RBI cyber security framework 2026: what it means for employee awareness
RBI's 2026 cybersecurity directions for commercial banks and NBFCs, and what they say about employee awareness, training and testing, quoted paragraph by paragraph.
On 31 July 2026 the Reserve Bank of India issued separate cybersecurity and IT directions for each type of regulated entity. This post covers what the Commercial Banks and NBFC directions say about employees, with the paragraph numbers from RBI's master directions page (updated as on 1 October 2026). For the wider picture, see our RBI compliance page.
What changed
- The Commercial Banks directions (RBI/DoS/2026-27/410) "shall come into effect immediately upon issuance" (paragraph 2).
- Paragraph 230 repeals the existing directions, instructions and guidelines on Cybersecurity Framework and IT Governance for commercial banks, as communicated in circular DoS.CO.PPG.66/11.01.005/2026-27.
- The NBFC directions (RBI/DoS/2026-27/461) "come into force with immediate effect".
Commercial banks: Section BB, User / Employee / Management Awareness
| Paragraph | What it says |
|---|---|
| 199 | Define and communicate security policies to users, employees, vendors and partners, and educate them about cybersecurity risks |
| 200 | "Targeted awareness and training for key personnel in executive, operational, and security administration or management roles" |
| 201 | "Encourage the reporting of suspicious behaviour incidents to the incident management team" |
| 202 | "The bank shall evaluate the awareness level of employees periodically." |
| 203 | "Continuous and adaptive capacity building"; awareness programmes "mandatory for all new recruits", and "annual training shall be conducted for lower and middle management" |
| 204 | Periodic sensitisation of the Board and Senior Management, and annual training for all Board members and Senior Management |
Two more paragraphs matter for a phishing programme. Paragraph 43 says the bank "shall take steps to adequately tackle cyber-attacks including phishing, spoofing attacks". Paragraph 197 says awareness among stakeholders, including employees, may form part of the indicators used to assess preparedness.
NBFCs: C.12 Training
- Paragraph 35: "a robust, ongoing information security training and awareness program for all users", periodically reviewed and updated for emerging cyber threats.
- Paragraph 36: "a formal mechanism to measure and track the effectiveness of such training through periodic assessments or testing", and "an up-to-date repository of the training and awareness status of all users".
Turning the paragraphs into evidence
| Requirement | Evidence an auditor can read | In SecurityRing |
|---|---|---|
| ¶202 periodic evaluation; NBFC ¶36 testing | Dated simulation results over time | Campaign reports and the executive trend report with the phishing exposure score |
| ¶203 continuous and adaptive capacity building | Content that changes with threats | Recommendations from CERT-In, RBI and other public advisories, refreshed on a schedule |
| ¶200 targeted training for key roles | Results for executive and admin cohorts | Segment risk by seniority and executive cohort; focused retests |
| ¶201 reporting suspicious behaviour | Lessons that point to your reporting route | Lesson red flags drafted in the AI Builder, edited to your process |
| NBFC ¶36 repository of training status | Per-person status | User roster with training completion; CSV export |
The baseline courses in paragraphs 203 and 204 (new recruits, management, Board) are yours to run. SecurityRing adds the regular simulations, the lesson at the moment of the click and the reports. It does not make a bank or NBFC compliant; your auditor and RBI decide.
A first quarter plan
- Month 1: a baseline email simulation for all staff, using a Regulatory updates or Your tools recommendation.
- Month 2: a targeted campaign for executive and operations roles (paragraph 200), for example a deepfake video in email from a consented leader likeness.
- Month 3: a focused retest of anyone who clicked twice, then the executive trend report for the Board.
Sources
- Reserve Bank of India, Reserve Bank of India (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (RBI/DoS/2026-27/410, DoS.CO.CSITEG.4/31.01.015/2026-27), 31 July 2026. Accessed 15 October 2026.
- Reserve Bank of India, NBFC cybersecurity and IT directions, 2026 (RBI/DoS/2026-27/461), 31 July 2026. Accessed 15 October 2026.