RBI IT Governance Directions: What NBFC IT Teams Must Evidence
The RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices has applied to Middle, Upper and Top Layer NBFCs since 1 April 2024. Much of it sits with the board and senior management, but four clauses land squarely on the IT team: asset classification, patch management, audit logs, and vulnerability testing. This is what each one asks for and what to keep as evidence.
Who it applies to and when
- Issued 7 November 2023 as RBI/2023-24/107; in force from 1 April 2024.
- Covers commercial banks, Credit Information Companies, the All India Financial Institutions, and NBFCs in the Top, Upper and Middle Layers.
- Does not apply to NBFC-Core Investment Companies or Local Area Banks.
- It replaced a set of earlier RBI circulars on IT governance, controls, assurance and business continuity.
The four clauses the IT team owns
| Clause | What it asks for | Evidence to keep |
|---|---|---|
| 9(c), 9(d) | Identify and classify information assets by criticality; monitor software end-of-support dates and hardware maintenance (AMC) dates on an ongoing basis. | An asset register with criticality and classification, plus support and AMC end dates per asset. |
| 13 | Documented policy and procedures for change and patch management, with patches applied and reviewed securely, on time, and with approvals. | The patch policy, monthly patch compliance reports, and approved exceptions. |
| 15 | Applications that can access or affect critical or sensitive information must have audit and system logging and provide audit trails; audit trails and system logs must be monitored regularly. | Logging configuration per critical application and a record of log reviews or alerts. |
| 26 | Vulnerability assessment at least every six months and penetration testing at least every 12 months for critical systems and DMZ systems with customer interfaces; risk-based for others. | VA and PT reports with dates, scope and remediation status. |
Asset classification and end-of-support tracking (clause 9)
You cannot classify assets you have not found. Start with a complete inventory of hardware and software, then add a criticality rating and a classification for each asset. Add two dates the Direction calls out: software end of support and hardware AMC end. Unsupported software is a finding auditors look for first, because it no longer receives security patches.
Patch management (clause 13)
The clause asks for documented policy and procedures, and for patches to be applied in a secure and timely manner with approvals. In practice an auditor will want to see the policy, a regular report of which systems are missing which updates, and a record of any approved exceptions with a reason and a review date.
Audit trails and log monitoring (clause 15)
Every application that can access or affect critical or sensitive information needs audit and system logging. Logging alone is not enough: the clause also asks for a system for regularly monitoring audit trails and system logs to detect unauthorised activity. Keep evidence that the monitoring happens, such as alert rules and review records.
Vulnerability assessment and penetration testing (clause 26)
For critical systems and DMZ systems with customer interfaces, the minimum is a vulnerability assessment every six months and a penetration test every 12 months. For other systems the Direction leaves the frequency to a risk-based approach, so write down the frequency you chose and why.
Where Sentrivox helps, and where it does not
- Inventory: the Windows agent records hardware, software, patches, services, users and ports on every endpoint, the starting point for clause 9.
- Patching: Sentrivox tracks patch history per endpoint and ties missing patches to known vulnerabilities, which supports the reporting clause 13 needs.
- Vulnerabilities: findings are enriched with NVD, CISA KEV, EPSS and Microsoft MSRC data, useful between formal VA cycles.
- Not covered: Sentrivox does not run penetration tests, and it does not replace your board-level IT governance or your auditor.
Frequently asked questions
Which NBFCs does the RBI IT governance Master Direction apply to?
NBFCs in the Top, Upper and Middle Layers under the Scale Based Regulation framework. It does not apply to NBFC-Core Investment Companies or Local Area Banks.
When did the RBI IT governance Master Direction come into force?
It was issued on 7 November 2023 (RBI/2023-24/107) and came into effect on 1 April 2024.
How often must an NBFC run VAPT under the Master Direction?
For critical systems and systems in the DMZ with customer interfaces, a vulnerability assessment at least once every six months and a penetration test at least once every 12 months. For non-critical systems, the frequency is risk-based.