Operationalising Zero Trust In Indian Banking System

In an era defined by an escalating digital evolution and intricate cyber threats, the Reserve Bank of India ("RBI") is progressively tightening the cyber resilience criteria for financial entities, which encompass scheduled commercial banks, non-banking financial companies ("NBFCs"), and other regulated institutions. This shift in regulation moves beyond conventional perimeter-based cybersecurity models, emphasizing a Zero Trust Architecture ("ZTA") supported by ongoing monitoring, identity-focused controls, and resilience-driven practices.

In this article we have outlined the regulatory framework that supports RBI's cyber resilience strategy, the legal and operational ramifications of Zero Trust for financial institutions, and essential compliance factors in light of the evolving supervisory environment.