RBI IT Governance Master Direction Audit
Board IT Strategy Committee to operator-level evidence — audited the way RBI inspectors read it.
Audit against the RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (effective 01-Apr-2024). Covers IT governance, IT services management, IT operations, information security, business continuity and IT audit obligations for banks, NBFCs, AIFIs and credit information companies.
- RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices (RBI/2023-24/107 dated 07-Nov-2023)
- RBI Cyber Security Framework for Banks (Jun 2016, updated)
- RBI Master Direction on Outsourcing of IT Services (RBI/2023-24/102 dated 10-Apr-2023)
- RBI IT Examination Framework + Annexures
- COBIT 2019 (mapped) + ISO 27001:2022
- ITIL 4 service-management practices
- ISO 22301 (BCP) — mapped where in scope
Compliance is leverage, not paperwork.
RBI Master Direction RBI/2023-24/107 dated 07-Nov-2023 (effective 01-Apr-2024) replaced two decades of fragmented IT-governance guidance with a single, prescriptive direction. The board IT Strategy Committee, IT Steering Committee, CISO independence, IT-services management lifecycle and IT-audit independence are now individually examinable. RBI inspections in 2024-25 have already cited dozens of REs for non-constitution of the IT Strategy Committee or CISO reporting through the CIO. Macksofy's audit produces the governance evidence, control-to-clause map and inspector walk-through pack required for a clean IT examination.
- Scheduled Commercial Banks (excl. RRBs and LABs as per applicability matrix)
- Top, Upper and Middle Layer NBFCs per Scale-Based Regulation
- All-India Financial Institutions (NABARD, NHB, EXIM, SIDBI, NaBFID)
- Credit Information Companies regulated under CICRA
- Boards looking to pre-empt the FY25-26 IT examination cycle
- Group entities consolidated under banking-group IT governance
Aligned to the regulations that matter.
How we run a RBI IT Gov MD engagement.
Interactive walkthrough — every phase clickable, every activity documented, every artefact regulator-ready.
1 · Governance baseline
- Board IT Strategy Committee constitution + charter audit
- IT Steering Committee minutes + decision-trail walk
- CIO / CISO / Head-IT-Assurance independence test
- IT-strategy alignment with business-strategy evidence
- 011 · Governance baseline
- Board IT Strategy Committee constitution + charter audit
- IT Steering Committee minutes + decision-trail walk
- CIO / CISO / Head-IT-Assurance independence test
- IT-strategy alignment with business-strategy evidence
- 022 · IT services & operations
- IT-services management lifecycle review (intake to retire)
- Change, release, configuration, problem, incident management
- Capacity, performance & availability management evidence
- Cryptographic-control inventory + lifecycle
- 033 · Risk, controls & information security
- IT-risk register + risk-acceptance audit trail
- Information-security policy + control-baseline currency
- Vulnerability + patch lifecycle SLA evidence
- Logging + monitoring + SOC capability assessment
- 044 · Business continuity & DR
- BCP / DR policy + tested RTO / RPO evidence
- DR drill cadence + lessons-learned closure
- Cyber-incident scenario in BCP testing
- Critical-system recovery walk-through
- 055 · IT assurance & audit
- IT-audit charter + Head-IT-Assurance independence
- Risk-based IT-audit plan adequacy
- Audit-finding closure + board reporting
- External-audit coverage gap analysis
- 066 · Reporting & inspection pack
- Clause-by-clause compliance attestation
- RBI IT examination walk-through deck
- Remediation roadmap + 30-day retest
Everything you need to satisfy auditors.
- Governance constitution pack — IT Strategy + Steering Committee charters
- CISO / Head-IT-Assurance independence attestation
- Clause-by-clause MD compliance register
- IT-services management lifecycle gap report
- BCP / DR drill evidence + cyber-scenario test report
- IT-audit charter + risk-based plan
- RBI IT-examination walk-through deck
- Free retest within 30 days + closure letter
Pre-IT-examination MD readiness audit
Outcome: IT Strategy Committee re-constituted with independent director; CISO moved out of CIO reporting line; clean RBI IT examination with no major findings
End-to-end MD audit + board reporting reset
Outcome: Risk-based IT-audit plan rolled out; quarterly IT-Strategy-Committee dashboard live; audit-finding closure cycle compressed from 180 to 60 days
The shape of a RBI IT Gov MD engagement.
Every number below is grounded in how Macksofy actually runs the engagement — not aspirational marketing copy.
What we actually examine.
Each pillar is a distinct workstream inside the engagement — scoped, evidenced, and signed off independently before the audit pack is assembled.
- Board & strategic governance3 pts
- IT services management3 pts
- IT operations & infrastructure3 pts
- Information & cyber security3 pts
- Business continuity3 pts
- IT assurance & audit3 pts
IT Strategy Committee, IT Steering Committee and CISO independence — the three things RBI checks first.
- IT Strategy Committee constitution + minute trail
- IT Steering Committee composition + decisions
- CISO reporting line independence from CIO
End-to-end lifecycle from demand intake through retirement — auditable, not anecdotal.
- Change / release / configuration evidence
- Capacity + performance management
- Cryptographic-key lifecycle + HSM controls
The everyday running of the estate the rest of the MD assumes is in place.
- Data-centre + DR site operations
- Backup, restore, integrity-test cadence
- Patch & vulnerability SLA evidence
Cross-mapped to the RBI CSF — the MD pulls security squarely into governance.
- ISMS alignment + control baseline
- SOC + threat-monitoring capability evidence
- Cyber-incident reporting (CSITE 6h / CERT-In)
Tested RTO / RPO with cyber-incident scenarios in the drill plan.
- BCP policy + scenario-based DR tests
- Cyber-incident scenario in BCP testing
- Critical-system recovery time evidence
An independent IT-audit function, risk-based plan, and closure traceable to the board.
- Head-IT-Assurance charter + independence
- Risk-based IT-audit plan + coverage
- Audit-finding closure + board reporting trail
From kick-off to regulator-ready report.
The horizontal flow below shows the typical week-by-week shape of a RBI IT Gov MD engagement. Click any station for detail in the methodology section above.
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things compliance leads ask before signing.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements