# RBI IT Governance Master Direction: RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices

> RBI’s consolidated expectations on IT governance, IT risk, controls, business continuity and IS audit for regulated entities.

URL: https://securei3.com/standards/rbi-it-governance/
Category: India regulations: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


The Reserve Bank of India issued the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices in November 2023, effective from 1 April 2024. It consolidates earlier IT and cyber circulars for banks, NBFCs, credit information companies and all-India financial institutions.

It expects a board-level IT strategy committee, an IT steering committee, a head of IT function, IT and information security risk management, IT services management and capacity planning, data backup and business continuity and disaster recovery, and periodic information systems audit.

## How we help

- Gap assessment against every chapter of the Direction, with board-ready reporting
- Governance charters, IT and IS policies and risk registers aligned to RBI expectations
- BCP/DR testing programmes and IS audit support
- Mapping to ISO/IEC 27001, ISO 22301 and ISO/IEC 20000-1 so certification evidence doubles as regulatory evidence

## Who it is for

- Scheduled commercial banks (other than RRBs)
- NBFCs in the Top, Upper and Middle layers
- Credit information companies and all-India financial institutions
- Technology vendors serving RBI-regulated entities

## Benefits

- Clear evidence for RBI inspections
- Board oversight that is documented, not assumed
- One control framework mapped to ISO 27001 and ISO 22301

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### Which entities does the RBI IT Governance Master Direction apply to?

It applies to scheduled commercial banks (excluding regional rural banks), small finance and payments banks, NBFCs in the Top, Upper and Middle layers, credit information companies and all-India financial institutions. Check the applicability paragraph against your licence category.

### Does ISO 27001 certification satisfy the Direction?

It covers much of the information security content, but the Direction adds RBI-specific governance structures, committee roles, IS audit and reporting expectations. We map the two and close the remaining gaps.

Related: https://securei3.com/standards/rbi-cyber-security-framework/, https://securei3.com/standards/rbi-it-outsourcing/, https://securei3.com/standards/iso-27001/, https://securei3.com/standards/iso-22301/, https://securei3.com/standards/cert-in-directions/

Contact: https://securei3.com/contact/: info@securei3.com