FAQS
On 31 July 2026, RBI issued new directions on cybersecurity and technology risk, with separate sets for commercial banks and for NBFCs. For NBFCs, the Reserve Bank of India's (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, replaced RBI's earlier IT framework and IT governance directions. Both came into force immediately.
Yes, they apply to all NBFCs registered with RBI, but not equally. NBFCs in the middle, upper and top layers carry the full set of requirements. Base-layer NBFCs have their own, lighter chapters, split by whether their asset size is below or above Rs 500 crore.
CERT-In requires listed cyber incidents to be reported within six hours of noticing them. RBI's 2026 directions for commercial banks also ask banks to report incidents to RBI within six hours of detection. Each regulated entity should check the exact reporting steps in the directions that apply to it.
No. TeamSync does not run your board committee or file returns for you. It holds the evidence those processes need, such as access records, policy versions, vendor documents, incident logs and audit reports, in one place with a tamper-evident audit trail
Yes. TeamSync can run on your own servers, in a private cloud or in a fully air-gapped network, with encryption keys you control. This suits banks and NBFCs that keep sensitive records in-house or must store payment data in India.
Partly. Many controls overlap, such as access control, encryption, incident logs and audit trails, so the same evidence can support both. DPDP-specific areas like consent and data principal requests still need their own processes.