RBI Cybersecurity Framework for Banks

Chapter III H to J: IT projects, architecture and IT service management – RBI Cybersecurity Framework for Banks

RBI Cybersecurity Framework for Banks 33: Para 33: IT architecture designed for security, reviewed annually by the ITSC

The IT architecture is designed so that security measures are always in place, reviewed by the ITSC at least annually and upgraded in phases as risk assessment requires; risk-cost trade-off decisions are documented for supervisory assessment.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter III H to J: IT projects, architecture and IT service management – RBI Cybersecurity Framework for Banks

29 Para 29: defined project management approach for IT projects
30 Para 30: enterprise architecture methodology for new technology or stack revamp
31 Para 31: new technology adoption within risk appetite and aligned to strategy
32 Para 32: product approval and quality assurance for new IT applications
34 Para 34: IT service management framework for operational resilience including DR sites
35 Para 35: service level management with segregation of duties
36 Para 36: security classification of information assets by criticality
37 Para 37: avoid outdated and unsupported hardware and software; track EOS and AMC dates

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All RBI Cybersecurity Framework for Banks controls