The six-hour clock: why India's new cyber directions make board accountability load-bearing for NBFCs
India's banking regulator issued seven parallel IT-governance directions on 31 July 2026, effective immediately, covering every class of regulated entity from commercial banks to NBFCs. The six-hour incident reporting obligation is the operational detail that changes how a risk function has to be built. For most boards, reviewing a cyber report once a quarter no longer meets the standard just set.
Originally published on linkedin
FinSaAIstra Intelligence | AI Governance & Regulatory Risk Series | August 2026
India’s banking regulator issued seven parallel directions that week, covering commercial banks, small finance banks, payments banks, urban co-operative banks, all-India financial institutions, NBFCs, and credit information companies. Each one repeals the older IT-governance instructions it replaces. All are in force immediately.
Buried inside the paperwork is an operational detail that changes how a risk function has to be built: any cyber incident now has to reach a regulator-run incident platform within six hours of detection.
What Six Hours Actually Means
Six hours sounds generous until you map what has to happen inside it. Detection, internal escalation, classification, a written report accurate enough to submit to a regulator - all inside a window that starts the moment the incident is detected, not the moment it’s confirmed or understood.
Most institutions can eventually produce a good incident report. Very few can produce a defensible one in six hours, because that requires automated detection-to-disclosure infrastructure most risk functions were never asked to build.
A Governance Obligation, Not a Technology Problem
For a CRO, this is not a technology problem to hand to the CISO. The directions frame cyber and technology risk as a board-level fiduciary duty, on the same footing as credit and market risk. A board that receives a cybersecurity briefing once a quarter and calls that oversight no longer meets the standard the regulator just set.
The Hidden Compliance Trigger Inside Balance-Sheet Growth
NBFC obligations are also tiered by asset size. Institutions above roughly Rs 500 crore in assets move into a materially heavier governance chapter than smaller ones. An NBFC’s own balance-sheet growth can quietly trigger a harder compliance regime, without anyone in the business treating growth itself as a compliance event.
The Vendor Contract Gap
Vendor contracts are the part most risk teams haven’t touched yet. A managed security provider that can’t commit, in writing, to a detection-to-disclosure timeline compatible with six hours is now a named liability sitting inside a procurement file, not a technical footnote. Renegotiating that clause is cheaper this quarter than discovering the gap during an actual incident.
The Board Accountability Test
Reviewing an incident report is not the same activity as owning the outcome, and the regulator just made that distinction load-bearing. The real governance failure point in most BFSI boards right now isn’t a missing cybersecurity policy. It’s the absence of one named individual who can personally answer for that six-hour clock.
If your board can’t name that person today, is that a gap in the cyber programme, or a gap in the board?