In 2023, RBI had carried out a control gap assessment of a large NBFC. RBI found that the company’s vendor contracts lacked monitoring and oversight provisions. It had not conducted an IS audit of its network and security solutions. Email gateway audit logs were not retained adequately. And a critical malware alert from its Endpoint Detection and Response (EDR) solution, raised by an infected server, was not analysed or acted upon. The result was a huge penalty under the NBFC IT Framework and related cybersecurity directions.
The discussed NBFC had bought the right tool which worked but what failed was the governance, audit and response around it.
That is the real test of NBFC cybersecurity readiness today. It is now important to know if controls are governed, tested, connected and provable. This guide focuses on seven areas to review across IT governance, risk and security. For each area, it explains what RBI now expects and gives practical first step.
Why NBFC cybersecurity readiness needs a fresh look in 2026
In July 2026, RBI issued the Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026. The Directions took effect immediately and they apply to all NBFCs registered under the RBI Act, the Factoring Regulation Act and the NHB Act, unless a provision specifies otherwise.
The change matters because the previous regime left gaps. The 2023 IT governance Master Direction did not apply to base layer NBFCs or Core Investment Companies. The 2026 Directions bring every layer into one framework, with requirements scaled to size and risk.
Readiness is now a board responsibility
Under the new Directions, the Board must approve technology and cybersecurity strategies and policies, and review them at least once a year. Cybersecurity can no longer sit only with the IT team. The Board owns the outcome, and supervisors will expect evidence that it does.
Which requirements apply to your NBFC
The Directions apply different chapters depending on an NBFC’s layer and asset size. The table below shows where each type of NBFC sits.
| NBFC type | Applicable chapter | What it covers |
| Base layer below ₹500 crore and CICs | Chapter III | Baseline controls: access, maker-checker, BCP and tested backups |
| Base layer at ₹500 crore and above | Chapter IV | IT governance, security policy, IS audit, BCP and outsourcing |
| Middle, upper and top layer (excluding CICs) | Chapter V | Full governance, risk management, testing and resilience requirements |
For the smallest NBFCs, the baseline includes a Board-approved IT and IS policy covering access controls, defined user roles, maker-checker, a BCP policy and periodic backup testing. These NBFCs are also expected to scale up their IT systems as their operations grow.
The seven areas below apply most fully to middle layer and larger base layer NBFCs. Smaller NBFCs can use them as a roadmap for where their obligations will head as they grow.
IT governance: where readiness starts
Every other control depends on clear ownership, so governance is where NBFC cybersecurity readiness begins. These two areas cover who is accountable for cyber risk and whether your NBFC knows what it needs to protect.
Area 1: Board oversight and security leadership
Governance failures tend to surface first in inspections, because they are easy to verify. Either the committee met or it did not.
For middle layer NBFCs and above, the IT Strategy Committee (ITSC) must have at least three directors. Its chair must be an independent director with at least seven years of experience in managing information systems or leading technology or cybersecurity initiatives. The ITSC must meet at least once a quarter. For base layer NBFCs at ₹500 crore and above, the ITSC chair must be an independent director, and no more than six months may pass between meetings.
Security leadership must also be independent. The Chief Information Security Officer (CISO) cannot report directly to the Head of IT and cannot be given business targets. The CISO must present a review of cybersecurity risks and preparedness to the Board, the Risk Management Committee or the ITSC at least every quarter.
A governance review should check the following:
- Whether the ITSC’s composition and meeting frequency match your layer’s requirements.
- Whether the CISO’s reporting line sits outside the IT function.
- Whether Board minutes show real discussion of cyber risk, not just approvals.
First step: Map your current committees, charters and reporting lines against the Directions.
Our guide on structuring an IT governance committee and our blog on drafting a board-approved cybersecurity policy can help.
Area 2: Asset inventory, access and cryptographic controls
An NBFC must first identify its assets. Larger base layer NBFCs must keep a detailed inventory of information assets, with each asset clearly identified. Middle layer NBFCs and above must also classify assets by their criticality to operations. They must monitor software end-of-support dates on an ongoing basis and plan replacements before systems go out of support.
Access is the next layer. Based on risk assessment, NBFCs must use two-factor or multi-factor authentication (MFA) for privileged users of critical systems and activities.
Then comes cryptography. Key lengths, algorithms, cipher suites and protocols must be strong. NBFCs must use published international standards that are not deprecated or known to be insecure. Meeting this requirement depends on knowing where cryptography is used across your systems.
A Cryptographic Bill of Materials (CBOM) gives you that inventory, and our CBOM solutions are built for this purpose.
First step: Check whether your asset register is current, has a named owner for each asset and records end-of-support dates.
Risk: managing what sits outside your perimeter
Much of an NBFC’s risk now sits with vendors, software suppliers and cloud providers, which means, they are outside its direct control. The two areas discussed cover how to keep oversight of that risk, because accountability stays with the NBFC even when the systems do not.
Area 3: Third-party and software supply chain risk
For critical applications, middle layer NBFCs and above must obtain the source code from the vendor or set up an escrow arrangement. They must also obtain written confirmation from the vendor that the application is free of known vulnerabilities, malware and covert channels.
This confirmation must be renewed whenever material changes, including upgrades, are made. Vendor risk controls must also address concentration risk, single points of failure and supply chain risk.
A vendor’s written confirmation is a claim. A Software Bill of Materials (SBOM) gives you evidence to test that claim, because it lists every component inside the software.
Our blog on aligning SBOM with RBI’s IT governance expectations explains the link, and our guide to vendor risk management under RBI Master Directions covers contract and due diligence controls.
First step: List your critical vendors and record what security evidence you hold for each one.
Area 4: Cloud and outsourced infrastructure
Cloud adoption moves infrastructure outside the NBFC’s direct control, but accountability stays with the NBFC. RBI’s Nov 2025 NBFC outsourcing Directions include a dedicated section on the use of cloud computing services. Within RBI’s outsourcing frameworks, IT outsourcing explicitly includes cloud computing and managed security services.
That’s why security testing must also extend to the cloud. The NBFC’s documented approach to vulnerability assessment and penetration testing must also cover systems hosted in a cloud environment.
Contracts matter too. They must give the NBFC access to records and audit trails, the right to audit the service provider, and RBI access to information held by the provider.
A cloud review should cover the following:
- Whether contracts include audit rights, log retention and exit terms.
- Whether cloud workloads fall within your security testing scope.
- Whether configuration risks are reviewed regularly through a cloud security assessment.
First step: Review your cloud contracts against the outsourcing Directions and note any gaps in audit rights or log access.
Security: proving that controls work
A control that has never been tested, monitored or audited offers little assurance to the Board or the regulator. These three areas cover how your NBFC can show that its defences work in practice.
Area 5: Vulnerability assessment and penetration testing
Testing is how an NBFC finds out whether its controls hold under pressure. For middle layer NBFCs and above, critical systems and customer-facing systems in the DMZ need a Vulnerability Assessment (VA) at least every six months and a Penetration Test (PT) at least every 12 months. Testing is also required before go-live, after go-live and after changes.
Where you test matters as much as how often. After implementation, VAPT should run on the production environment. If a test environment is used instead, it must match production, and any deviation must be documented and approved by the Information Security Committee. Identified vulnerabilities must be fixed within a set timeframe, with steps taken to stop known vulnerabilities from recurring.
First step: Build a 12-month testing calendar with a named owner and remediation deadline for each finding.
Our vulnerability assessment checklist is a useful starting point, and our penetration testing services cover the PT requirement.
Area 6: Incident response and cyber resilience
The case at the start of this guide shows that detection alone is not enough. An alert only creates value if someone analyses and acts on it.
For middle layer NBFCs and above, the CISO’s office must manage and monitor the Security Operations Centre (SOC). They must report cyber incidents to RBI on the DAKSH platform within six hours of detection and should also notify CERT-In proactively. Housing finance companies, however, continue to report cyber incidents to NHB, not RBI.
Resilience must also be tested. DR drills for critical systems must run at least every six months. Each drill must involve running operations from the DR site for at least a full working day. NBFCs must also back up data and periodically restore it to confirm the backups are usable.
First step: Run a tabletop exercise that tests the six-hour reporting clock from detection to DAKSH submission. If your team cannot monitor 24/7, managed detection and response can close that gap.
Area 7: IS audit and evidence readiness
Audit readiness is where every other area comes together. For larger base layer NBFCs, an IS audit should be conducted at least once a year, preferably before the statutory audit. For middle layer NBFCs and above, the Audit Committee of the Board must approve an IS Audit Policy, and audit planning must follow a risk-based approach.
RBI also encourages continuous auditing for critical systems, with more frequent control and risk assessments. The goal is continuous evidence. NBFCs must regularly monitor audit trails and system logs to detect and recover from unauthorised activity. If logs are not retained or reviewed, the evidence simply does not exist when an auditor asks for it.
First step: Build an evidence index that maps each control to its current proof, owner and last review date.
Our RBI IT compliance audit readiness guide for NBFCs and gap assessment checklist for NBFCs can help you structure it.
Conclusion
RBI’s 2026 Directions make NBFC cybersecurity readiness layer-specific, board-owned and evidence-driven. Owning the right tools is no longer enough. Each control must be governed, tested, linked to response and backed by proof that holds up under inspection.
The seven areas in this guide give you a structured way to find where its gaps sit. Start with governance, because every other area depends on clear ownership. Then work through risk and security, one first step at a time.
At CyberNX, our RBI Master Direction Compliance Services help NBFCs assess readiness against their applicable layer, close gaps and build continuous audit evidence. If you want to understand where your NBFC stands under the 2026 Directions, speak with our compliance team for a layer-specific readiness review.
FAQs
Does the RBI 2026 cybersecurity framework apply to base layer NBFCs?
Yes. The Directions apply to all NBFCs, with Chapter III covering base layer NBFCs below ₹500 crore and CICs, and Chapter IV covering base layer NBFCs at ₹500 crore and above. The requirements scale with size, so smaller NBFCs face a lighter baseline.
How often should an NBFC conduct VAPT?
Middle layer NBFCs and above must run a VA at least every six months and a PT at least every 12 months on critical and customer-facing DMZ systems. For non-critical systems, the NBFC decides frequency based on risk.
How quickly must an NBFC report a cyber incident to RBI?
NBFCs must report cyber incidents on the DAKSH platform within six hours of detection. Housing finance companies report to NHB instead.
