RBI Cybersecurity Directions 2026: what changes for branch, ATM and WAN networks
On 31 July 2026, RBI issued the "Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026" (RBI/DoS/2026-27/410). They took effect immediately and replace earlier cyber and IT-governance instructions. For network teams, the key paragraphs cover 6-hour incident reporting on DAKSH, VA and PT frequency, MFA for privileged and telework access to critical systems, strong cryptography and periodic review of VLAN, LAN/WAN and third-party interconnections. The Directions do not mandate a cryptography inventory, a standalone segmentation rule or a fixed log-retention period.
Key facts
| Instrument | Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 |
| Reference and date | RBI/DoS/2026-27/410, DoS.CO.CSITEG.4/31.01.015/2026-27, 31 July 2026 |
| Effective | Immediately |
| Versions | Seven, one per class of regulated entity (commercial banks, small finance banks, payments banks, UCBs, AIFIs, NBFCs and CICs) |
| Incident reporting | On DAKSH within 6 hours of detection, and notify CERT-In (Para 182) |
| Testing | VA every 6 months, PT every 12 months for critical and customer-facing DMZ systems (Para 151) |
| Repeal | Earlier cyber and IT-governance instructions for commercial banks stand repealed (Para 230) |
This post is based on the commercial-bank version. The other six versions share the title but may differ in detail, so check the version that applies to your entity.
What the Directions require of the network
These are the paragraphs that land on branch, ATM and WAN teams.
| Requirement | Paragraph | What it means for branch/ATM/WAN networks | Evidence to keep |
|---|---|---|---|
| Report cyber incidents on DAKSH within 6 hours of detection; notify CERT-In | 182 | Router, firewall and SD-WAN alarms must reach the SOC fast enough to detect, triage and report inside 6 hours | Alarm-to-ticket timestamps, incident reports, CERT-In notifications |
| Up-to-date inventory of information assets, including network devices, with business criticality | 47 | Every branch router, ATM router, switch and firewall listed, with site, firmware and criticality | Exported device inventory, reviewed on a schedule |
| Evaluate device configurations and patch levels at inter-VLAN nodes in the DC, LAN/WAN interfaces, external connections and partner, vendor and service-provider interconnections | 103 | Review WAN edge, branch LAN and third-party links (switch vendor, ATM managed-service provider, telecom operator) | Config review reports, patch status, config diffs |
| Segregate development, test and production | 82 | Keep lab and staging routers and controllers off the production WAN | Network diagrams, access rules |
| MFA for privileged users of critical systems and critical activities | 110 | Admins of controllers, core routers and firewalls sign in with MFA | MFA policy, admin access logs |
| MFA for enterprise (logical) access to critical systems when teleworking; identify all remote-access devices | 114 | Remote staff and vendors reaching critical systems use MFA; you keep a list of devices that connect | Remote-access policy, device list, session logs |
| Strong, non-deprecated key lengths, algorithms, cipher suites and protocols | 140 | Retire weak IPsec and TLS settings on tunnels, VPNs and management interfaces | Crypto settings per tunnel type, change records |
| VA every 6 months and PT every 12 months for critical systems and customer-facing DMZ systems | 151 | Internet-facing gateways and DMZ systems go into the test plan | VA/PT reports, remediation tracker |
| Audit logs, with scope, frequency and storage set by the bank | 93–97 | Decide which network logs you collect and where they go | Logging policy, SIEM integration evidence |
| IPv6 for public-facing IT infrastructure | 78 | Check IPv6 readiness at internet-facing edges | IPv6 plan and status |
The Directions also require a cyber security operations centre (CSOC). For most banks, that is where network alarms end up.
What they don't require
Three common claims need correcting.
Myth 1: "RBI now mandates a cryptography inventory." The commercial-bank text does not. Para 140 requires strong, internationally accepted, non-deprecated cryptography. Para 47 requires an inventory of information assets. A cryptography bill of materials (CBOM) is a good way to show which algorithms you use, but it is not an RBI rule in this version.
Myth 2: "RBI sets a log-retention period." It does not. Paras 93–97 leave the scope, frequency and storage of log collection to the bank. The fixed number comes from CERT-In: its Directions of 28 April 2022 require ICT logs kept for a rolling 180 days within India.
Myth 3: "All remote access now needs MFA." The mandatory MFA language is narrower. It covers privileged users of critical systems and critical activities (Para 110), and enterprise access to critical systems when teleworking (Para 114). Many banks will extend MFA further, and that is a sensible risk decision. But it is not what these paragraphs say.
A fourth point: there is no standalone "network segmentation" paragraph. Para 103 on interconnections, Para 82 on separating development, test and production, and the DMZ definition come close. Segmentation is how most banks will meet them, but the text does not prescribe a design. RBI also does not approve network vendors. The obligation stays with the bank.
Branch networks
A branch is a small site with a big attack surface: teller systems, CCTV, guest Wi-Fi and vendor devices, often on one switch.
- Separate traffic by purpose. Keep core banking, CCTV, guest and vendor traffic in different zones. This is the practical way to show the interconnections in Para 103 are controlled.
- Put branch devices in the asset inventory. Include the router, switch and Wi-Fi access points, with firmware versions (Para 47).
- Watch local admin access. Anyone who can change a branch router's configuration is a privileged user. If the router is part of a critical system in your classification, Para 110 MFA applies.
- Send alarms centrally. A branch compromise found days later cannot be reported within 6 hours of detection. Feed branch alarms into the CSOC.
ATM and off-site networks
ATMs are often run by third parties over cellular or VSAT links, which makes them interconnection-heavy.
- Treat the ATM service provider link as a third-party interconnection. Para 103 names partner, vendor and service-provider interconnections. Review configurations and patch levels there too.
- Check the contract route. IT and cyber third-party arrangements outside the "Managing Risks in Outsourcing Directions, 2025" fall under Paras 126–135 of the 2026 Directions. Your compliance team should confirm which applies to each ATM contract.
- Know your router estate. Thousands of off-site routers need firmware, crypto settings and ownership tracked centrally.
- Keep logs in India. RBI leaves retention to you, but CERT-In's 180-day in-India log rule still applies.
WAN and data centre
- Review the DC side of the WAN. Para 103 specifically names inter-VLAN nodes in the data centre and LAN/WAN interfaces. Schedule these reviews and keep the reports.
- Test the edges. Internet-facing gateways and DMZ systems with a customer interface need VA every 6 months and PT every 12 months (Para 151).
- Retire weak crypto. List the IPsec proposals, TLS versions and SSH settings in use across tunnels and management planes, then remove deprecated ones (Para 140).
- Separate labs. Staging controllers and test routers should not reach production (Para 82).
A 30-day checklist for network teams
- Map each network system to your critical and non-critical classification.
- Export a full inventory of routers, switches, firewalls and access points, with site, firmware and criticality (Para 47).
- List every third-party interconnection: ATM providers, telecom operators, vendors and partners (Para 103).
- Run a configuration and patch review on DC inter-VLAN nodes, WAN edges and third-party links, and file the report (Para 103).
- Turn on MFA for every admin of controllers, core routers and firewalls (Para 110).
- Enforce MFA for telework access to critical systems, and build the list of remote-access devices (Para 114).
- Document IPsec, TLS and SSH settings per tunnel type, and plan the removal of deprecated algorithms (Para 140).
- Add internet-facing gateways and customer-facing DMZ systems to the VA (6-monthly) and PT (12-monthly) calendar (Para 151).
- Route network alarms to the CSOC, and time a test incident from alarm to a draft DAKSH report (Para 182).
- Write down your network log scope, storage and retention, and keep at least 180 days in India for CERT-In.
- Check that devices sync to NIC or NPL NTP sources.
- Confirm with compliance which outsourcing or third-party paragraphs cover each network service contract.
Where Nexapp fits
Nexapp builds SD-WAN, NGFW, SSE/ZTNA and Instaroute 4G/5G routers for Indian banks and enterprises. The platform helps you meet several of the paragraphs above. The obligation stays with your bank.
- Interconnection control (Para 103): Nexapp SD-WAN Enterprise separates branch, ATM and vendor traffic with VRF and a zone firewall, and adds IPS, antivirus and web filtering.
- Access (Paras 110 and 114): Nexapp SSE/ZTNA grants access app by app, checks device posture and supports passkey sign-in.
- Logs and detection (Paras 93–97 and 182): logs export to your SIEM over syslog, and retention is configurable to your policy. The platform runs Nexapp-hosted in India or self-hosted in your data centre.
- Cryptography (Para 140): IKEv2 tunnels support hybrid post-quantum key exchange (ML-KEM).
- Operations: a 24×7 NOC in Pune.
See how this maps to banking on our BFSI page, and our security practices on the Trust page.
Sources
- RBI Directions text, RBI/DoS/2026-27/410 (mirror; RBI notification)
- KPMG India on the seven entity-wise versions
- CERT-In Directions, No. 20(3)/2022-CERT-In, 28 April 2022
- RBI (Commercial Banks – Managing Risks in Outsourcing) Directions, 2025, 28 November 2025 (TaxGuru reproduction)
Frequently asked questions
Do the Directions apply to our SD-WAN provider?
The Directions apply to the bank, not the vendor.
Your provider's services come in through your contracts: the Managing Risks in Outsourcing Directions, 2025, or Paras 126–135 for IT and cyber arrangements outside them. The provider may also have its own CERT-In duties, such as 180-day logs in India.
Is 6 hours from detection or occurrence?
From detection. Para 182 says banks report cyber incidents "within six hours of detection" on DAKSH.
CERT-In's separate 6-hour clock runs from noticing the incident or being told about it. Keep timestamped records for both.
Do we need MFA for all branch staff?
Not under the mandatory wording.
MFA is mandatory for privileged users of critical systems and critical activities (Para 110), and for telework access to critical systems (Para 114). Branch admins who can change critical systems count as privileged. Going further is your risk decision.
Does RBI mandate SD-WAN?
No. The Directions are technology-neutral.
They ask for controlled interconnections, strong cryptography, MFA in defined cases, testing and fast reporting. SD-WAN with segmentation and central logging is one way to meet these, not a requirement.
What about NBFCs and co-operative banks?
RBI issued seven versions on 31 July 2026, including ones for NBFCs and urban co-operative banks.
They share the title and structure, but details may differ from the commercial-bank version summarised here. Read the version for your entity, and check paragraph numbers against it.
Mapping your branch and ATM network to the 2026 Directions? Walk through it with a Nexapp architect.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.