Indian banks and NBFCs spent much of 2024 absorbing a compliance shift that didn't announce itself with much fanfare. The Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023, issued on 7 November 2023 and in force from 1 April 2024, repealed twelve earlier circulars on IT risk, IS audit, business continuity, VAPT, phishing, incident reporting and the CISO's role, and replaced them with a single master direction. It applies to scheduled commercial banks (other than regional rural banks), small finance and payments banks, most NBFCs, credit information companies and the all-India financial institutions.
For institutions that had been managing IT compliance as a patchwork of individual circular responses, that consolidation exposed a structural weakness: patchwork compliance produces patchwork evidence, and patchwork evidence does not survive a unified audit.
This is the case for treating ISO 27001:2022 not as a parallel certification exercise, but as the underlying management system that makes RBI compliance structurally — not just documentarily — sound.
Why "we already comply" often isn't true under the new direction
The Master Direction's chapters on IT governance (Chapter II) and IT infrastructure and services management (Chapter III) ask questions that a checklist-based compliance approach struggles to answer convincingly:
- Who owns a given control, and can that ownership be evidenced across a full audit period — not just at the point of inspection?
- Is risk treatment documented as an ongoing process, or reconstructed retroactively when an auditor asks?
- Does infrastructure change management produce a continuous audit trail, or does it rely on institutional memory?
These are exactly the questions an ISO 27001:2022 ISMS is designed to answer by default, because Clause 6 (Planning) and Clause 9 (Performance Evaluation) require continuous risk treatment and internal audit evidence as a condition of maintaining certification — not as a one-time exercise.
The practical mapping
The Direction's operative chapters line up with the ISMS as follows. This is a structural crosswalk to orient a gap assessment, not a substitute for a clause-by-clause review.
| RBI Master Direction Chapter | ISO 27001:2022 Structural Equivalent |
|---|---|
| Chapter II — IT Governance | Clause 5 (Leadership), A.5.1–A.5.4 (Policies, Roles, Segregation of Duties, Management Responsibilities) |
| Chapter III — IT Infrastructure & Services Management | A.8.9 (Configuration Management), A.8.20 (Networks Security), A.8.32 (Change Management) |
| Chapter IV — IT and Information Security Risk Management | Clauses 6.1.2–6.1.3 (Risk Assessment and Treatment), A.5.24–A.5.28 (Incident Management) |
| Chapter V — Business Continuity and Disaster Recovery Management | A.5.29–A.5.30 (Security During Disruption, ICT Readiness for Business Continuity) |
| Chapter VI — Information Systems Audit | Clause 9.2 (Internal Audit), A.5.35 (Independent Review of Information Security) |
Third-party oversight sits in a separate instrument: RBI's Master Direction on Outsourcing of Information Technology Services (2023). ISO 27001's supplier controls, A.5.19–A.5.23, are the natural home for that evidence.
Where institutions actually fail this audit
The recurring failure mode isn't a missing control. It's a control that exists on paper in the RBI compliance file and doesn't match what the ISMS risk register says about the same asset. An auditor who requests the same firewall change record from two different internal teams and gets two different answers doesn't file that as a minor discrepancy — it becomes a governance finding, because it demonstrates the institution doesn't actually have single-source-of-truth control over its own environment.
The fastest way to fail a unified IT audit is to have two teams independently maintaining evidence for the same control.
A reasonable next step for IT Risk teams
- Reconcile your RBI compliance evidence file against your ISO 27001 risk register, control by control, before your next inspection cycle — not after a finding forces you to.
- Assign single ownership per control across both frameworks. If your ISO control owner and your RBI compliance owner for the same control are different people who don't talk to each other regularly, that gap will surface in an audit.
- Treat ISO 27001:2022 certification as infrastructure, not marketing. The certificate itself satisfies external stakeholders; the ISMS process underneath it is what actually reduces the risk of a failed RBI audit.