RBI IT Governance compliance attestation due by 31 March 2025

RBI’s Master Direction on IT Governance, Risk, Controls and Assurance Practices becomes fully enforceable on 1 April 2025. Boards of banks, NBFC-Upper Layer entities, credit information companies, and payment operators must finish remediation, evidence collection, and third-party reassessments before attesting compliance in FY 2024-25 filings. this analysis nests under the AI and risk pillar hub at AI tools, the automated governance guide, and recent briefs on NYDFS Part 500 deadlines and UK operational-resilience tolerances.

Regulatory checkpoints by 31 March 2025

Chapter	Requirement	Evidence expected
Governance (Ch. II)	Board-approved IT strategy, risk appetite, and oversight committees (ITSC/IS steering).	Approved charters, minutes with risk decisions, quarterly KPI/KRI dashboards.
Risk management (Ch. III)	Integrated IT and cyber risk assessment covering confidentiality, integrity, availability, and resilience.	Risk register with inherent/residual ratings, treatment plans, and mapping to Basel/ISO controls.
Controls & assurance (Ch. IV)	Three-lines testing of critical apps, infra, and endpoints; secure SDLC; vulnerability management SLAs.	Pen test reports, code-review logs, patch metrics vs. SLA, and segregation-of-duties matrices.
Resilience (Ch. V)	BCP/DR that meets stated RPO/RTO; cyber-incident response with 6-hour containment playbooks.	Failover drill results, tabletop summaries, RPO/RTO evidence, IR runbooks with call trees.
Third parties (Ch. VI)	Critical outsourcing approvals, data localization, exit strategies, and incident notification clauses.	Contract annexes, exit tests, cloud architecture diagrams, SOC/SOX mappings.

Diagram: closing loop from board strategy → risk register → control testing → remediation queue → attestation packet.

Month-by-month finish line

1. December–January: Freeze scope of critical systems; refresh risk taxonomy; align impact ratings with RBI definitions; start third-party re-reviews for cloud/core banking.
2. February: Complete independent assurance on cyber, change, and DR; verify patching cadence; close open high/critical vulnerabilities; rehearse 6-hour incident drills.
3. Early March: Board/ITSC sessions to sign remediation plans and risk acceptance; finalize exit strategy tests for critical vendors; evidence-room build with traceability.
4. By 31 March: File internal attestation, lock audit workpapers, and schedule FY 2025-26 continuous-monitoring cadence.

Operational playbook

• Control ownership: Map each clause to accountable executives (CIO for architecture, CISO for cyber, COO for BCP/DR, Procurement for outsourcing). Embed KRIs such as patch closure <15 days (critical) and DR success rate ≥99%.
• Testing cadence: Monthly vulnerability scans, quarterly red-team or scenario tests on payments switching and core banking, semi-annual DR failovers, and quarterly vendor control walkthroughs.
• Evidence discipline: Store approvals, configs, and logs in a supervised repository with versioning and retention matching RBI inspection needs (minimum three years).
• Data localization and sovereignty: Validate that regulated PII, payment, and credit bureau data stay within India; record encryption key custody and lawful access pathways.
• Change management: Enforce segregation-of-duties and rollback plans for releases; maintain SBOMs for critical applications to accelerate vulnerability response.

Self-assessment and metrics

Metric	Target	Use
Critical vuln closure time	<15 days	Demonstrates Chapter IV patch discipline.
BCP/DR test success	≥99% across Tier-1 apps	Supports Chapter V resilience assurance.
Third-party exit tests	100% of critical vendors yearly	Proves Chapter VI reversibility readiness.
Board risk reviews	Quarterly with actions closed <30 days	Shows ongoing governance oversight.
Change rollback readiness	Documented for 100% high-risk releases	Reduces operational outage risk.

Common inspection findings to avoid

• Unapproved cloud deployments lacking data-localization controls.
• Outdated DR runbooks that fail RPO/RTO during live drills.
• Vendor contracts without notification timelines or right-to-audit clauses.
• Risk registers without residual ratings or board sign-off.

Cited sources

• RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2024
• RBI press release announcing the Master Direction

See also

Selected articles on related subjects.

Policy · Credibility 93/100 · July 1, 2025

APRA CPS 230 go-live demands board-owned operational resilience evidence

APRA's CPS 230 operational risk policy framework is now fully in force. Australian financial institutions need documented business continuity, third-party risk management, and operational resilience programs. This is one…

Policy · Credibility 86/100 · July 31, 2025

Fca Consumer Duty Board Review

The UK FCA expects Consumer Duty boards to sign off 31 July 2025 outcomes assessments with MI, fair value remediation, and vulnerable customer evidence ready for supervisor challenge.

Policy · Credibility 86/100 · September 6, 2025

Policy — Cybersecurity regulation

NIS2's supply chain security requirements are getting more attention as enforcement ramps up. Essential and important entities need to assess their suppliers' cybersecurity practices, include security requirements in…

Policy · Credibility 86/100 · September 8, 2025

Policy — Financial regulation

DORA's Register of Information requirement is operational—financial entities need to maintain detailed records of their ICT third-party arrangements. This is not just a list of vendors; you need contracts, risk…

Policy · Credibility 86/100 · September 9, 2025

Policy — Operational resilience

DORA's third-party ICT register requirements are now operational for EU financial entities. Maintain comprehensive records of ICT service providers, including risk assessments, contractual arrangements, and concentration…

Continue in the Policy pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• AI Policy Implementation Guide

  Coordinate governance, safety, and reporting programmes that meet EU Artificial Intelligence Act timelines and U.S. National AI Initiative Act mandates while sustaining product…

• Digital Markets Compliance Guide

  Implement EU Digital Markets Act, EU Digital Services Act, UK Digital Markets, Competition and Consumers Act, and U.S. Sherman Act requirements with cross-functional operating…

• Semiconductor Industrial Strategy Policy Guide

  Coordinate CHIPS and Science Act, EU Chips Act, and Defense Production Act programmes with capital planning, compliance, and supplier readiness.

Coverage intelligence

Published

March 3, 2025

Coverage pillar

Policy

Source credibility

93/100 — high confidence

Topics

RBI Master Direction · IT governance compliance · Board attestations · Third-party risk

Sources cited

3 sources (rbi.org.in, iso.org)

Reading time

6 min

Cited sources

1. Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2024 — Reserve Bank of India
2. RBI issues Master Direction on IT Governance, Risk, Controls and Assurance Practices — Reserve Bank of India
3. ISO 31000:2018 — Risk Management Guidelines — International Organization for Standardization