RBI Cybersecurity Framework for Banks 158: Para 158...

What does 158 require?

The bank reviews VA/PT auditor performance on an ongoing basis and acts on deficiencies; a later compromise through vulnerabilities not reported in time counts as a deficiency and weighs on renewal.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter V R to X: cryptography, straight through processing, surveillance, threat defence, anti-phishing and VA/PT – RBI Cybersecurity Framework for Banks

140 Para 140: strong, non-deprecated cryptography compliant with law
141 Para 141: no manual intervention in data between processes for critical applications
142 Para 142: tested, automated, authenticated STP interfaces with audit trails
143 Para 143: set up a CSOC for continuous surveillance
144 Para 144: multi-point defence against malicious code
145 Para 145: anti-malware with behavioural detection everywhere, centrally managed
146 Para 146: whitelist internet websites and systems
147 Para 147: consider secure web gateways with HTTPS deep inspection

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All RBI Cybersecurity Framework for Banks controls