Section 29 of the RBI 2023 IT governance direction asks for DR drills on critical systems at least half yearly, with a switch to the alternate site used as primary for long enough to cover at least a full working day. It adds tested backups, defined RTO and RPO, and identical patches at both sites.
What section 29 says
- (a) DR drills for critical information systems at least half yearly. Others per risk assessment.
- (b) Major issues seen in a drill must be fixed and tested again before the next cycle.
- (c) DR testing involves switching to the alternate site and using it as primary for sufficiently long, covering at least a full working day, including beginning of day to end of day operations.
- (d) Regular tests of BCP and DR under different scenarios.
- (e) Back up data and periodically restore it to check it works. Protect backup integrity and access.
- (f) DR architecture and procedures meeting the defined RTO and RPO.
- (g) Prioritise a minimal RTO and a near zero RPO for critical systems.
- (h) If RPO is not zero, document how data is reconciled when resuming from the alternate location.
- (i) Configurations and security patches at the data centre and DR must be identical.
- (j) BCP and DR capabilities across critical interconnected systems, including vendors and partners, shown through coordinated resilience testing.
Section 28 adds that the policy should help the entity recover and securely resume critical operations, including security controls, after cyber attacks.
Translating it for engineering
- Write RTO and RPO per critical system and get them approved.
- Treat the backup restore as the test. A backup you have not restored is a guess.
- Keep infrastructure as code for both sites and compare them. Drift between sites is the usual reason DR fails.
- Patch both sites together. Clause (i) makes patch parity explicit.
- Plan a drill that runs production traffic for a full working day, which needs staffing, a communication plan and a rollback.
- Record findings, owners and retest dates after each drill.
- Include your own services in customers' DR tests when they ask. Clause (j) pushes entities to test with vendors.
Interconnected systems
Clause (j) matters for anyone who sells into a bank. A recovery that works inside the bank but breaks at a payment partner or a SaaS vendor has not recovered. Share your own RTO and RPO figures with customers and be ready to join a coordinated test.
Security during recovery
A rushed recovery can open security gaps. Section 28 mentions resuming operations including security controls. Check that logging, access control and secrets management exist at the alternate site before the drill, not after.
Quick check
Is a tabletop exercise enough?
Clause (c) describes an actual switch to the alternate site for at least a full working day. A tabletop may support it but does not replace it.
Who must meet these rules?
Regulated entities under the direction. A vendor serving them will be asked how its service supports their drills.
Sources
Last reviewed: 19 October 2026.
