Many organizations have a gap between the cybersecurity work they believe they are doing and the controls a regulator expects. For banks, NBFCs, and payment operators, understanding the applicable RBI directions is an important first step.
Some compliance deadlines have passed. Others are approaching. This guide summarizes the two RBI directions relevant to VAPT and explains the main requirements organizations should review.
Two RBI Directions Relevant to VAPT Compliance
1. Master Direction on IT Governance, Risk, Controls and Assurance Practices
RBI issued this Direction in November 2023. It took effect on 1 April 2024. It applies to several categories of regulated entities, including:
- Scheduled commercial banks, excluding Regional Rural Banks
- Small finance banks
- Payments banks
- NBFCs in the applicable layers under RBI’s Scale Based Regulation
- Credit information companies
- All India Financial Institutions, including EXIM Bank, NABARD, NaBFID, NHB, and SIDBI
The Direction includes VA and PT requirements for critical information systems and certain customer-facing systems. Regulated entities should check the applicable RBI Direction and their system classification to confirm the requirements that apply to them.
Official source: RBI Master Direction on IT Governance
2. Master Directions on Cyber Resilience and Digital Payment Security Controls for Non-Bank PSOs
RBI issued this Direction on 30 July 2024. It applies to authorized non-bank Payment System Operators (PSOs). Depending on the entity, this may include payment aggregators, PPI issuers, and cross-border money transfer operators.
RBI set phased implementation deadlines based on the size of the PSO:
- Large non-bank PSOs: 1 April 2025
- Medium non-bank PSOs: 1 April 2026
- Small non-bank PSOs: 1 April 2028
The deadlines for large and medium PSOs have passed. Small PSOs have a later deadline. Each PSO should confirm its classification and assess its current compliance status against the full Direction.
Official source: RBI Master Direction on Cyber Resilience for Non-Bank PSOs
How Often Should Critical Systems Be Tested?
Under the IT Governance Direction, regulated entities must conduct VA at least once every six months for critical information systems and certain customer-facing systems in a DMZ. They must conduct PT at least once every 12 months.
Testing should also cover the system lifecycle. This includes relevant pre-implementation and post-implementation checks, as well as testing after major changes. For non-critical systems, the entity should use a risk-based approach to decide the need and frequency of testing.
The PSO Direction includes requirements that may apply when a new service is introduced or significant changes are made. Organizations should review the relevant clauses and plan event-driven testing alongside periodic assessments where required.
What Should a VAPT Scope Cover?
A VAPT scope should reflect the organization’s systems, services, and risk profile. For a payment operator, the assessment may need to consider customer-facing applications and APIs, payment infrastructure, cloud-hosted systems, and critical third-party services.
Third-party responsibilities should also be clear. If a vendor supports a critical process, document the security expectations, assessment scope, evidence, and remediation responsibilities in the relevant agreement.
What Evidence Should Organizations Keep?
Organizations should retain clear records of the assessment and the actions taken afterward. These records can help demonstrate that testing was completed and that identified risks were addressed.
- The systems, applications, and vendors included in scope
- The assessment method and the qualifications of the independent assessor
- Findings, severity ratings, and remediation owners
- Target remediation dates and closure evidence
- Retest results for addressed findings
- Approvals, exceptions, and risk acceptance records
A scanner report alone may not show that a penetration test was performed. Keep evidence of the assessment method and confirm that it meets the requirements of the applicable RBI Direction.
Common Gaps to Review
Use these questions to review your VAPT program:
- Are critical third-party systems included where required?
- Does the evidence show the assessment method, scope, and assessor?
- Are remediation timelines documented?
- Are findings retested after remediation?
- Can the team provide the records promptly when requested?
Requirements from other regulators may also apply. Review them separately and cite the relevant official framework before relying on a specific deadline or remediation period.
Board and Executive Oversight
Cybersecurity governance is part of the compliance program. The applicable RBI Direction sets expectations for oversight, accountability, and information security responsibilities.
Organizations should review the relevant requirements for the CISO role, Board oversight, information security policies, and the Cyber Crisis Management Plan (CCMP). Record approvals and periodic reviews so the organization can demonstrate how it manages cyber risk.
Why These Requirements Matter
Financial services depend on applications, APIs, payment infrastructure, and third-party services. A weakness in any of these areas can disrupt operations, expose information, or affect customers.
VAPT can help identify security weaknesses. It works best as part of a broader program that also includes remediation, retesting, governance, and ongoing risk management.
RBI VAPT Compliance Checklist
Use this checklist as a starting point. Confirm each item against the Direction that applies to your organization:
- Identify the applicable RBI Direction and entity category.
- Confirm system criticality and testing scope.
- Schedule VA and PT at the required intervals.
- Plan additional testing for relevant system changes or service launches.
- Include critical vendors and third-party dependencies where required.
- Document findings, owners, timelines, fixes, and retests.
- Keep governance approvals and compliance evidence ready for review.
For banks and applicable NBFCs, the IT Governance Direction has been in effect since 1 April 2024. For medium non-bank PSOs, the implementation deadline was 1 April 2026. Small non-bank PSOs have until 1 April 2028. Confirm the specific requirements and applicability directly against the relevant RBI Direction.
Compliance depends on putting the required program into operation and maintaining evidence of it. A written policy is only one part of that work.
As RBI cybersecurity expectations evolve, organizations need visibility into vulnerabilities, cyber risks, and remediation status. Periodic assessments should form part of a broader security and compliance program.
C9Lab supports banks, NBFCs, fintechs, and payment operators with VAPT services and cybersecurity assessments.
Comments
Join the discussion. We’d love to hear your thoughts.