RBI Cybersecurity Framework for Banks 156: Para 156: control over audit methodology and auditor competence when engaging VA/PT auditors

The bank controls audit methodology, processes and auditor competence so audit objectives are met, and on selecting, appointing or renewing a VA/PT auditor considers qualifications, expertise of firm and staff, credentials and competency.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter V R to X: cryptography, straight through processing, surveillance, threat defence, anti-phishing and VA/PT – RBI Cybersecurity Framework for Banks

140 Para 140: strong, non-deprecated cryptography compliant with law
141 Para 141: no manual intervention in data between processes for critical applications
142 Para 142: tested, automated, authenticated STP interfaces with audit trails
143 Para 143: set up a CSOC for continuous surveillance
144 Para 144: multi-point defence against malicious code
145 Para 145: anti-malware with behavioural detection everywhere, centrally managed
146 Para 146: whitelist internet websites and systems
147 Para 147: consider secure web gateways with HTTPS deep inspection

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All RBI Cybersecurity Framework for Banks controls