RBI’s 2026 cyber Directions, on every cloud finding.
The Directions ask for vulnerabilities closed in a time-bound way, known problems kept from coming back, and the status in front of your committees every quarter. NxSCORE keeps that record for your cloud, finding by finding.
You will recognise this if
- The 31 July 2026 Directions replaced the frameworks your cloud controls were mapped to.
- Your board-approved policy sets the days to fix, and nobody can say how many findings are past them today.
- Every quarter, someone builds the closure status for the IT Strategy Committee by hand.
- The same misconfigurations are closed in one quarter and reported again in the next.
What RBI asks of your cloud.
RBI (Commercial Banks) Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions, 2026, RBI/DoS/2026-27/410, 31 July 2026, with the Managing Risks in Outsourcing Directions, 2025. Each clause beside the figure NxSCORE reports against it every quarter.
| Clause | What it asks | What the quarterly pack shows |
|---|---|---|
| ¶153 | Vulnerabilities fixed in a time-bound manner | Findings closed in the quarter, the share closed by their fix-by date, and what is past it |
| ¶153, ¶102 | Compliance sustained so known problems do not recur, with the root cause addressed | Resources that failed again after a fix, and prevention plans in place and holding |
| ¶66, ¶67, ¶101, ¶103 | Baseline configurations and configuration management | Baseline controls failing in at least one account at the latest assessment |
| ¶160, ¶161, ¶28(7) | Closure status and cyber risk reported to the ITSC and the Board at least quarterly | The pack itself: found, closed, time to fix, recurrence, exceptions and evidence, per quarter |
| ¶47 | An inventory of assets, with their criticality | The cloud resources NxSCORE knows across the assessed accounts |
| ¶93 to ¶97 | Audit logging enabled and validated, kept as long as the bank’s policy says | Whether the logging controls pass, and which fail |
| Outsourcing ¶69(vi), ¶92; Directions ¶131 to ¶134 | Cloud data stored in India where it applies; cloud configuration monitored | Resources found outside the Mumbai and Hyderabad regions |
The paragraph numbers here are from the Directions for commercial banks. Small finance banks, payments banks, urban co-operative banks, all-India financial institutions, NBFCs and CICs each have their own Directions of the same date, with their own numbering.
From the clause to a date on every finding.
The deadline stops being a number in a policy document. Every cloud finding carries its own date, and everyone can see which are past it.
- 01
Fix-by dates from the rule you follow.
Each finding’s fix-by date runs from the day NxSCORE first saw it, by severity. RBI sets no number of days. Enter the ones in your board-approved policy; until then NxSCORE starts at 30, 60 and 90.
Fix-by dates, your policySettings- High30 days
- Medium60 days
- Low90 days
- 02
What is past its date, today.
Every open finding is overdue, due this week, on track or risk accepted. Your analyst works the overdue and the nearly due first, and writes the fix your engineers run.
A finding closes only when a later assessment no longer sees it, so the date it closed is the date it was really fixed.
PrioritiesExample- Public access on 58 buckets, prod-paymentsDue this week
- IMDSv1 on 44 instances, data-lakeOverdue
- Unused key, svc-reportingOn track
- Port 22 open on bastion-drRisk accepted
- 03
Exceptions with a reason, a decider and an end date.
When a finding cannot be fixed in time, anyone can ask to accept the risk. Only your security team decides, with a reason and an expiry date no more than 12 months away. After that date the finding counts against its fix-by date again.
Exception, bastion-drRisk acceptedFinding Port 22 open on bastion-dr Reason Vendor access until the DR site moves to Session Manager Asked by infra team Decided by Security team Expires 31 March 2027, then counts against its fix-by date again - 04
Closed once, and kept closed.
A resource that fails again after a fix is counted as back again, not as new. When the same cause keeps returning, NxSCORE proposes a prevention plan for your team to agree and apply, and marks it verified after 14 days without the problem coming back.
Prevention plan, public bucketsApplied- Came backFixed three times this quarter, failed again each time.
- AgreedA guardrail on new buckets, agreed with the platform team.
- AppliedIn place. Watching for the problem to return.
- VerifiedAfter 14 days without it coming back.
Every date kept in one record. Now, the quarter in one pack.
Every quarter, a pack your committee can sign.
The figures your committee asks for, from the record your team works in, laid out against RBI’s clauses.
- 05
Checked every day, not before the meeting.
Every connected account is assessed every day, through read-only access. The baseline controls, the logging controls and the resources seen are part of the record the pack is built from.
Where your outsourcing arrangements need data in India, the pack lists the AWS resources it found outside the Mumbai and Hyderabad regions. Global services such as IAM and CloudFront report a home region abroad and are left out, because they are not data held there.
Daily assessmentRead-onlyBaseline Controls failing in at least one account Logging CloudTrail in every region, log validation, trail bucket logging and encryption, flow logs Inventory Every resource seen in the assessed accounts - 06
Your figures, laid out against RBI.
The pack covers the last four quarters: findings found and closed, the median time to fix, what closed within its fix-by date, what failed again, prevention plans, exceptions, and evidence accepted or waiting.
Its RBI sheet says which clause each figure speaks to. It never says you comply: that is for you, your auditors and the regulator.
RBI mappingExample¶153 41 findings closed this quarter, 88% within fix-by dates; 6 open past their date. Exceptions 9 exceptions active; 2 expire within 90 days. Recurrence 3 resources failed again after a fix; 4 prevention plans in place, 2 verified. - 07
Prepared, reviewed and approved by three people.
Data that arrives after the pack is prepared cannot change what was signed. Set it to run every quarter, and it goes to your committee by email only once an owner has approved it.
Board pack, Q3 2026Signed- PreparedThe workbook is frozen and its SHA-256 recorded.
- ReviewedBy someone who did not prepare it.
- ApprovedBy a workspace owner. The sign-off sheet names all three.
Questions about RBI and the cloud.
Does RBI set a number of days to fix a cloud misconfiguration?
No. The 2026 Directions ask for vulnerabilities to be fixed in a time-bound manner and leave the timelines to each bank’s board-approved policy. NxSCORE uses the days in your policy to give every finding a fix-by date.
Which RBI Directions does this page follow?
The Directions for commercial banks, RBI/DoS/2026-27/410 of 31 July 2026, and the Managing Risks in Outsourcing Directions of 2025. Other regulated entities have their own Directions of the same date with their own paragraph numbers.
Does the quarterly pack say we comply with the Directions?
No. It lays your own figures for the quarter against the paragraphs they speak to, so your committee can read them in the regulator’s terms. Whether the bank complies is for the bank, its auditors and RBI to judge.
Can NxSCORE show that our cloud data stays in India?
For AWS, the pack lists the resources it found outside the Mumbai and Hyderabad regions at the latest assessment. Global services are left out because they report a home region without holding your data there.
See your fix-by record before the next committee meeting.
Connect one cloud account and enter the days in your policy. After the first assessment, your analyst takes you through what is past its date, what keeps coming back, and how the quarter’s pack reads against the Directions.