RBI Cyber Security Framework for NBFCs: Requirements Explained

Most NBFCs think they are compliant with the RBI's cyber framework until the day an RBI inspection team sits across the table and asks a deceptively simple question: show me the board minute where your cyber security policy was approved, and show me the date it was last reviewed. The silence that follows is where a lot of NBFCs lose the room.

The framework itself is not exotic. It is a set of clear expectations dressed up in RBI circular language. The problem is that most non-banking financial companies treat it as an IT department chore rather than a board-owned obligation, and then discover during a Supervisory review that the paperwork does not exist, the responsibilities were never assigned, and the incident nobody reported to CERT-In is now a supervisory finding with your name on it.

The confusion starts because there is not one master document. RBI has released the requirements in layers over several years, and which layer binds you depends on your asset size and your customer interface. Getting this classification wrong is the first mistake, because you either over-engineer controls you do not need or, far more dangerously, ignore ones you do.

The foundational circular is the June 2017 Master Direction on Information Technology Framework for the NBFC Sector (DNBS.PPD.No.04/66.15.001/2016-17). That was the baseline. It was then significantly strengthened and superseded in practice by the November 2023 Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/DoS/2023-24/107, effective 1 April 2024), which now covers NBFCs alongside banks and other regulated entities. On top of that sits the Digital Lending guidelines and, for anyone touching payments, the broader RBI cyber expectations.

A practical rule: if you are a Base Layer NBFC under the Scale Based Regulation with a small book and no digital lending, your obligations are lighter but not zero. The moment you cross into Middle or Upper Layer, or run a lending app, assume the full 2024 IT Governance framework applies and build for that. Regulators do not accept we thought we were exempt as a defence.

Strip away the circular prose and the RBI framework comes down to nine expectations. Every audit finding I have seen maps back to one of these being missing, stale, or owned by nobody.

The single most common gap is governance that exists only on a slide. NBFCs draw a neat org chart with an IT Strategy Committee and a Steering Committee, and then never actually convene them. The 2024 IT Governance Master Direction is explicit here: the Board is responsible for IT governance, an IT Strategy Committee of the Board must meet at least once a quarter, and a Steering Committee at the executive level must assist it.

The framework also expects a clear separation between the Chief Information Security Officer and the head of IT. This trips up smaller NBFCs constantly. You cannot have the same person who builds the systems also independently attest that they are secure. That is marking your own homework, and an examiner will call it out immediately. If your CISO reports to your CTO, you already have a finding waiting.

Here is where documentation and reality diverge most sharply. Almost every NBFC has a BCP document. Almost none can produce evidence of a DR drill in the last twelve months with results, gaps found and gaps closed. The framework does not just want a plan; it wants a tested plan with defined recovery objectives.

Concretely, the examiner will ask for your documented Recovery Time Objective, which is how fast you must be back up, and your Recovery Point Objective, which is how much data you can afford to lose. Then they will ask for the last DR test report showing whether you actually met them. If your RTO on paper is four hours but your last failover took a day, or you have never failed over at all, that gap is your finding.

If you run a lending app, your data is almost certainly flowing through a Lending Service Provider, a cloud host, a KYC vendor, a bureau and an SMS or WhatsApp gateway. The RBI's outsourcing and digital lending expectations make one thing unambiguous: you remain fully responsible for a control failure at any of them. Outsourcing the activity does not outsource the accountability.

The Digital Lending guidelines add hard requirements. Data collected by the app must be need-based and with explicit borrower consent. It must be stored on servers located in India. The borrower must be able to see, and where relevant delete, their data. And the LSP arrangement must be governed by a written agreement that gives you audit rights over their controls. Most NBFCs sign a commercial contract and skip the security annexure entirely.

When an incident hits, you are actually running two clocks at once, and NBFCs routinely miss both. The CERT-In Directions of April 2022 require you to report a cyber incident within six hours of noticing it. Six hours is not a business day; it is a genuine sprint, and the only way to hit it is to have the template, the contacts and the escalation path ready before the incident, not after.

Separately, RBI expects prompt reporting of material cyber incidents through its own supervisory channels. The framework also requires you to synchronise all system clocks to the Network Time Protocol servers of NIC or NPL, and to retain logs securely for a rolling 180 days within Indian jurisdiction. That log retention clause is the one auditors love, because it is trivially verifiable and frequently failed.

Picture the scene an examiner walks you through. A collections agent clicks a phishing link on a Tuesday afternoon. Your endpoint tool flags anomalous outbound traffic at 3pm. Nobody is watching the console until Wednesday morning. By the time your IT head decides it is serious enough to report, forty hours have passed. You have breached the six-hour CERT-In window, your logs from the affected server were rotated out because retention was set to thirty days, and you cannot reconstruct what left the network. That is not a hypothetical; that is a Thursday at a mid-sized NBFC.

NBFCs consistently underestimate both the timeline and the spend, then try to compress everything into the fortnight before an inspection. Real readiness for a mid-sized NBFC is a three to six month programme, and the cost depends heavily on how much documentation and tooling already exists.

These are indicative ranges for a mid-sized NBFC and scale with the number of applications, cloud footprint and whether you run a lending app. The expensive mistake is not the audit fee. It is the remediation you are forced to do at speed when a finding lands, or worse, the supervisory action that follows a reportable incident you handled badly.

After enough inspections you start to see the same failures recur. If you fix only five things before your next review, fix these.

The Digital Personal Data Protection Act 2023 now sits on top of everything above, and for an NBFC the two frameworks reinforce each other. Borrower data is personal data. Your consent capture, your purpose limitation, your breach notification and your data-retention decisions are now legal obligations, not just RBI expectations. When the DPDP rules and the Data Protection Board become fully operational, a mishandled breach can attract both a supervisory finding and a financial penalty. Build your consent and data-governance controls once, and map them to both regimes.

If an inspection were confirmed for next month, this is the list I would hand you. None of it is optional, and most of it is documentation you either have or you do not.

Come back to that opening question: show me the board minute, and show me the review date. If you can answer that one cleanly, and produce the DR drill report, the vendor annexures and the incident template behind it, you are most of the way to a clean inspection. The framework is not trying to catch you out. It is asking whether the people who run the money also own the risk. Most of the work is proving that they do.

If you would rather not discover the gaps in the inspection room, our team at CyberSigma are senior CERT-In empanelled auditors and PCI QSAs who run these RBI readiness reviews hands-on, from policy and governance through to the DR drill and the VAPT. We are happy to walk your framework with you before someone from RBI does.