A business continuity plan only proves its worth during a disruption, which is the worst time to discover it has never been tested. ISO 22301 and RBI and SEBI guidelines expect plans that are owned, rehearsed and understood by the people who will run them.
Our course prepares managers to own and exercise continuity plans. The guide below explains the most common myths that make a BCP document different from a working plan.
Quick answer
No single Indian law requires every company to have a business continuity plan. Banks, larger NBFCs and other RBI regulated entities must keep a Board-approved BCP and DR policy and test it, SEBI regulated entities must plan, drill and train for recovery, and the people named in the plan need to know their roles.
The course
What the law requires
Is there a general business continuity law in India?
No. There is no statute that requires every company to maintain a business continuity plan. The detailed obligations come from sector regulators, mainly the Reserve Bank of India and SEBI, for the entities they regulate. The Disaster Management Act, 2005 governs the national, state and district disaster management system and defines "disaster" in section 2(d), but it does not set business continuity duties for private companies. ISO 22301 is a voluntary international standard for business continuity management systems; RBI's IT Governance Master Direction cites it as an example of best practice.
RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices (2023)
Chapter V of the RBI Master Direction dated 7 November 2023 (in effect from 1 April 2024) covers business continuity and disaster recovery for commercial banks (excluding RRBs), Top, Upper and Middle Layer NBFCs, Credit Information Companies and the All India Financial Institutions. Paragraph 5(a) requires the Board to approve business continuity strategies and policies. Paragraph 28 requires a BCP and DR policy that adopts best practices, is updated on major developments or risk assessments, and enables the entity to recover and securely resume critical operations after cyber attacks or other incidents.
Paragraph 29 sets DR testing duties: DR drills for critical information systems at least half-yearly; DR tests that switch to the DR site and run it as primary for at least a full working day; regular BCP and DR tests under different contingency scenarios; periodic restoration of backups to check they work; DR arrangements that meet the defined RTO and RPO, aiming for minimal RTO and near zero RPO for critical systems; and BCP and DR capability in critical interconnected systems, including those of vendors and partners. Paragraph 21 requires RTO and RPO metrics for all critical information systems.
RBI Guidance Note on Operational Risk Management and Operational Resilience (April 2024)
The RBI Guidance Note of 30 April 2024 applies to commercial banks, co-operative banks, All India Financial Institutions and all NBFCs including housing finance companies. Principle 12 (paragraph 13) says regulated entities should have business continuity plans linked to their operational risk framework, grounded in scenario analysis and business impact analysis, with RTOs and RPOs, communication guidelines, and "testing programmes, training and awareness programmes". It adds that business continuity exercises should support staff awareness, including training customised to specific cases, and that plans should define roles, succession of authority and triggers for invoking the plan. The Guidance Note describes its tools as indicative and principle-based.
SEBI: CSCRF and BCP/DR rules for market infrastructure institutions
SEBI's Cybersecurity and Cyber Resilience Framework of 20 August 2024 requires regulated entities to prepare contingency plans, a continuity of operations plan (COOP), training, exercises and incident response and recovery plans approved by their Board, partners or proprietor (RS.MA). It requires regular business continuity drills, including a ransomware scenario affecting both the primary and DR sites, and declaration of a "Disaster" within 30 minutes when critical systems are disrupted. As issued, it sets an RTO of 2 hours and an RPO of 15 minutes. Contingency plans and the COOP must be reviewed half-yearly by MIIs and Qualified REs and annually by mid-size and small-size REs.
For stock exchanges, clearing corporations and depositories, SEBI's circular of 12 September 2024 modifies the BCP and DR guidelines in the relevant master circulars. It requires a Near Site in addition to the DR site, a near zero RPO (zero data loss for clearing corporations and depositories), and enough trained staff at the DR site, with the same expertise as at the primary data centre, to run live operations without primary site staff.
DPDP Rules 2025: continuity of personal data processing
For every Data Fiduciary, Rule 6(1)(d) of the DPDP Rules 2025 lists, among the minimum security safeguards, reasonable measures for continued processing if personal data is compromised, such as data backups. This rule applies from 13 May 2027.
Who must be trained and how often
None of these sources sets a fixed frequency for business continuity training. They do set testing frequencies (for example, half-yearly DR drills for critical systems under RBI paragraph 29(a)) and expect the people who run the plan to be trained. The RBI Guidance Note links training and awareness programmes to the BCP itself, and SEBI requires trained staff at MII DR sites.
Common practice, not law, is to train plan owners, crisis team members and department heads when they take on the role and before each major exercise, and to give all staff a short annual briefing on how they will be contacted and what to do in a disruption.
| Audience | What they need | Common practice |
|---|---|---|
| Board and senior management | Approving BCP/DR policy, impact tolerances, reading test results | Annual briefing |
| BCP owners, crisis and incident teams, IT/DR staff | BIA, RTO/RPO, invoking the plan, running and learning from drills | On appointment and before each drill |
| Department heads and managers | Their unit's critical processes, workarounds, communication tree | On appointment and annually |
| All staff | Alerts, reporting lines, remote working arrangements | Short annual briefing |
Penalties and consequences
Business continuity rules do not carry a separate penalty schedule. The table below summarises what each regulator expects and of whom. Non-compliance with RBI directions and SEBI circulars can lead to supervisory or enforcement action under those regulators' own powers.
| Regulator and source | Who it applies to | What it expects |
|---|---|---|
| RBI IT Governance Master Direction 2023, paras 5, 21, 28, 29 | Commercial banks (excl. RRBs), Top/Upper/Middle Layer NBFCs, CICs, AIFIs | Board-approved BCP/DR policy; RTO/RPO for critical systems; DR drills at least half-yearly; backup restore tests; vendor BCP/DR |
| RBI Guidance Note on Operational Risk and Resilience 2024, Principle 12 | Commercial and co-operative banks, AIFIs, all NBFCs incl. HFCs | Scenario-based BCP with BIA, RTO/RPO, training and awareness, defined triggers and succession of authority |
| SEBI CSCRF 2024 | SEBI regulated entities (by category) | Board-approved contingency plan and COOP; business continuity drills; disaster declaration within 30 minutes; periodic review |
| SEBI circular 12 September 2024 | Stock exchanges, clearing corporations, depositories | Near Site plus DR site; near zero or zero RPO; trained staff able to run live operations from DR site |
| DPDP Rules 2025, Rule 6(1)(d) | All Data Fiduciaries (from 13 May 2027) | Reasonable measures, such as backups, for continued processing of personal data |
What good Business Continuity training covers
- Why a BCP is a tested capability, not a document: the RBI and SEBI drill requirements
- Business impact analysis: identifying critical operations and their dependencies, including vendors
- Setting and using RTO, RPO and impact tolerances
- Clear triggers for invoking the plan and who has authority to declare a disaster
- Roles, succession of authority and what happens when key people are unavailable
- Crisis communication to staff, customers, regulators and suppliers
- Running drills and exercises under severe but plausible scenarios, including ransomware and pandemic
- Backups that are tested, protected and, for ransomware, isolated
- Recording lessons learned and updating the plan after every test or real incident
- Board and senior management reporting on test results and gaps
Our courses for this topic
| Course | Audience | Duration | Language | Format |
|---|---|---|---|---|
| Business Continuity Planning | Management | 40 min | English | SCORM eLearning |
Laws & standards covered
- ISO 22301 – Business Continuity Management
- RBI BCP Guidelines
- SEBI Operational Risk Guidelines
- DPDP Act – Data Breach Response
Who it's for
- Business continuity managers
- IT and operations managers
- Senior management
- Department heads
Guides & insights
Frequently asked questions
Is a business continuity plan legally required for an unregulated Indian company?
There is no general statutory requirement. The specific obligations apply to entities regulated by RBI and SEBI. From 13 May 2027, every Data Fiduciary must also have reasonable measures, such as backups, for continued processing of personal data under Rule 6(1)(d) of the DPDP Rules.
How often must banks and NBFCs test disaster recovery?
Under paragraph 29(a) of the RBI IT Governance Master Direction, DR drills for critical information systems must be at least half-yearly; for other systems, frequency follows the entity's risk assessment.
Is ISO 22301 certification mandatory?
No. ISO 22301 is a voluntary standard. RBI's Master Direction refers to it as an example of best practice for a BCP and DR policy, but does not require certification.
Does RBI expect business continuity training, or only testing?
Both. RBI's 2024 Guidance Note says business continuity plans should incorporate training and awareness programmes and that exercises should support staff awareness, including training customised to specific cases.
Who in our organisation should take this course?
The [Business Continuity Planning course](/courses/business-continuity-planning) is aimed at plan owners, IT and operations managers, department heads and senior managers who will run or approve the plan.
How does business continuity relate to operational risk?
RBI treats business continuity as part of operational resilience and requires BCPs to be linked to the operational risk management framework. See our [operational risk training guide](/training/operational-risk).
Which Business Continuity Training courses does Compliance at Workplace offer?
Business Continuity Planning (40 min, for Management).
Which laws and standards does Business Continuity Training cover?
ISO 22301 – Business Continuity Management; RBI BCP Guidelines; SEBI Operational Risk Guidelines; DPDP Act – Data Breach Response.
Who should take Business Continuity Training?
Business continuity managers, IT and operations managers, Senior management, Department heads.
Can the Business Continuity Training be customised to our organisation?
Yes. Every course can be customised to your policies, branding and industry scenarios, and delivered on your LMS as SCORM or on our Compliance Central platform.
Sources
- RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 7 November 2023
- RBI Guidance Note on Operational Risk Management and Operational Resilience, 30 April 2024
- SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), 20 August 2024
- SEBI circular on BCP and DR of Market Infrastructure Institutions, 12 September 2024
- Digital Personal Data Protection Rules, 2025 (MeitY)
Last updated by the Compliance at Workplace Editorial Team.