On this page
Preparing for an RBI inspection? We run independent VAPT mapped to paragraph 26 of the Master Direction, with CVSS-scored findings and a retest your auditors can follow.
For years, RBI’s cybersecurity expectations for banks sat across the 2016 Cyber Security Framework and a long trail of circulars. The 2023 IT Master Direction brought IT governance, risk, controls and assurance together for banks and larger non-bank lenders. For VAPT, paragraph 26 is short, specific and inspected.
Who is covered
- Direction
- RBI (IT Governance, Risk, Controls and Assurance Practices) Directions, 2023
- Reference
- RBI/2023-24/107, issued 7 November 2023
- Effective
- 1 April 2024
- Covered
- Commercial banks (including foreign banks, small finance banks and payments banks), NBFCs in the top, upper and middle layers, credit information companies, and EXIM Bank, NABARD, NaBFID, NHB and SIDBI
- Excluded
- Local area banks and NBFC core investment companies
- Foreign bank branches
- Comply or explain
Non-bank payment system operators are covered by a separate RBI direction on cyber resilience and digital payment security controls. Cooperative banks have their own RBI cybersecurity guidance. If you are in either group, map the requirements in your own direction; the testing principles below still apply.
What paragraph 26 requires
| Requirement | What the Direction says | What it means in practice |
|---|---|---|
| Frequency for critical and DMZ systems | VA at least every six months, PT at least every 12 months | Two VA cycles and one PT cycle a year for every in-scope system |
| Lifecycle testing | Before implementation, after implementation and after major changes | New apps and big releases are tested before customers see them |
| Non-critical systems | Risk-based approach to whether and how often | A written rationale for anything tested less often |
| Who tests | Appropriately trained and independent information security experts or auditors | Independent from the team that built and runs the system |
| Environment | Post-implementation PT on production; any test environment must mirror production, with deviations approved by the ISC | Production testing windows, or documented ISC approval |
| Remediation | Fix vulnerabilities in a time-bound manner and prevent known ones from recurring | Deadlines by severity, tracked to closure, with regression checks |
| Documented approach | Scope, coverage and a scoring mechanism such as CVSS, which may extend to cloud-hosted systems | A VA/PT policy or standard your auditors can test against |
What counts as a “critical system”?
The Direction applies the six-month and twelve-month rule to critical information systems and to systems in the DMZ that have a customer interface. In a typical bank or NBFC that means:
- Internet and mobile banking, and customer loan or investment portals
- Payment interfaces: UPI, cards, NEFT and RTGS gateways and payment APIs
- Core banking or loan management systems and the middleware around them
- Customer onboarding and video KYC flows
- Partner and co-lending APIs, including fintech integrations
- Internet-facing infrastructure: VPNs, email gateways, firewalls and load balancers
- Cloud-hosted applications that support any of the above
Write down your list of critical systems and keep it current. Inspection teams compare the VA/PT reports against that list, and a system that is missing from both is a harder finding than one that is tested late.
The rest of the Direction you will be asked about
VAPT findings feed into other parts of the Direction:
- Security reviews. Security infrastructure and policies are reviewed at least annually.
- CISO reporting. The CISO reviews cybersecurity risks and preparedness with the board, the risk management committee or the IT Strategy Committee at least quarterly. Open VAPT findings belong in that review.
- IS audit. The Audit Committee of the Board oversees information systems audit, approves an IS Audit Policy reviewed at least annually, and IS audit planning follows a risk-based approach. Expect IS auditors to test whether VAPT happened on time and findings were closed.
Common gaps in RBI VAPT programmes
- Annual VA instead of half-yearly. The penetration test happens once a year, but the vulnerability assessment does too. Critical and DMZ systems need VA every six months.
- Pre-production only. Testing in UAT without documenting how it differs from production, and without ISC approval.
- Missing lifecycle tests. Major releases go live between annual tests without their own assessment.
- No scoring standard. Findings rated by gut feel rather than CVSS or another documented method.
- Recurring known vulnerabilities. The same outdated library appears in three consecutive reports. The Direction specifically asks you to stop known vulnerabilities from coming back.
- Testers who are not independent. The managed service provider that runs the infrastructure is also the one testing it.
How Summit supports RBI regulated entities
Summit runs independent, manual VAPT for banks, NBFCs and fintechs across web and internet banking applications, mobile apps, payment and partner APIs and network infrastructure. We plan the half-yearly VA and annual PT cycles with you, score findings with CVSS, support remediation and retest. For larger institutions, red team operations test detection and response end to end. Where you want a CERT-In empanelled report, we route it through our empanelled partner, so you still deal with one team. See our SEBI CSCRF and RBI compliance page for the wider picture.
Plan this year's VA and PT cycles
Share your list of critical and customer-facing systems. We will build a testing calendar that meets paragraph 26 and gives your auditors a clean trail. Get a quote.
Related reading: SEBI CSCRF VAPT requirements · CERT-In empanelled auditors and VAPT · Red team vs penetration testing
Frequently asked questions
Which RBI rule requires VAPT?
The Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023, issued on 7 November 2023 and effective from 1 April 2024. Paragraph 26 sets out the vulnerability assessment and penetration testing requirements.
How often does RBI require VAPT?
For critical information systems and systems in the DMZ with a customer interface, vulnerability assessment at least once every six months and penetration testing at least once every 12 months. VA and PT are also expected before and after implementation and after major changes. Non-critical systems follow a risk-based approach.
Which entities are covered by the RBI IT Master Direction?
Commercial banks (including foreign banks, small finance banks and payments banks), NBFCs in the top, upper and middle layers, credit information companies and all-India financial institutions such as EXIM Bank, NABARD, NaBFID, NHB and SIDBI. Local area banks and core investment companies are excluded.
Does RBI require a CERT-In empanelled auditor for VAPT?
The Master Direction asks for appropriately trained and independent information security experts or auditors rather than naming CERT-In empanelment. Many banks and NBFCs still choose empanelled auditors because boards, internal audit and other regulators recognise them.
Should penetration testing be done on production?
Post-implementation penetration testing should be done on production. If testing happens in a test environment instead, it must match production in version and configuration, and any differences must be documented and approved by the Information Security Committee.
Can Summit run VAPT for an RBI regulated entity?
Yes. Summit runs independent, manual VAPT for banks, NBFCs and fintechs, with reports mapped to paragraph 26, CVSS scoring and a retest, and can route the report through our CERT-In empanelled partner where you need one.
