For years, technology risk at many regulated Indian financial institutions was treated as an operational matter, delegated to the IT department and reviewed occasionally. The Reserve Bank of India's Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, issued in November 2023 and effective from April 2024, changed the tone. It sets out expectations on governance structures, risk management, controls and assurance in a single consolidated framework, and places responsibility for technology firmly at senior management and board level.

This article summarises the themes in plain language. It is not a substitute for reading the Direction itself, which applies to specified categories of regulated entities and has its own definitions and timelines. Confirm applicability to your entity type and check for subsequent amendments or clarifications.

Why it matters

Regulated entities today run on technology: core banking, payment systems, lending platforms, mobile apps, cloud services and data analytics. Failures in these systems affect customers, financial stability and trust. The Direction aims to ensure that technology decisions are governed with the same rigour as financial and credit decisions.

The main themes

1. Governance structures. The Direction expects clear oversight arrangements. The board is responsible for approving IT strategy and policy, and a board-level or senior management IT Strategy Committee oversees technology direction and risk. An IT Steering Committee, comprising senior business and technology leaders, helps align initiatives with business needs and monitors progress. Roles such as Head of IT Function and Chief Information Security Officer are expected to have defined responsibilities and appropriate independence and reporting lines.

2. IT strategy and policy. Entities are expected to have a documented IT strategy aligned with business strategy, approved by the board, and supported by policies covering the full technology lifecycle.

3. IT risk and information security. IT and cyber risks should be integrated into the overall risk management framework, with defined risk appetite, assessment, monitoring and reporting. Information security policies, control frameworks, vulnerability management, access control and incident handling are expected to be in place and effective.

4. IT operations and service management. Controls over change management, release management, incident and problem management, capacity planning and asset management should be documented and operating.

5. Business continuity and disaster recovery. Entities should maintain tested plans for resilience, with defined recovery objectives, regular drills and attention to critical services and dependencies.

6. Third-party and outsourcing risk. Dependence on vendors and cloud providers must be governed through due diligence, contracts, monitoring and exit planning. RBI has separately issued directions on outsourcing of IT services that complement this area.

7. Systems acquisition, development and projects. Secure development, testing and project governance are expected, along with controls over major programmes.

8. Data governance and management information. Quality, integrity and availability of data used for decisions and reporting.

9. Assurance. Independent assurance through internal audit and, where required, information systems audit, aligned with risk. Findings should be tracked and closed, with board-level visibility.

What boards and senior management must do

The Direction's emphasis on accountability means board members and executives should be able to demonstrate that they:

  • Understand the entity's technology landscape and key risks at a level appropriate to their role.
  • Approve and periodically review IT strategy, policies and risk appetite.
  • Receive regular, meaningful reporting on technology risk, cyber threats, incidents, audit findings and major projects.
  • Ensure adequate resources and skills for technology and information security functions.
  • Challenge management and hold it to account for remediation.

Directors cannot delegate understanding. Training sessions and structured briefings help.

A practical gap-assessment approach

  1. Confirm applicability. Determine which provisions apply to your entity category and any phased timelines.
  2. Map current state to requirements. For each area, list existing policies, committees, roles, controls and evidence.
  3. Identify gaps. Common gaps include undefined committee mandates, missing or outdated IT strategy, weak risk quantification, incomplete asset inventories, untested recovery plans and shallow third-party oversight.
  4. Prioritise. Rank by regulatory exposure and risk to customers and operations.
  5. Create a remediation plan with owners, deadlines and board visibility.
  6. Track and report progress through the IT Strategy Committee and board.

Typical evidence an inspector may ask for

  • Board-approved IT strategy and policies, with approval dates and review history.
  • Committee charters, membership and minutes.
  • Role descriptions and reporting lines for key technology and security leaders.
  • IT risk assessments and registers, with link to enterprise risk reporting.
  • Information security control documentation and testing results.
  • Penetration test and audit reports, with remediation status.
  • BCP and DR plans, test records and lessons learned.
  • Vendor risk assessments, contracts and monitoring reports.
  • Incident records and reporting to the regulator where required.

Frequent weaknesses

  • Committees exist but meet irregularly, with minutes that record attendance rather than decisions.
  • The CISO reports within IT, limiting independence.
  • Risk registers contain technical items but do not connect to business impact.
  • Disaster recovery plans exist but have not been tested for critical systems.
  • Vendor oversight stops at onboarding.
  • Audit findings reappear year after year.

Linking with other frameworks

Many requirements align with ISO 27001 controls and management system practices, and with CERT-In obligations on logging and incident reporting. Building a unified control framework helps you satisfy several expectations with one body of evidence. Cybersecurity directions from RBI, including those on cyber incident reporting and cyber crisis management, apply in parallel; check which circulars apply to your entity.

Start with a readiness review

F9 Infotech assists regulated entities with gap assessments against RBI IT governance and cyber expectations, helps establish committees and reporting, and prepares evidence for supervisory reviews. Book an RBI IT and cyber readiness review.

This article is a general summary and not regulatory or legal advice. Refer to the original RBI directions and consult your advisers.