RBI Cybersecurity Framework for Banks

Chapter III H to J: IT projects, architecture and IT service management – RBI Cybersecurity Framework for Banks

RBI Cybersecurity Framework for Banks 36: Para 36: security classification of information assets by criticality

The bank identifies and maps the confidentiality, integrity and availability classification of information assets according to their criticality to operations.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter III H to J: IT projects, architecture and IT service management – RBI Cybersecurity Framework for Banks

29 Para 29: defined project management approach for IT projects
30 Para 30: enterprise architecture methodology for new technology or stack revamp
31 Para 31: new technology adoption within risk appetite and aligned to strategy
32 Para 32: product approval and quality assurance for new IT applications
33 Para 33: IT architecture designed for security, reviewed annually by the ITSC
34 Para 34: IT service management framework for operational resilience including DR sites
35 Para 35: service level management with segregation of duties
37 Para 37: avoid outdated and unsupported hardware and software; track EOS and AMC dates

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All RBI Cybersecurity Framework for Banks controls