It’s a rare instance to see cyber incidents at an NBFC go wrong at the point of attack. They usually go wrong in the hours that follow – disbursals are down, customers are calling and the team is still deciding whether to pause a service, and often nobody is sure who is allowed to make that call.
The problem is more structural than technical. Much of what NBFCs work from, was inherited from rules shared with banks, sized for a different kind of business, then filed away and never tested. A plan that has never been rehearsed is not the most reliable plan, especially during a cyber incident.
That is now changing. On Jul 31, 2026, the Reserve Bank of India (RBI) issued a cybersecurity framework built only for NBFCs. It states clearly what a cyber crisis management plan for NBFCs under RBI supervision must cover, who owns it and how quickly an incident must reach the regulator.
This post breaks down the four parts every plan needs, what the six-hour reporting clock changes in practice, and where these plans usually lose their value.
What is a cyber crisis management plan?
A Cyber Crisis Management Plan (CCMP) is a board-approved document. It sets out what your organisation does when a cyber incident stops being a technical problem and starts being a business one.
It is not an incident response runbook. A runbook tells an analyst how to isolate a host. A CCMP tells the business who declares a crisis, who talks to customers, who talks to the regulator and what “recovered” means. RBI treats it as a governance artefact, not an IT document. That distinction puts the plan on the board’s agenda.
What changed for NBFCs on Jul 31, 2026
RBI issued the Reserve Bank of India (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, effective immediately. The earlier IT Framework and IT Governance instructions for NBFCs stand repealed.
Few things stand out for crisis planning:
- Obligations now follow your layer: requirements are split by Base Layer below ₹500 crore, Base Layer at ₹500 crore and above, and Middle Layer and above, excluding Core Investment Companies
- The CCMP is named directly: Base Layer NBFCs at ₹500 crore and above must maintain a CCMP as part of board-approved strategy, and Middle Layer and above must maintain both a cybersecurity policy and a CCMP
- The board owns it: strategies and policies covering incident response, recovery and cyber crisis management must go to the board for review at least annually
- Reporting moved to DAKSH: cyber incidents go to RBI on the DAKSH supervisory platform within six hours of detection
Housing finance companies continue to report incidents to the National Housing Bank (NHB) rather than RBI.
The four aspects RBI specifies for the CCMP
RBI defines the crisis resilience lifecycle in four parts. Each one needs a named owner and a tested process, not a paragraph of intent.
1. Detection
Everything downstream depends on how fast something gets noticed. Coverage should extend across lending platforms, customer portals, collections systems and third-party integrations. Audit trails and log monitoring are explicit requirements, and they are what makes the six-hour clock survivable.
2. Response
This is where decision rights live. Define who can declare a crisis, who authorises service suspension and who approves customer communication. The plan should also carry pre-drafted escalation paths to senior management and the board.
3. Containment
Containment limits the blast radius while the investigation continues: network segmentation, credential resets, disabling compromised integrations and pausing affected products. Preserving forensic evidence while containing damage is a real tension, so the plan should say which takes priority and who decides.
4. Recovery
Recovery is measured, not declared. Define Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for every critical system, run disaster recovery drills at least half-yearly and confirm that restored backups actually work.
Why the six-hour clock reshapes the plan
The six hours window is triggered by detection, not diagnosis, so the report goes in before anyone knows the root cause. That changes how the plan is written:
- Two clocks run at once: RBI expects reporting on DAKSH within six hours, and the CERT-In Directions of Apr 28, 2022 require notification to the Indian Computer Emergency Response Team (CERT-In) on a parallel six-hour timeline
- Access must be pre-arranged: portal registration, credentials and named filers should be sorted long before an incident, with at least one backup
- Templates beat drafting: keep organisation details pre-filled so the team only completes incident-specific fields, and file what is known rather than waiting for a complete picture
Where NBFC crisis plans lose their value
A CCMP that exists on paper and one that works under pressure are different documents. The common failure points are usually structural:
- Untested plans: RBI expects periodic drills, including crisis communication testing with vendors and service providers, not just internal tabletop sessions
- Vendors outside the plan: if a managed service provider or a lending-as-a-service partner is part of the failure, the crisis plan needs to reach them
- Unclear reporting lines: the Chief Information Security Officer (CISO) cannot report to the head of IT and must place a cybersecurity review before the board or its risk committee quarterly
- No lessons-learnt loop: findings from drills and past incidents should update the plan, and the board should see that update
- Stale annexures: contact lists, escalation matrices and vendor details age fast, and they fail first at 2 AM
Conclusion
The 2026 Directions moved crisis management from a documentation exercise to a governance one. Detection, response, containment and recovery each need an owner. The six-hour window needs rehearsal. And the board needs a plan it has actually reviewed.
At CyberNX we help NBFCs and HFCs build a cyber crisis management plan that stands strong in an audit as well as in a real incident. Our RBI Master Direction Compliance service maps your controls to the applicable chapter, closes the gaps and keeps the plan current as your infrastructure and risk profile change. Talk to our experts and find out where your crisis plan stands today.
Cyber crisis management plan for NBFCs under RBI supervision FAQs
What is a cyber crisis management plan for an NBFC?
It is a board-approved plan that defines how an NBFC detects, responds to, contains and recovers from a cyber incident. It covers decision rights, escalation paths, customer communication and regulatory reporting. RBI treats it as part of board-approved strategy, not an IT-owned document.
Which NBFCs need a CCMP under the 2026 Directions?
Base Layer NBFCs with asset size of ₹500 crore and above must put a CCMP in place. Middle Layer, Upper Layer and Top Layer NBFCs, excluding Core Investment Companies, must maintain a cybersecurity policy and a CCMP. Smaller Base Layer entities and Core Investment Companies follow a lighter baseline.
How soon must an NBFC report a cyber incident to RBI?
Within six hours of detection, filed on the DAKSH supervisory platform. CERT-In must be notified in parallel under its 2022 Directions, and housing finance companies report to NHB instead of RBI. The clock starts at detection, so partial reporting followed by updates is the workable approach.
How often should a cyber crisis management plan be tested?
Testing frequency depends on the applicable RBI chapter. For Chapter IV NBFCs, test it at least annually, and sooner if systems or vendors change materially. Disaster recovery drills for critical systems are expected at least half-yearly, and crisis communication drills should include service providers. Every drill should feed updates back into the plan.
