Assurance · Regulated Payments
RBI cyber resilience for payment operators — compliant, audited, assured.
The RBI Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (2026) raise the bar for every PSO. Srida IT maps every control area to independent assessment, remediation and assurance — so you meet the Directions and can prove it.
The core obligations
In effect now for Large & Medium non-bank PSOs; for Small PSOs from 1 April 2028.
Who must comply
Every authorised non-bank Payment System Operator.
Payment gateways, PPI issuers, white-label ATM operators, card networks, aggregators, TReDS and Bharat Bill Payment operators — and the unregulated partners in their ecosystem, by mutual agreement. The Directions consolidate RBI’s earlier circulars (ATM Switch ASPs, system audit scope) into one reference, with board-level accountability and hard deadlines such as 6-hour incident reporting.
Requirement → capability
Every control area in the Direction — covered.
Almost everything the Master Direction mandates maps directly to a service Srida IT already delivers.
System Audit of the PSO (Section V)
What RBI requires
Annual system audit of the payment system against the RBI-defined scope.
How Srida IT helps
System-audit readiness, gap assessment, evidence packs and remediation support.
Governance — IS policy, CCMP, CISO, KRIs/KPIs
What RBI requires
Board-approved IS policy & CCMP, a CISO/senior owner, monitored KRIs & KPIs.
How Srida IT helps
vCISO, IS-policy & governance framework, CCMP development, KRI/KPI design and board reporting.
Risk assessment & monitoring
What RBI requires
Cyber-risk assessment for new products/changes; IT assessment reports to the board.
How Srida IT helps
Cyber-risk assessments, pre-launch reviews and board-ready risk reporting.
ISMS & data security
What RBI requires
An ISMS on applicable standards; DLP; PII protection; encryption in transit & at rest.
How Srida IT helps
ISO/IEC 27001 ISMS build & internal audit; data protection; DPDPA & ISO/IEC 27701 privacy.
PCI-DSS (card data)
What RBI requires
PCI-DSS compliance & certification for stored card data.
How Srida IT helps
PCI DSS v4.0 readiness, gap assessment and remediation.
Security testing (VA/PT, source-code review)
What RBI requires
Annual authenticated VA/PT and source-code review; pre-deployment security audits.
How Srida IT helps
VAPT, source-code review and pre-deployment security assessments.
Network security, SOC & SIEM
What RBI requires
SOC monitoring, SIEM correlation, segmentation, boundary defences, anti-malware.
How Srida IT helps
SOC/SIEM advisory & design, network-security and segmentation review.
Secure SDLC & APIs
What RBI requires
Secure-by-design S-SDLC; multi-tier architecture; API authN/Z, integrity, availability.
How Srida IT helps
Secure-SDLC advisory, application & API security assessment, source-code/escrow guidance.
Vendor / third-party risk
What RBI requires
Vendor controls; independent auditor assurance on critical vendors' cyber resilience.
How Srida IT helps
Third-party risk assessments and independent vendor cyber-resilience assurance.
Incident response & reporting
What RBI requires
Board-approved IR; forensics; reporting to RBI within 6 hours and to CERT-In.
How Srida IT helps
IR plan & playbooks, forensic readiness, the RBI/CERT-In reporting process, IR retainer.
Business continuity & DR
What RBI requires
BCP on cyber scenarios; DR in a different seismic zone; near-zero RPO; half-yearly drills.
How Srida IT helps
BCP/DR programme (ISO 22301), RTO/RPO design and DR-drill facilitation.
Cloud security
What RBI requires
Cloud operation policy, data localisation, annual independent CSP audits.
How Srida IT helps
Cloud-security policy, CSP assurance and configuration review.
Patch & change management
What RBI requires
Documented patch/change lifecycle; emergency patching for critical vulnerabilities.
How Srida IT helps
Patch- & change-management SOPs and governance.
IAM & inventory
What RBI requires
Least-privilege IAM, MFA for privileged accounts, asset inventory & data-flow maps.
How Srida IT helps
IAM review & design, privileged-access controls, asset & data-flow mapping.
Digital payment security (mobile, card, PPI)
What RBI requires
Device binding, session security, fraud monitoring, MFA, masked/secure alerts.
How Srida IT helps
Digital-payment control review, fraud-monitoring and transaction-security advisory.
Awareness & board sensitisation
What RBI requires
Periodic staff awareness; board & senior-management sensitisation.
How Srida IT helps
Srida IT Academy — awareness programmes and board/executive briefings.
ATM Switch ASP controls (Section VI)
What RBI requires
Cyber-security controls for third-party ATM Switch Application Service Providers.
How Srida IT helps
ATM Switch ASP security assessment and control review.
How we engage
Assess → Remediate → Assure → Sustain.
Assess
A gap assessment of your environment against every control area of the Master Direction, with a prioritised, board-ready remediation roadmap.
Remediate
Build the missing pieces — IS policy, CCMP, ISMS, IR & BCP/DR, IAM, logging, PCI/ISMS controls — and close VA/PT findings.
Assure
Independent testing (VA/PT), vendor assurance and system-audit readiness, so you can face the formal RBI system audit with confidence.
Sustain
Continuous GRC assurance between audits, an incident-response retainer, and ongoing KRI/KPI reporting to the board.
Why Srida IT
Independent & end-to-end
An audit & assurance firm with security, GRC and privacy under one roof — assessment, remediation and independent assurance, not just advice.
Framework depth
ISO/IEC 27001, PCI DSS v4.0, DPDPA, ISO/IEC 27701, NIST CSF — backed by detailed in-house requirements & testing procedures for each.
Board-ready outputs
Gap assessments, prioritised roadmaps, evidence packs and KRI/KPI reporting your Board sub-committee can act on.
Ready for the RBI Master Direction?
Start with a readiness assessment — we’ll map your current posture against every control area and give you a prioritised path to compliance.
Srida IT provides assessment, remediation and independent assurance to help PSOs meet these Directions. Where the formal system audit must be performed by a CERT-In-empanelled auditor, we prepare and support your audit and remediation. References to standards and regulations are to the respective issuing bodies.