RBI Cybersecurity Framework for Banks

Chapter V L to P: access control, teleworking, customer authentication, mail and removable media – RBI Cybersecurity Framework for Banks

RBI Cybersecurity Framework for Banks 108: Para 108: no local admin rights on end-user devices except time-bound need

Administrative rights on end-user workstations, PCs and laptops are disallowed; access rights are given on need-to-know and for a specific duration through an established process.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter V L to P: access control, teleworking, customer authentication, mail and removable media – RBI Cybersecurity Framework for Banks

104 Para 104: access only for a valid business need
105 Para 105: supervise, log and review elevated access
106 Para 106: secure access with data at rest and in transit protected
107 Para 107: protect credentials, tokens and access profiles against leakage and attack
109 Para 109: centralised authentication and authorisation with strong passwords, least privilege and SoD
110 Para 110: risk-based two-factor or multi-factor authentication; mandatory MFA for privileged users of critical systems and activities
111 Para 111: centralised management, logging and monitoring of privileged access to critical systems
112 Para 112: limit invalid logons and deactivate dormant accounts

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All RBI Cybersecurity Framework for Banks controls