RBI IT governance Master Direction for NBFCs

Last reviewed 19 October 2026 by the InspireGRC team.

1 Apr 2024in force

QuarterlyIT Strategy Committee meetings, at least

Every 6 monthsvulnerability assessment and DR drill for critical systems

Every 12 monthspenetration test for critical systems

Who it covers

RBI issued the Master Direction on 7 November 2023, effective 1 April 2024. Among NBFCs it covers those in the Top, Upper and Middle Layers under Scale Based Regulation. It also covers banks, credit information companies and the all-India financial institutions. Base Layer NBFCs are not in its scope, and Core Investment Companies are excluded.

Board and committees

The Board reviews the IT, information security, cyber security and business continuity policies at least once a year.
An IT Strategy Committee of at least three directors, chaired by an independent director with substantial IT expertise, meaning at least seven years of relevant experience. All members must be technically competent, and it meets at least quarterly.
An IT Steering Committee of senior IT and business management, also meeting at least quarterly.
An Information Security Committee, headed from the risk management side, with the CISO as a member.

Head of IT and CISO

A sufficiently senior, technically competent Head of IT runs the IT function.

The CISO should preferably be of General Manager rank or equivalent. The CISO must not report to the Head of IT and must not carry business targets, reports to the executive overseeing risk management, and reviews cyber security risk with the Board or its committees at least quarterly.

Testing on a timetable

For critical systems and internet-facing systems that customers use:

vulnerability assessment at least every six months, and a penetration test at least every twelve months, plus testing before and after go-live and after major changes
disaster recovery drills at least every six months. A drill means running from the DR site as primary for at least a full working day.
backups restored periodically to prove they work, near-zero data loss and minimal recovery time for critical systems, and identical configurations and patches at the main and DR sites

IS audit

The Audit Committee of the Board oversees information systems audit, approves an IS audit policy and reviews it yearly. IS audit needs its own function or dedicated resources, planned on risk, with continuous auditing encouraged for critical systems.

Incidents

The Direction asks NBFCs to notify CERT-In and RBI proactively, as other regulations require; housing finance companies report to NHB. RBI's separate Master Direction on Outsourcing of IT Services, in force since 1 October 2023, adds that the NBFC must report to RBI within six hours of its IT vendor detecting an incident.

If you sell IT or SaaS to NBFCs

The outsourcing direction reaches you through the contract. It covers cloud and SaaS, and requires the NBFC's agreement with you to include:

service levels, and approval of your sub-contractors
audit and inspection rights for the NBFC and for RBI
your duty to report incidents without undue delay
business continuity, and a clean exit: data returned or securely destroyed, with your cooperation during the handover

Have these answers ready before procurement asks.

Checklist

Confirm your layer under Scale Based Regulation, and therefore whether the Direction applies.
Constitute the IT Strategy Committee and IT Steering Committee, and calendar quarterly meetings.
Check the CISO's reporting line: not to the Head of IT, with no business targets.
List your critical systems, then schedule half-yearly vulnerability assessments and DR drills, and an annual penetration test.
Run at least one DR drill from the DR site for a full working day, and record the issues and fixes.
Review IT, security, cyber and business continuity policies with the Board every year.
Check every IT outsourcing contract for audit rights, incident reporting, exit terms and data location.

Sources

This guide explains the rules in plain English. It is not legal advice; for decisions about your own obligations, speak to a qualified lawyer.

RBI IT governance for NBFCs: what the 2023 Master Direction requires