INDUSTRY FACT FILE · BANKING

Cybersecurity FAQs for Banks

Forty frequently asked questions and answers in five categories, written for Boards, CXOs, CISOs, risk, compliance and technology teams in banks.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: RBI's 2026 Directions, audit and compliance 3.  Category 3: VAPT, digital channels and application security 4.  Category 4: SOC, fraud, incident response and forensics 5.  Category 5: Third parties, cloud, privacy and emerging technology

Audience: Board members, MD & CEO, CISO, Chief Risk Officer

Q1. Why has cybersecurity become a Board-level obligation for banks?

RBI's 2026 cybersecurity Directions place responsibility for technology and cyber risk on the Board. The Board approves technology and cybersecurity policies and reviews them at least annually; an IT Strategy Committee meets at least quarterly; and the CISO reviews cyber risk with the Board, Risk Management Committee or ITSC at least quarterly. Cyber failures now affect supervisory standing, customer trust and business continuity at the same time.

Q2. What are the most significant cyber risks for banks today?

The highest-consequence risks are account takeover and mule accounts, phishing and executive impersonation, ransomware, attacks on digital channels and partner APIs, third-party and ATM switch compromise, privileged and insider misuse, high-value payment fraud, data leakage and slow detection. Priority depends on the bank's category, channels, technology estate and existing controls.

Q3. How should a bank's IT Strategy Committee be set up under the 2026 Directions?

For commercial banks, the ITSC must have at least three directors and be chaired by an independent director with at least seven years of substantial experience in IT. It meets at least quarterly, oversees IT strategy and cyber risk, and reviews the adequacy and effectiveness of BCP/DR at least annually.

Q4. Where should the CISO sit in the organisation?

For commercial banks, RBI's 2026 Direction expects the CISO to be at General Manager or equivalent level, with no direct reporting line to the Head of IT and no business targets. The CISO reports to the Executive Director overseeing risk management. This separation keeps security independent of delivery pressure.

Q5. What should the Board see in cyber risk reporting?

Useful reporting connects technical findings to business services: critical vulnerabilities and their age, testing coverage against the six-monthly VA and annual PT requirements, significant incidents and root causes, CSOC performance, third-party risks, DR drill results and progress on remediation. Metrics should show changing risk and control effectiveness, not just activity.

Q6. Do the same rules apply to every kind of bank?

No. On 31 July 2026 RBI issued separate Directions with the same title for commercial banks, small finance banks, payments banks and urban co-operative banks, among others. Foreign bank branches follow a 'comply or explain' approach for specified chapters; urban co-operative banks are graded into four levels; and regional rural banks and rural co-operative banks are supervised by NABARD under the framework applicable to them.

Q7. How much should a bank spend on cybersecurity?

There is no regulatory percentage. Spending should follow risk: first close critical exposures and meet mandatory testing and DR cycles, then strengthen monitoring and response, then mature governance and resilience. Managed services can give smaller banks capabilities such as a 24x7 CSOC without building everything in-house.

Q8. How can Codec Networks support a bank's cybersecurity strategy?

Codec Networks provides gap assessments against RBI's 2026 Directions, VAPT, application and API security, managed CSOC, forensics and incident response, third-party and ATM switch provider assessments, privacy programmes and Board advisory. Engagements can begin with a focused assessment and grow into a recurring assurance calendar.

Audience: Compliance heads, CISOs, internal audit, IS audit teams

Q9. What are RBI's 2026 cybersecurity Directions?

They are the 'Cybersecurity, Technology: Risk, Resilience and Assurance Framework' Directions issued on 31 July 2026 for commercial banks (RBI/DoS/2026-27/410) and, separately, for small finance banks, payments banks, urban co-operative banks, All India Financial Institutions, NBFCs and credit information companies. They took effect immediately and repealed the earlier cybersecurity and IT governance instructions for these entities.

Q10. What happened to the 2016 Cyber Security Framework and the 2023 IT Governance Master Direction?

For the entities covered by the 2026 Directions, RBI repealed the existing instructions on cybersecurity framework and IT governance through a circular dated 31 July 2026, with standard saving provisions for actions taken under the earlier instructions. Banks should update policy references, control libraries and audit programmes to the new Directions.

Q11. What are the key testing frequencies?

For critical systems and DMZ systems with customer interfaces, the commercial bank Direction requires vulnerability assessment at least once every six months and penetration testing at least once every 12 months, performed by trained, independent experts. Non-critical systems follow a risk-based approach, and testing is also expected after new implementations and major changes.

Q12. How quickly must cyber incidents be reported?

Cyber incidents must be reported to RBI on the DAKSH platform within six hours of detection, and banks must proactively notify CERT-In. CERT-In's Directions separately require specified incidents to be reported within six hours. Reliable reporting needs 24x7 monitoring, clear classification criteria and rehearsed escalation.

Q13. What are the DR and business continuity expectations?

DR drills for critical systems must be conducted at least half-yearly, with operations running from the DR site for at least a full working day. The ITSC reviews BCP/DR adequacy at least annually, and the bank must document a Cyber Crisis Management Plan covering detection, containment, response and recovery.

Q14. Who oversees IS audit, and how often must it be done?

The Audit Committee of the Board oversees IS audit and approves and reviews the IS Audit Policy at least annually. The commercial bank Direction calls for risk-based audit planning and allows continuous auditing for critical systems; it does not prescribe a single fixed frequency, so the IS Audit Policy should define coverage and cycles.

Q15. Do VA/PT and audits have to be performed by CERT-In empanelled auditors?

The commercial bank Direction requires VA/PT by trained, independent experts and states that, where CERT-In empanelled auditors are engaged, the bank should follow CERT-In's audit guidelines. Other requirements—such as payment data storage audits or contractual obligations—may specify empanelled auditors. Codec Networks is CERT-In empanelled for information security auditing services.

Q16. What other RBI rules affect bank cybersecurity?

Key instruments include RBI's Managing Risks in Outsourcing Directions, 2025; the Authentication Mechanisms for Digital Payment Transactions Directions, 2025 (in force from 1 April 2026); the revised customer-protection framework for fraudulent electronic banking transactions (applicable from 1 January 2027); KYC directions including V-CIP; fraud risk management directions; and the 2018 circular on storage of payment system data.

Audience: CIOs, CTOs, digital banking heads, application security teams

Q17. What should a bank's VAPT programme cover?

It should cover internet-facing and DMZ systems, critical internal systems, internet and mobile banking, APIs, payment interfaces, core banking, cloud workloads and network devices. Testing should be authenticated where relevant, include business-logic testing and end with retesting of fixed findings.

Q18. What does the Direction say about application security?

Banks must apply secure design, coding and testing practices, including threat modelling, and conduct application security testing throughout the lifecycle—with scope not limited to the OWASP Top 10. For critical applications, banks should obtain source code or put escrow or equivalent arrangements in place, and obtain vendor confirmation that applications are free of known vulnerabilities and malware.

Q19. What should mobile banking security testing include?

Testing should cover device binding and registration, authentication and session handling, secure storage, communication security, root and jailbreak detection, tampering and repackaging resistance, detection of remote-access apps and backend API security. OWASP MASVS provides a useful baseline.

Q20. Why is API security a priority for banks?

APIs connect mobile apps, corporate customers, fintech partners, co-lending NBFCs and Account Aggregators to bank systems. A single authorisation flaw or overshared response can expose large volumes of customer data. APIs should be inventoried, minimised, tested in each significant release and monitored for abuse.

Q21. How do the 2026 Authentication Directions change digital channels?

From 1 April 2026, domestic digital payment transactions require at least two factors of authentication, with at least one dynamic factor, subject to specified exemptions. RBI does not mandate a particular factor, so banks can adopt alternatives to SMS OTP such as biometrics or device-bound tokens. Authentication and account-recovery flows should be retested.

Q22. What controls protect customers on digital channels?

RBI's 2026 Direction expects risk-based transaction monitoring across channels and customer notification through alternate channels for payments above a customer-set value. Anti-phishing and anti-rogue-app services, DMARC for e-mail and customer reporting channels for phishing also reduce customer harm.

Q23. How should banks handle legacy systems that cannot be patched quickly?

Identify them in the asset inventory, assess exposure, isolate them through network segmentation, restrict and monitor access, apply compensating controls and plan replacement. The Direction requires expeditious patching under the bank's policy, with an emergency process for critical, actively exploited vulnerabilities, and time-bound remediation of VA findings.

Q24. Is red teaming mandatory?

The commercial bank Direction allows banks to conduct red team exercises but does not make them mandatory. Many larger banks use red teaming to test detection and response realistically, beyond what scheduled VA/PT can show.

Audience: SOC managers, fraud risk heads, incident response teams

Q25. What does RBI expect from a bank's Cyber Security Operations Centre?

The commercial bank Direction requires a CSOC for continuous surveillance, with round-the-clock Level 1 monitoring, Level 2 capability for root-cause analysis and corrective action, and Level 3 capability for advanced analysis, forensics and malware reverse engineering. It also expects SOC performance metrics, adequate staffing for 24x7 monitoring and threat intelligence briefings to the Board/ITSC and senior management.

Q26. Can a bank use a managed or shared SOC?

Yes, subject to the bank's outsourcing and third-party requirements. Accountability stays with the bank, so contracts must define coverage, response responsibilities, data handling, audit and RBI access rights, and reporting. Many mid-sized and co-operative banks use managed or co-managed models.

Q27. How can the CSOC help with fraud, not just cyber attacks?

A bank-aware CSOC correlates security events with fraud signals—new device registrations, SIM-change indicators, login anomalies, remote-access app detection, rapid pass-through transactions and unusual high-value transfers—so account takeover and mule activity are detected earlier.

Q28. What is a mule account, and how can banks detect them?

A mule account receives and moves fraud proceeds, often opened with borrowed, rented or synthetic identities. Indicators include dormant accounts suddenly receiving many inbound transfers, rapid outbound movement, shared devices across accounts and mismatches with the customer's profile. RBI Innovation Hub's MuleHunter.AI had been adopted by 29 banks as of July 2026.

Q29. What should a bank's Cyber Crisis Management Plan include?

It should define incident classification, roles and decision authority, escalation, containment and recovery steps, evidence preservation, communications with customers, media and regulators, and the reporting workflow to RBI (DAKSH) and CERT-In within six hours. The Direction also expects participation in cyber drills and periodic crisis-communication drills.

Q30. How long must logs be kept?

CERT-In's Directions require logs of ICT systems to be maintained securely for a rolling 180 days within Indian jurisdiction. Banks should also align log retention with their own policies, investigation needs and other applicable requirements.

Q31. When should a bank bring in forensic investigators?

As soon as a material incident is suspected. Early forensic support preserves evidence, establishes the timeline and scope, informs regulatory reporting and supports recovery and any legal action. An incident response retainer agreed in advance avoids delays during a crisis.

Q32. How should a bank test its readiness for ransomware?

Combine ransomware simulation, backup restoration tests, EDR coverage validation, half-yearly DR drills on critical systems and leadership tabletop exercises. Recovery readiness should be demonstrated with evidence rather than assumed from the existence of a backup policy.

Audience: Vendor management, cloud and infrastructure heads, data protection leads, innovation teams

Q33. How should banks manage third-party cyber risk?

Classify vendors by criticality, perform due diligence, include security, incident-notification, audit and RBI access rights in contracts, and review evidence periodically. RBI's Managing Risks in Outsourcing Directions, 2025 govern outsourcing generally, and the 2026 Direction adds requirements for IT and cyber third-party arrangements not covered by them.

Q34. What are the requirements for ATM switch service providers?

Where a commercial bank runs its ATM switch through a third-party shared service, RBI's 2026 Direction lists baseline control areas the provider must implement and requires them to be built into contracts, along with baseline contractual controls such as incident reporting to the bank and periodic VA/PT.

Q35. Can banks use public cloud?

Yes, within RBI's outsourcing and cybersecurity requirements and applicable data localisation rules. The 2026 Direction extends VA/PT and software controls to cloud environments, and the bank must follow legal requirements on infrastructure location and cross-border data movement. Shared-responsibility boundaries should be documented and tested.

Q36. When do DPDP obligations apply to banks?

The DPDP Rules, 2025 were notified on 13 November 2025 with phased commencement. Most data-fiduciary obligations, including security safeguards and breach intimation, take effect in May 2027. Banks should complete data mapping, consent and notice reviews, DLP and breach-workflow readiness before then.

Q37. What does the 2026 Direction require on data leak prevention?

It requires a DLP strategy covering endpoints, data in transit and data at rest, extending to vendor-managed facilities and customer data, together with controls on removable media and the ability to remotely wipe or lock mobile devices.

Q38. What risks come with AI in banking?

AI in fraud detection, customer service and credit decisions introduces risks such as model manipulation, data leakage through prompts or outputs, prompt-injection attacks against chatbots and agents, and unreliable automated decisions. AI systems should be inventoried, tested with AI-specific techniques and governed under a framework such as ISO/IEC 42001.

Q39. How do deepfakes affect banks?

Cloned voices and synthetic video can impersonate customers during V-CIP and impersonate executives to authorise payments. Defences include liveness detection, call-back verification on independent channels, maker-checker controls that cannot be overridden by phone and regular deepfake simulation for treasury and service teams.

Q40. How can a bank start an engagement with Codec Networks?

Begin with a scoping discussion covering the bank's category, critical systems, channels, third parties, inspection calendar and immediate concerns. Codec Networks will propose a scope, methodology, timeline and deliverables—often starting with a gap assessment against RBI's 2026 Directions or a VAPT programme.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Requirements differ by bank category; confirm obligations against the current official Directions, including amendments issued by RBI, NABARD, CERT-In and MeitY.