is evidence that the controls actually run, on schedule, with someone accountable for each one.

NBFCs now run most of their business on digital systems: loan origination apps, collection platforms, core lending software and partner APIs. That makes them attractive targets for fraud, ransomware and data theft, and it puts responsibility on boards, risk teams and business heads, not only the IT head. This guide summarises what RBI expects in plain English, shows where NBFCs commonly fall short and gives a step-by-step plan to close the gaps. Always read the original RBI texts and take professional advice for your specific category, as RBI updates and consolidates its directions from time to time.

The Main RBI Cybersecurity Requirements for NBFCs

IT Governance, Risk, Controls and Assurance Practices

RBI issued the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices on 7 November 2023, effective from 1 April 2024. For NBFCs, it applies to entities in the Top, Upper and Middle Layers under the scale-based regulation framework; NBFC Core Investment Companies are excluded. It covers IT governance, IT and information security risk management, business continuity and disaster recovery, and information systems audit.

Outsourcing of Information Technology Services

The Master Direction on Outsourcing of IT Services was issued on 10 April 2023 and came into effect on 1 October 2023. It sets rules for selecting, contracting with and monitoring technology vendors, and makes clear that the NBFC remains responsible for outsourced activities.

CERT-In directions

Beyond RBI, the CERT-In directions of April 2022 require organisations in India to report specified cyber incidents to CERT-In within six hours of noticing them and to keep ICT system logs for a rolling 180 days. The RBI direction also asks regulated entities to proactively notify CERT-In and RBI of incidents as per regulatory requirements. Our CERT-In 6-hour incident reporting checklist explains how to prepare.

Base Layer NBFCs fall outside the scope of the 2023 IT governance direction, but they are still expected to manage IT and cyber risk sensibly. Check the instructions that apply to your category.

Key Requirements at a Glance

Area	What the IT governance direction expects	Evidence to keep
IT Strategy Committee	Board-level committee that meets at least quarterly	Charter, agendas, minutes, dashboards presented
IT Steering Committee	Senior IT and business representation, meets at least quarterly	Minutes, project and risk reviews
CISO	Senior executive who reports directly to the Executive Director or equivalent overseeing risk management	Appointment note, reporting line, CISO reports to committees
Vulnerability assessment and penetration testing	For critical and customer-facing systems in the DMZ: VA at least every six months, PT at least every 12 months	Test reports, closure proof, retest results
Disaster recovery	DR drills for critical information systems at least half-yearly	Drill plans, results against RTO and RPO, action items
Incident reporting	Proactive notification to CERT-In and RBI as required	Incident register, reports filed, timelines
IT outsourcing	Board-approved policy, due diligence, audit rights, exit plans	Vendor register, contracts, periodic reviews

Governance: What the Board Must Own

RBI places clear responsibility on the board and senior management. The IT Strategy Committee oversees IT strategy, resources and risk. The CISO should be independent of IT delivery, which is why the direction has the CISO report to the executive overseeing risk management rather than to the head of IT. Board-approved policies on information security, cyber security, IT risk, business continuity and IT outsourcing should be reviewed periodically.

A common gap is having the right committees on paper but no meaningful reporting to them. Fix: give the board a short, regular dashboard covering open high-risk vulnerabilities, incidents, audit findings, vendor risks and DR test results, with trends over time.

Security Controls and Testing

The direction expects a structured control environment, not just antivirus and a firewall. Priority areas include:

• Asset inventory: an up-to-date list of hardware, software, data and interfaces, classified by criticality.
• Access control: least privilege, multi-factor authentication for privileged and remote access, and regular access reviews.
• Vulnerability management: VA and PT on the schedule above, with tracked closure of findings. See our note on VAPT services.
• Logging and monitoring: audit and system logs for applications handling sensitive data, with alerts reviewed by a security operations function, in-house or through SOC as a service.
• Secure change management: security testing before new apps or major changes go live, and controlled data migration with sign-offs and audit trails.
• Encryption: accepted, non-deprecated cryptographic standards for data at rest and in transit.

Leaked staff and partner logins are a growing route into financial firms. Our post on the RBI cyber advisory on credential exposure covers what to do about them.

Business Continuity and Disaster Recovery

An NBFC that cannot disburse or collect for a few days faces real financial and reputational damage. The direction asks for a documented BCP and DR framework with defined recovery time and recovery point objectives for critical systems, and half-yearly DR drills for critical information systems.

Fix: make drills realistic. Switch actual workloads to the DR site, measure how long recovery really takes, record data loss against your targets and include key vendors such as your loan management software provider. A plan that has never been tested is not a plan.

Managing IT Outsourcing and Vendor Risk

Most NBFCs depend on external providers for core lending systems, cloud hosting, collection apps and customer support. Practical steps under the outsourcing direction include:

• Keep a board-approved IT outsourcing policy and a register of all IT service providers.
• Do risk-based due diligence before signing, covering financial strength, security practices and past performance.
• Include audit and inspection rights for both the NBFC and RBI in contracts.
• Define security obligations, incident reporting duties, data handling and service levels.
• Agree on exit plans, including safe return or destruction of data.
• Review material vendors periodically, not only at renewal time.

Common Gaps Found in NBFC Reviews

• Shared admin accounts: generic logins on servers, databases and cloud consoles make it impossible to trace who did what. Fix: named accounts with MFA and a privileged access tool.
• Customer data on staff phones: field and collection apps store data without encryption or remote wipe. Fix: mobile device management and app-level encryption.
• Open partner APIs: fintech and partner APIs exposed without rate limits, strong authentication or monitoring. Fix: an API gateway with authentication, throttling and logging.
• Live data in test systems: old test environments hold copies of customer data with weaker controls. Fix: mask data or remove old environments.
• Vendor reports accepted without review: audit observations stay open for years. Fix: track vendor findings in the same register as internal ones.

A Practical Compliance Roadmap

If you are starting or restructuring your programme, work in this order:

1. Gap assessment: compare current policies, controls and evidence against each applicable direction for your layer.
2. Prioritise: fix governance gaps and high-risk technical issues first, such as unpatched internet-facing systems or shared admin accounts.
3. Assign owners: give every control a named owner and a review date.
4. Build evidence: store policies, minutes, test reports and closure proof in one organised repository.
5. Test on schedule: run VA/PT, DR drills and IS audits at the required frequency and track every finding to closure.
6. Report to the board: present a short dashboard to the IT Strategy Committee every quarter and record its decisions.

Your DR planning can borrow from our guide to a disaster recovery plan.

Frequently Asked Questions

Which NBFCs must follow RBI's IT governance direction?

NBFCs in the Top, Upper and Middle Layers under scale-based regulation, excluding Core Investment Companies. It took effect from 1 April 2024.

How often must NBFCs run VA/PT?

For critical systems and customer-facing systems in the DMZ, vulnerability assessment at least once every six months and penetration testing at least once every 12 months.

Who should an NBFC's CISO report to?

The direction says the CISO should report directly to the Executive Director or equivalent executive overseeing the risk management function, which keeps security independent of IT delivery.

How quickly must a cyber incident be reported?

Under the CERT-In directions, specified incidents must be reported to CERT-In within six hours of noticing them. RBI also expects proactive notification. Check the current RBI instructions for your category.

Do Base Layer NBFCs need to follow these rules?

The 2023 IT governance direction does not apply to them, but they still need to manage IT and cyber risk and follow the instructions that apply to their category, including CERT-In directions.

How Affix Center Can Help

Affix Center is a Mumbai-based IT and software company. Our cybersecurity services support NBFCs with gap assessments, VA/PT coordination, security monitoring and DR planning, and our enterprise advisory team helps structure governance, policies and vendor risk reviews so evidence is ready when supervisors ask.

To discuss your compliance position, contact us.