Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023 — DoS.CO.CSITEG/SEC.7/31.01.015/2023-24, issued 7 November 2023, effective 1 April 2024.
Most compliance tooling sold into Indian financial services implies something it cannot deliver: that running a scan gets you closer to being compliant. For the RBI IT Governance Directions specifically, that claim collapses under inspection. The Directions are structured around board accountability, committee charters, and independent assurance. A configuration scan cannot see any of that.
What a scan can do is produce technical evidence against a specific, bounded subset of the Directions — and do it in minutes rather than weeks. The useful question is which subset. This post answers it for Microsoft 365, paragraph by paragraph, and is equally explicit about the paragraphs no tenant scan will ever touch.
Who this applies to
The Directions bind a defined set of Regulated Entities: scheduled commercial banks, small finance banks, payments banks, local area banks, primary urban co-operative banks (on a graded basis), NBFCs in the Top, Upper and Middle Layers under Scale-Based Regulation, credit information companies, and the All-India Financial Institutions (EXIM Bank, NABARD, NaBFID, NHB, SIDBI).
Two exclusions matter and are frequently missed:
- Regional Rural Banks are explicitly outside this Master Direction. They are governed separately.
- Base Layer NBFCs fall broadly outside the full-scope obligations, though the spirit of the Directions is encouraged.
If your organisation is not in the covered universe, an assessment against these Directions is a security posture review, not a compliance position. Say so in the report. Auditors notice when a document overstates its own standing.
The four paragraphs M365 configuration evidences most directly
Para 19 — Access controls
This is where the strongest M365 evidence sits. Para 19 covers need-based access, privileged user supervision, and multi-factor authentication for privileged users of critical information systems.
Directly evidenceable from tenant configuration:
- Conditional Access policy inventory and enforcement scope
- MFA registration and enforcement state, per user and per policy
- Privileged Identity Management configuration — whether Global Administrator assignments are permanent or eligible, and whether activation requires MFA and approval
- Guest and external access permissions
- Access review configuration for privileged roles
The gap most tenants fail on is not MFA itself but permanent privileged assignment. A tenant with five standing Global Administrators and no PIM has a least-privilege finding regardless of how well MFA is configured.
Para 20 — Secure teleworking and remote access
Covers MFA for enterprise logical access, secure remote working, and remote-device identification.
Evidenceable: Conditional Access device-compliance requirements, Intune enrolment coverage, device compliance policy existence and scope, legacy authentication blocking, and app protection policies for mobile.
Legacy authentication deserves specific mention. It bypasses Conditional Access entirely, which means an otherwise well-configured MFA posture can be defeated by a protocol nobody remembers leaving enabled.
Para 23(d) — Secure storage, transmission and processing of data
Evidenceable: Data Loss Prevention policy coverage across Exchange, SharePoint, OneDrive and Teams; retention policy scope; sensitivity label publication; BitLocker enforcement via Intune; external forwarding configuration.
A common pattern is DLP configured for Exchange only, with Teams and SharePoint left uncovered — which is a partial control that reads as a full one on a policy list.
Para 25 — Risk assessment, phishing and spoofing mitigation
Para 25(c) names phishing and spoofing explicitly, which makes email authentication configuration directly citable rather than inferred.
Evidenceable: SPF, DKIM and DMARC records and enforcement posture; anti-phishing impersonation protection; Safe Links and Safe Attachments policy coverage; anti-spam thresholds; quarantine configuration.
DMARC at p=none is the single most common finding here. The record exists, so a checklist marks it present, but nothing is enforced.
Paragraphs partially evidenceable
Para 15 — Audit trails and log monitoring. Configuration state is visible: unified audit log enabled, mailbox auditing scope, diagnostic export destinations, sign-in log retention tier. What a scan cannot show is whether anyone monitors those logs, which is the substance of the obligation. Para 15 requires audit trails detailed enough for forensic use and regular monitoring for unauthorised activity — it sets no specific retention period, contrary to a persistent myth of 90 or 180 days.
Para 16 — Cryptographic controls on transmission channels. TLS enforcement on Exchange connectors is visible. The organisation’s broader key management standard, HSM usage and algorithm policy are not.
Para 21 — IT performance and maturity metrics. Microsoft Secure Score and Compliance Manager score are retrievable and make reasonable input metrics. Whether they are reported to the IT Strategy Committee is a governance question.
Para 27 — Cyber incident response. Alert and incident state in Defender XDR is visible, as is Defender for Endpoint onboarding coverage. Whether the entity has a tested incident response plan, and whether it reports to CERT-In within the six-hour window under the CERT-In Directions of 28 April 2022 and to the RBI within the prescribed timeframe, is documentary evidence a scan cannot produce.
What no tenant scan can evidence
This is the part most vendors leave out. The following obligations are board, committee and process matters. No configuration scan — from any vendor, on any platform — produces evidence for them:
- Paras 4–8 — IT governance framework, board oversight, IT Strategy Committee. The ITSC must be chaired by an independent director with substantial IT expertise and meet at least quarterly. Evidence is charters, minutes, attendance and quorum records.
- Paras 22–24 (governance elements) — risk management framework, information security policy, CISO mandate. The CISO must report independently of IT operations. Assessors flag CISOs reporting into the CIO more often than almost any other finding, and no tool detects a reporting line.
- Paras 28–30 — Information Systems audit. Para 30 requires an IS Audit Policy approved by the Audit Committee of the Board, reviewed at least annually, risk-based audit planning, and a separate IS Audit function or resources within Internal Audit. Where external resources are used for skills the entity lacks, accountability remains with Internal Audit. Notably, the Directions set no auditor empanelment requirement — a point often misstated.
- Business continuity and disaster recovery. BIA, RTO/RPO definitions and live failover drill evidence are entirely outside a cloud configuration scan.
- Third-party and outsourcing risk. Governed alongside the Master Direction on Outsourcing of Information Technology Services (10 April 2023, effective 1 October 2023). Due diligence records, contractual audit rights and exit plans are documentary.
If a vendor tells you their scan covers the RBI IT Governance Directions, ask which paragraph it evidences for the ITSC charter. There is no answer.
How to use this split
The practical value of separating the two categories is sequencing. Configuration findings are cheap and fast to close — blocking legacy authentication is a fifteen-minute change; publishing sensitivity labels is an afternoon. Governance findings take board cycles and cannot be compressed.
An entity approaching its first IS audit under these Directions is usually better served closing the configuration set first, because it is achievable inside a single audit window and it removes the findings an assessor will document fastest. The governance workstream runs in parallel on a longer clock.
What a scan gives you is a defensible technical baseline with timestamped evidence, against a named subset of paragraphs, with the boundary of that subset stated explicitly. That is a smaller claim than most tooling makes. It is also one you can put in front of an auditor without qualification.
A note on paragraph references. The RBI Master Direction is a public regulatory instrument; this article is original commentary and does not reproduce its text. Paragraph identifiers reflect the structure of the Direction as published, but numbering should be verified against the current gazetted version and any subsequent amendments or FAQs before being relied on for certification. The authoritative source is the RBI notification itself: DoS.CO.CSITEG/SEC.7/31.01.015/2023-24.