RBI Cybersecurity Framework for Banks

Chapter V I: application security life cycle – RBI Cybersecurity Framework for Banks

RBI Cybersecurity Framework for Banks 90: Para 90: source code or escrow for critical applications

What does 90 require?

The bank obtains the source code of all critical applications from vendors, or else a source code escrow or other arrangement mitigating vendor default, with all updates and fixes included in escrow.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter V I: application security life cycle – RBI Cybersecurity Framework for Banks

79 Para 79: security across all stages of the application life cycle
80 Para 80: secure coding for internal and collaborative development
81 Para 81: security requirements specified from the start
82 Para 82: segregated development, test and production environments
83 Para 83: threat modelling, secure coding, standards-aligned testing and secure deployment
84 Para 84: address vulnerabilities per OWASP and defence in depth
85 Para 85: application security assessments beyond the OWASP top 10
86 Para 86: periodic application security testing across the lifecycle in production-like environments

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All RBI Cybersecurity Framework for Banks controls