New cyber norms for payment cos focus on quick reporting
https://etimg.etb2bimg.com/thumb/msid-135697610,imgsize-1651121,width-1200,height=627,overlay-etciso,resizemode-75/cybercrime-fraud/new-cyber-norms-for-payment-cos-focus-on-quick-reporting.jpg
In the wake of a string of data leaks and online attacks, Reserve Bank of India (RBI), in its consolidated cybersecurity guidelines for payment system operators, has gone beyond hygiene factors prescribed globally, requiring any cyber incident to be reported to RBI and govt agencies within six hours, focusing on domestic data storage and requiring operators to have rights over software applications.
While global standards prescribe common security controls, including role-based access, multi-factor authentication, firewalls and security operations centre monitoring, RBI has introduced requirements that reflect India’s regulatory and operational priorities. These include mandatory breach reporting, data localisation, source code access or software escrow arrangements, and stricter disaster recovery standards.
The six-hour reporting requirement is among the most demanding provisions. Payment system operators (PSOs) must report critical system outages, cyberattacks, internal fraud and settlement-related glitches to RBI within six hours of detection. Cybersecurity incidents must also be reported to CERT-In.
This is shorter than the reporting windows under several overseas frameworks. European Union’s GDPR allows 72 hours for reporting personal data breaches, while its Digital Operational Resilience Act provides tiered reporting timelines, typically ranging from four to 24 hours depending on the severity of an incident. In the US, reporting requirements under SEC and NYDFS rules range from 72 hours to four business days.
RBI has extended these requirements beyond regulated payment operators to their technology partners.
Firewall Security Company India Complete Firewall Security Solutions Provider Company in India












