The Reserve Bank of India issued the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices in November 2023, effective from 1 April 2024. It consolidates earlier IT and cyber circulars for banks, NBFCs, credit information companies and all-India financial institutions.
It expects a board-level IT strategy committee, an IT steering committee, a head of IT function, IT and information security risk management, IT services management and capacity planning, data backup and business continuity and disaster recovery, and periodic information systems audit.
How we help
- Gap assessment against every chapter of the Direction, with board-ready reporting
- Governance charters, IT and IS policies and risk registers aligned to RBI expectations
- BCP/DR testing programmes and IS audit support
- Mapping to ISO/IEC 27001, ISO 22301 and ISO/IEC 20000-1 so certification evidence doubles as regulatory evidence
Who it is for
- Scheduled commercial banks (other than RRBs)
- NBFCs in the Top, Upper and Middle layers
- Credit information companies and all-India financial institutions
- Technology vendors serving RBI-regulated entities
What you gain
- Clear evidence for RBI inspections
- Board oversight that is documented, not assumed
- One control framework mapped to ISO 27001 and ISO 22301
How we get you compliant
Applicability and scoping
Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
Data and process mapping
Build a record of processing or control inventory so obligations can be tied to real systems and owners.
Gap assessment
Measure current practice against each obligation and rank the gaps by legal and business risk.
Remediation roadmap
Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
Evidence and ongoing monitoring
A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.