By the VD Hosts team 4 min read
In November 2023 the Reserve Bank of India issued the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, which came into effect on 1 April 2024. It brought several older circulars into one framework and made one thing very clear: technology risk is a board-level responsibility, not just an IT department topic.
This article summarises what the Direction expects in practical terms, so that technology, security and compliance teams can check where they stand. It is general information, not legal advice; always work from the current text published on rbi.org.in and confirm applicability with your compliance team.
Who the Direction applies to
The Direction applies to a defined set of regulated entities, including scheduled commercial banks (other than regional rural banks), small finance banks, payments banks, NBFCs in the Upper, Middle and Top layers of RBI's scale-based regulation, credit information companies and specified all-India financial institutions. Cooperative banks and Base Layer NBFCs are covered by separate RBI guidance with similar themes.
1. Governance: who owns technology risk
The Direction expects clear ownership at the top:
- Board oversight: the board approves the IT strategy and the policies that govern IT and information security.
- IT Strategy Committee: a board-level committee that reviews IT strategy, IT risk, cyber security and resources, meeting at a frequency set out in the Direction (at least quarterly).
- IT Steering Committee: a management committee that oversees IT projects, priorities and performance.
- Head of IT and CISO: named senior roles responsible for IT operations and for information security respectively, with the CISO's independence protected.
What to evidence: committee charters, minutes showing technology risk is actually discussed, and an IT strategy aligned to the business plan.
2. IT and information security risk management
Regulated entities are expected to identify, assess and treat IT and cyber risks as part of enterprise risk management. In practice this means:
- An up-to-date inventory of information assets, classified by criticality.
- A risk assessment that covers applications, infrastructure, vendors and data.
- An information security policy and supporting procedures, reviewed periodically.
- Access control based on least privilege, with strong authentication for privileged and remote access.
- Secure configuration, patch management and change management.
3. Testing: vulnerability assessment and penetration testing
The Direction requires vulnerability assessment and penetration testing (VAPT) of critical information systems at minimum frequencies, and after significant changes. Findings must be tracked to closure. Three practical points matter as much as the frequency:
- Scope: include internet-facing applications, APIs used by partners and mobile apps, not only network ranges.
- Manual testing: access-control and business-logic flaws are rarely found by scanners alone.
- Retest: auditors and supervisors look for evidence that fixes were verified, not just reported.
See how we approach this in our VAPT service and API security testing.
4. Business continuity and disaster recovery
Critical systems need a documented business continuity and disaster recovery plan with defined recovery objectives, regular DR drills, and evidence that backups can actually be restored. The Direction sets expectations for how often DR drills of critical systems are conducted. Drill reports should record what was tested, how long recovery took, and what was fixed afterwards.
5. Incident management and reporting
Institutions need an incident response process, logging and monitoring that can detect incidents, and reporting to RBI within the timelines it specifies. Separately, the CERT-In Directions of April 2022 require reporting of specified cyber incidents to CERT-In within six hours of noticing them. Your incident playbook should cover both. We explain the CERT-In requirements in more detail in our CERT-In checklist.
6. Vendor and outsourcing risk
Many IT services are outsourced, but accountability is not. RBI's directions on outsourcing of IT services expect due diligence, contracts with audit and access rights, data protection and incident reporting clauses, and ongoing monitoring of service providers, including cloud providers.
7. Information systems audit
Periodic information systems audits, risk-based in scope, with findings reported to the board's audit committee and tracked to closure, close the loop. Audit evidence is much easier to produce when the controls above are documented as they run.
A practical checklist
| Area | Evidence a supervisor or auditor is likely to ask for |
|---|---|
| Governance | IT Strategy Committee and Steering Committee charters and minutes; named Head of IT and CISO |
| Risk | Asset inventory, IT risk register, information security policy |
| Access | Privileged access list, MFA coverage, access review records |
| Testing | VAPT reports, remediation tracker, retest reports |
| Continuity | BCP/DR plan, DR drill reports, backup restore tests |
| Incidents | Incident response plan, logs retained, reporting records |
| Vendors | Outsourcing policy, due diligence files, contracts with audit rights |
Where to start
If you are not sure where you stand, a gap assessment against the Direction usually takes a few weeks and gives you a prioritised plan. Start with the areas where evidence is weakest, often testing follow-up, DR drills and vendor oversight, because they are the hardest to fix quickly when an inspection is announced.
VD Hosts helps banks, NBFCs and fintechs with governance and compliance programmes, security testing, and secure modernisation of the systems behind them. Compliance remains the responsibility of the regulated entity; our role is to help you build and evidence the controls.
Common questions
When did the RBI IT Governance Master Direction take effect?
Does the Direction apply to all NBFCs?
Is a penetration test once a year enough?
Can IT operations be outsourced under the Direction?
This article is general information, not legal or regulatory advice. Check the current official texts and take professional advice for your situation. See our Website Disclaimer.
