CERT-In empanelled IT and information-security audits mapped clause-by-clause to RBI's directions — for banks, NBFCs, HFCs, payment system operators and cooperative banks. We turn a regulatory obligation into a genuine uplift in your security posture.
The Reserve Bank of India holds its regulated entities to detailed expectations on IT governance, cyber resilience and information security — and requires independent assurance that those controls are designed well and operating effectively. Falling short invites supervisory observations, and in serious cases, business restrictions.
Our RBI audit practice assesses your environment against the directions that apply to your entity category, validates the controls through hands-on technical testing, and documents everything in a board- and regulator-ready format. We don't just check boxes against a circular — we give you a clear, prioritised path to close gaps within RBI's timelines.
As a CERT-In empanelled auditing organization with a dedicated BFSI practice, we bring purpose-built audit workbooks — including a 112-point Master Direction IS-audit workbook and a 124-point NBFC compliance workbook — so nothing in the framework is missed.
RBI's IT and information-security expectations apply across its supervised entities. The intensity and cadence of audit depend on your category and, for NBFCs, your regulatory layer.
| Regulated entity | Key applicable RBI frameworks | Typical audit |
|---|---|---|
| Commercial & Small Finance Banks | ITGRCA MD 2023Cyber Security Framework 2016Digital Payment Security 2021 | Annual |
| Payments Banks | ITGRCA MD 2023Cyber Security FrameworkDigital Payment Security | Annual |
| Regional Rural Banks | Cyber Security FrameworkITGRCA (phased) | Periodic |
| Urban Cooperative Banks | Cyber Security Framework for UCBsGraded Levels I–IV | Per level |
| NBFCs — Middle, Upper & Top Layer | ITGRCA MD 2023Scale-Based Regulation | Annual |
| NBFCs — Base Layer | Proportionate IT governance | Periodic |
| Housing Finance Companies | ITGRCA MD 2023 | Annual |
| Payment System Operators / PPI | Cyber Resilience & DPSC for PSOs 2024System Audit Report | Annual SAR |
| Credit Information Companies | IT / IS governanceITGRCA (as applicable) | Periodic |
| ARCs, AIFIs & Account Aggregators | ITGRCA (as applicable)IT framework | Periodic |
Applicability and cadence are indicative and depend on the latest RBI directions and your specific licence. We confirm the exact scope for your entity during planning.
We map every finding to the specific directions that govern your entity.
The consolidated direction, effective April 2024, setting IT governance, risk management, information security and IS-audit expectations across banks, NBFCs (by layer), HFCs and CICs.
Baseline cyber-security controls, a Cyber Crisis Management Plan, security operations and incident reporting obligations for banks.
Security controls for internet, mobile and card payment channels offered by regulated entities to their customers.
Cyber-resilience and digital-payment-security requirements for authorised payment system operators, phased by entity size.
A graded, four-level framework for urban cooperative banks, scaling controls to each bank's digital footprint.
Governance of outsourced IT and cloud services, including third-party risk, concentration risk and exit strategies.
For authorised payment system operators and their participants, RBI requires an independent system audit and confirmation that payment data is stored only in India — both attested through a System Audit Report by a CERT-In empanelled auditor.
A periodic, independent system audit of a PSO’s architecture, security controls, transaction integrity, business continuity and compliance with the applicable RBI directions — documented as a System Audit Report and submitted to RBI by a CERT-In empanelled auditor.
Under RBI’s directive, the entire data relating to payment systems must be stored only in India. We validate storage locations and data flows end to end, confirm that any data processed abroad for cross-border transactions is purged overseas and brought back within 24 hours, and report compliance through a board-approved SAR.
Our audit provides full coverage across the twelve control domains an RBI information-security audit examines — aligned to the RBI Master Direction (ITGRCA) and the foundational Gopalakrishna Working Group framework.
Board and IT Strategy Committee oversight, IT strategy, organisational structure and the IT/IS policy framework.
Day-to-day IT operations and service management, including capacity, change and patch management.
The information-security programme, CISO function, risk management and the Cyber Security Framework / CCMP.
Identity and access management, least privilege, privileged-access control and segregation of duties.
Application controls, secure development, maker-checker, and VAPT of in-scope applications.
Network segmentation, perimeter defences, and server and endpoint hardening.
Governance of outsourced IT and cloud services, vendor risk and concentration / fourth-party risk.
BCP and disaster recovery with defined RTO/RPO and documented DR-drill evidence.
Incident response, RBI / CERT-In reporting, and cyber-fraud detection and management.
The IS-audit function — its independence, planning, coverage and follow-up.
Data classification, encryption, customer-data protection and data-localisation requirements.
Customer awareness, grievance redressal, and legal and regulatory compliance.
A compliance-first lifecycle that produces supervisory-ready evidence.
We confirm your entity category and layer, and the exact RBI directions that apply to you.
Board minutes, IT strategy, policies and prior audit and RBI inspection observations.
Design and operating-effectiveness testing across every applicable control domain.
Vulnerability assessment and penetration testing of in-scope applications and infrastructure.
Every finding mapped clause-by-clause to ITGRCA, the Cyber Security Framework and DPSC.
A board- and RBI-ready report, remediation tracker, retest and formal closure.
Use these to prepare. The first gets you ready for the engagement; the second is the control-domain checklist we assess against.
Your audit is mapped to the RBI directions and supporting standards that apply.
Cyber resilience audits across SEBI's five-tier entity model.
Learn more →Regulator-aligned vulnerability assessment and penetration testing.
Learn more →Back to the full regulatory audit pillar.
View pillar →Talk to our CERT-In empanelled team about an audit scoped to your entity category and applicable directions.
