RBI and SEBI · Cybersecurity regulation for Indian financial services
RBI and SEBI cybersecurity compliance for regulated entities that must show resilience, not just policies.
Banks, NBFCs and payment operators answer to the Reserve Bank of India; brokers, depositories, fund houses and market infrastructure answer to SEBI's CSCRF. Neither regulator issues a certificate. Sterling's expert and experienced consultants map the directions that apply, close the gaps with your teams and prepare the evidence your board, auditors and supervisor will ask for. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced information security consultants, with cyber governance programmes delivered for financial services across countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; RBI and SEBI supervise compliance
8,100+ client engagements in 60+ countries.
Financial services client experience
What it is
What are the RBI and SEBI cybersecurity frameworks?
They are binding regulatory instructions, not voluntary standards. The Reserve Bank of India sets cyber and technology risk rules for the banks, NBFCs and payment operators it regulates; the Securities and Exchange Board of India does the same for market intermediaries and infrastructure through one consolidated framework.
Both expect board ownership of technology risk, an independent security officer, tested recovery, regular vulnerability testing, continuous monitoring and prompt incident reporting. SEBI adds a periodic cyber audit by a CERT-In empanelled auditing organisation and, for its larger entities, a measured Cyber Capability Index score.
Current directions. RBI issued its Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 on 31 July 2026 for commercial banks, NBFCs and other entity types, replacing earlier IT governance and cybersecurity instructions for those entities; non-bank payment system operators follow the RBI Master Directions on cyber resilience and digital payment security controls of July 2024. SEBI's CSCRF was issued on 20 August 2024 with later clarifications and extensions.
Who it is for
Who needs RBI or SEBI cybersecurity compliance?
Any entity licensed or registered by either regulator, and in practice many of their technology suppliers. The work usually starts from one of four places:
- A supervisory inspection or regulator letter. Findings from RBI or SEBI, or a new direction with a compliance date, set a fixed deadline.
- A bank or broker client pushes the rules down to you. Regulated entities remain accountable for outsourced technology, so vendors, fintech partners and cloud providers inherit contractual security clauses.
- A new licence or a change of category. Growth can move an entity into a stricter tier.
- A group with several regulated arms. A group with a bank, an NBFC and a broking or asset management company needs one security programme that satisfies both regulators.
Requirements
What are the main RBI and SEBI cybersecurity requirements?
The two regimes are organised differently. RBI's 2026 directions for commercial banks are arranged in chapters; SEBI's CSCRF is arranged around six cyber resilience functions, each with its own standards and guidelines, scaled by entity category.
- RBI, role of the board and IT governance: a board-level IT Strategy Committee and a CISO who reports to the executive overseeing risk, not the head of IT.
- RBI, IT and information security risk management: identifying, assessing and treating technology risk, including risk in outsourced and partner arrangements.
- RBI, baseline cybersecurity and resilience: the minimum controls, including vulnerability assessment and penetration testing of critical systems and half-yearly disaster recovery drills.
- RBI, security operations centre and IS audit: continuous monitoring, and a risk-based IS audit function overseen by the Audit Committee.
- SEBI CSCRF, Governance and Identify: policy, roles, oversight, and knowing your assets and their criticality.
- SEBI CSCRF, Protect and Detect: access, data and network security, patching, and security monitoring through your own SOC or the Market SOC.
- SEBI CSCRF, Respond and Recover: incident handling, forensic follow-up, business continuity and disaster recovery.
What does useful RBI and SEBI cyber evidence look like?
Board minutes showing technology risk was decided, an asset inventory that matches what runs, dated test reports with vulnerabilities tracked to closure, DR drill records showing a real switch-over, and incident logs with detection and reporting times.
Compliance route
How do you comply with the RBI and SEBI cybersecurity frameworks?
There is no certification body and no certificate. The regulator judges compliance through supervision, returns and inspection, informed by the audits the directions require.
- 01Confirm which directions and category apply.Identify the regulator, the entity-specific directions and, for SEBI, your CSCRF category; then fix the systems used for regulated activities that fall in scope.
- 02Gap analysis: compare current controls with each requirement.We test governance, policies, technical controls and records against the applicable directions and agree actions, owners and dates.
- 03Build governance and close the control gaps.Board and committee roles, the security officer's reporting line, policies, monitoring, testing, recovery and third-party controls put into daily use.
- 04Review internally and prepare for the required audits.Internal review and IS audit readiness first; SEBI regulated entities then commission their cyber audit from a CERT-In empanelled auditing organisation.
- 05Report, remediate and keep evidence current.Submit reports as the directions require, report incidents within the set timelines and track every finding to closure before the next cycle.
Check the route before you sign. Nobody can sell you an RBI or SEBI cybersecurity certificate. For a SEBI cyber audit, confirm the firm's empanelment directly with CERT-In, and keep the consultant who prepares you separate from the auditor who reports on you. The certification buyer's checklist
Cost
How much does RBI or SEBI cybersecurity compliance cost?
The budget follows the obligations: a small intermediary on outsourced systems faces a very different bill from a bank running its own security operations centre.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Entity type and category, current maturity, and whether you choose Design™ or Drive™ |
| Required audits and testing | IS audit, SEBI cyber audit, vulnerability assessment and penetration testing, quoted by the firms you appoint |
| Monitoring | An in-house or outsourced SOC, or onboarding to the Market SOC where SEBI allows it |
| Your team's time | Board and committee time, and the technology effort to fix findings |
| Software and learning | Effivity and Sterling Academy access, itemised at no additional cost |
What moves the price
- Number of critical systems, data centres and DR sites
- Depth of outsourcing and third-party dependencies
- Open findings from past inspections or audits
What a Sterling proposal always shows
- Deliverables, assumptions and exclusions in writing
- Milestones linked to deliverables
- One all-inclusive proposal for our work
Timeline
How long does RBI or SEBI cybersecurity compliance take?
The regulator's date usually sets the finish line. Governance and policy move quickly; monitoring, recovery testing and legacy fixes take longer. As an estimate, most programmes take six to twelve months.
| Phase | What sets the pace |
|---|---|
| Applicability and gap analysis | Access to technology, risk and audit owners, and past inspection reports |
| Governance and control build | Board calendars, procurement of tools and changes to live systems |
| Testing and drills | Test windows, DR switch-over scheduling and closing what the tests find |
| Audit and reporting | The auditor's availability and the reporting dates the directions set |
Your engagement
What your RBI or SEBI cyber compliance engagement includes
Sterling OS™ runs every engagement, and each phase has a clear meaning for regulated financial entities. Sterling does not certify, and it does not conduct the audits the directions require: RBI and SEBI supervise compliance, and the auditors you appoint report independently.
Design™: guided support
Your security and risk teams build the programme; a Sterling consultant sets the method, reviews every policy and control and coaches the owners.
Drive™: managed support
The alternative to Design™ when your team is stretched: Sterling drafts the policies, registers and board papers with your owners and runs the programme to the audit.
Sustain™: after the first compliance cycle
Periodic internal reviews, tracking of audit and inspection findings, and readiness for each new circular or reporting cycle.
Automate™: Effivity
Your security management system runs in Effivity, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Compliance decisions remain with RBI and SEBI; audit opinions remain with the auditors you appoint.
Often combined with
Standards organisations pair with RBI and SEBI cybersecurity frameworks
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
- Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
- BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
- CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
Effivity · security management software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the RBI and SEBI cyber frameworks.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. For a regulated financial entity, your consultant sets up the workspace within the agreed scope: controlled policies, the asset and risk registers, audits and findings, incidents, supplier assessments, training records, KPIs and board review in one place. Regulatory submissions still go to RBI or SEBI through their own channels; Effivity keeps the programme behind them running and dated. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Scope, regulators and interested parties
The entities, systems and regulated activities in scope, with the directions that bind each one, reviewed whenever a new circular lands.
Board oversight and security roles
Committee terms, the security officer's reporting line and cyber objectives with owners, visible to the board.
Technology and cyber risk
A register of system, outsourcing and cyber risks, with treatments followed to closure and escalated as agreed.
Competence and documented information
Awareness and role training records, linked to Sterling Academy; policies and procedures under version control.
Assets, suppliers and change
Asset inventories, vendor assessments and change approvals recorded as the work happens.
KPIs, audits and board review
Security dashboards, audit programmes and a review record showing what the board saw and decided.
Incidents, findings and corrective action
Incidents, test results and audit observations traced to root cause, with evidence that each fix held.
Forms and workflows that match your operation
Fields, approvals and reports configured without code, so the system follows your branches, trading desks and data centres.
What this means at the audit
An auditor or inspector will pick a critical system and ask when it was last tested, what was found and who closed it. With Effivity, the test, the finding, the corrective action and the review decision are already linked and dated.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your documents, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for QMS, ISMS, BCMS and more when you integrate other standards
Sterling Academy · security e-learning
Make cyber hygiene part of every role, from branch to boardroom.
Sterling Academy offers video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion that can be verified online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness training that helps staff spot phishing, fraud attempts and data handling mistakes
- Internal auditor training, as applicable to your standard, as part of the engagement
- Completion reports by team, ready for an inspector or auditor
- New joiners trained as they arrive, so records stay current between audits
Keep exploring
Explore more about RBI and SEBI cybersecurity frameworks
RBI and SEBI resources
Services for RBI and SEBI cybersecurity frameworks
Why Sterling
Want successful RBI and SEBI cyber compliance? Come to Sterling.
Indian financial groups rarely answer to one regulator. Sterling builds one security programme for every regulated arm, with one engagement team accountable.
60+ countries since 2003
Information security and continuity programmes for banks, insurers, fintechs and their suppliers, with offices in 21 countries.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal; auditors and testing firms quote separately.
One programme, two regulators
Controls mapped once and traced to each RBI chapter and CSCRF function, so a new circular means an update, not a rebuild.
Expert and experienced consultants
Security specialists who understand how a bank or broker actually runs before they open the directions.
The Sterling Promise
What our RBI and SEBI cyber compliance success guarantee means
We stay with you until your agreed RBI or SEBI cyber compliance outcome is achieved, through implementation, internal review and the closure of any audit findings.
The engagement identifies the directions, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. RBI and SEBI supervise compliance, and the auditors you appoint form their own opinions. Our commitment concerns the agreed compliance support, not a promise about every future inspection or flawless security.
FAQs
Frequently asked questions about RBI and SEBI cybersecurity compliance
Is there an RBI or SEBI cybersecurity certificate?
No. Neither regulator certifies organisations against its cyber rules. Compliance is shown through audit reports, submissions and inspection outcomes, so be wary of anyone offering a certificate.
Does ISO 27001 certification satisfy SEBI CSCRF or the RBI directions?
Not on its own. ISO/IEC 27001 supplies much of the governance and risk machinery, but the directions add roles, testing frequencies, reporting timelines and audits that a certificate does not cover.
How do we know our SEBI CSCRF category?
CSCRF sets the criteria that place each regulated entity in one of five categories, from market infrastructure institutions to self-certification entities. The category decides audit frequency, SOC arrangements and Cyber Capability Index duties, so check it against the current circular and clarifications.
How quickly must a cyber incident be reported to RBI?
Under the 2026 directions for commercial banks and NBFCs, within six hours of detection on RBI's DAKSH platform, with CERT-In notified as well. SEBI regulated entities follow the incident classification and reporting rules in CSCRF.
Do technology vendors to banks and brokers have to comply?
Not directly, but regulated entities stay accountable for outsourced systems, so their contracts pass the requirements on.
Keep exploring
More on RBI and SEBI cybersecurity frameworks and related standards
More in Financial services, payments & AML
Talk to a consultant
Plan your RBI or SEBI cyber compliance before the next inspection.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice