Skip to content
VITI Security
Contact

RBI Directions 2026

RBI Cybersecurity Framework Scorecard

Check your bank, NBFC or payment operation against RBI’s cybersecurity and technology-risk expectations.

How this is calculated

  1. Each of the ten questions is one expectation from RBI’s cybersecurity directions; each Yes counts as one control in place.
  2. Readiness = controls in place divided by ten, rounded to a whole percentage. 80% or more is green, 50% to 79% amber, below 50% red.
  3. Every No becomes a gap note that cites the paragraph of the 2026 Directions (or the 2018 localization circular) behind it.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Weight per control
Equal (10 percentage points each)
Colour thresholds
Green from 80%, amber from 50%

Worked example

The calculator run on its default inputs:

Board-level IT Strategy Committee
No
Information security policy plus a Board-approved cybersecurity policy
No
Periodic IT and cyber risk assessment
No
Cyber Security Operations Centre (SOC) monitoring
No
VA every 6 months and PT every 12 months for critical systems
No
Cyber incidents reported to RBI within 6 hours of detection (and to CERT-In)
No
MFA for privileged users of critical systems
No
Vendor / outsourcing risk managed per RBI outsourcing directions
No
Payment system data stored only in India
No
DR drills for critical systems at least every 6 months
No

0/10 controls in place

0% ready

Controls in place
0 of 10
Gaps to close
10
Readiness
0%

All ten answers default to No, so the result is 0/10 controls in place (0% ready) with ten gaps listed. Each Yes adds 10 points; eight Yes answers reach the green band.

Sources

Sources last checked September 2026.

Limitations

The paragraph references are to the commercial-bank Directions; NBFCs, small finance banks, payments banks, co-operative banks and others have parallel directions whose details differ, and several requirements scale with the bank’s risk assessment. A yes/no answer cannot show whether a control meets the stated frequency. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.