RBI Cybersecurity Framework for Banks

India (Reserve Bank of India)

vRBI (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (31 July 2026), repealing the Cyber Security Framework in Banks circular of 2 June 2016 and the IT Governance Master Direction of 7 November 2023

16 domains

216 controls

The Reserve Bank of India's 2026 Directions on cybersecurity, technology risk, resilience and assurance for commercial banks, which replaced the 2016 Cyber Security Framework in Banks and the 2023 IT governance Master Direction: Board and committee governance (IT Strategy Committee, Information Security Committee, an independent CISO reporting to risk), IT and cyber risk management, some 160 baseline controls from asset inventory to DMARC, VA/PT and half-yearly full-day DR switchovers, third-party and ATM switch provider controls, incident reporting on DAKSH within six hours, a Cyber Security Operations Centre and IS audit.

Verified

RBI Cybersecurity Framework for Banks is a compliance framework from India (Reserve Bank of India) with 16 domains and 216 controls. The largest domains are Chapter V L to P: access control, teleworking, customer authentication, mail and removable media – RBI Cybersecurity Framework for Banks (22 controls), Chapter V R to X: cryptography, straight through processing, surveillance, threat defence, anti-phishing and VA/PT – RBI Cybersecurity Framework for Banks (22 controls), Chapter V A to G: assets, data leakage, migration, software, physical, capacity and configuration – RBI Cybersecurity Framework for Banks (21 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (16)

Chapter III C to G: IT Strategy Committee, senior management, committees, Head of IT and CISO – RBI Cybersecurity Framework for Banks

13 controls

Controls in the Chapter III C to G: IT Strategy Committee, senior management, committees, Head of IT and CISO – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 13 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::16	Para 16: Board-level IT Strategy Committee	The bank establishes a Board-level IT Strategy Committee (ITSC), whose composition and functions follow paragraphs 16 to...
rbi-cybersecurity-framework-for-banks::17	Para 17: ITSC composition: three directors, independent IT-expert chair, competent members	The ITSC has at least three directors including its chairperson; the chairperson is an independent director with substan...
rbi-cybersecurity-framework-for-banks::18	Para 18: ITSC meets at least quarterly	The ITSC meets at least once every quarter.
rbi-cybersecurity-framework-for-banks::19	Para 19: ITSC functions: planning, strategy, governance, risk, budget, escalation, BCP/DR, capacity, access standards	The ITSC ensures an effective IT strategic planning process; guides the IT strategy and its alignment to the bank's stra...
rbi-cybersecurity-framework-for-banks::20	Para 20: senior management duties for IT and cyber	Senior management ensures execution of the Board-approved IT strategy, effective functioning of IT, information security...
rbi-cybersecurity-framework-for-banks::21	Para 21: IT Steering Committee meeting at least quarterly	The bank establishes an IT Steering Committee with senior management representation from IT and business functions, meet...
rbi-cybersecurity-framework-for-banks::22	Para 22: IT Steering Committee responsibilities	The IT Steering Committee assists the ITSC with strategic IT planning, oversight of IT performance and alignment with bu...
rbi-cybersecurity-framework-for-banks::23	Para 23: Information Security Committee under ITSC oversight, headed from risk management	An Information Security Committee, overseen by the ITSC and composed as the ITSC decides with the CISO and business, IT...
rbi-cybersecurity-framework-for-banks::24	Para 24: appoint a senior, competent Head of IT Function	The bank appoints a sufficiently senior, technically competent and experienced official as Head of IT Function (CTO, CIO...
rbi-cybersecurity-framework-for-banks::25	Para 25: Head of IT responsibilities: alignment, organisation, DR and BCP	The Head of IT Function ensures IT projects follow the IT policy and strategy, an effective organisational structure sup...
rbi-cybersecurity-framework-for-banks::26	Para 26: Head of IT as first line of defence over IT controls and risk	As first line of defence the Head of IT Function ensures effective assessment, evaluation and management of IT controls...
rbi-cybersecurity-framework-for-banks::27	Para 27: senior, independent CISO with expertise, tenure, staff and budget	A senior executive, preferably General Manager or equivalent, is designated CISO; the CISO has no direct reporting line...
rbi-cybersecurity-framework-for-banks::28	Para 28: documented CISO role: strategy, enforcement, committee invitee, SOC, reporting to risk ED, quarterly review	The CISO's documented role covers at least driving cyber strategy and regulatory compliance, enforcing the protective po...

Chapter III H to J: IT projects, architecture and IT service management – RBI Cybersecurity Framework for Banks

10 controls

Controls in the Chapter III H to J: IT projects, architecture and IT service management – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 10 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::29	Para 29: defined project management approach for IT projects	The bank follows a consistent, formally defined project management approach for IT projects that allows stakeholder part...
rbi-cybersecurity-framework-for-banks::30	Para 30: enterprise architecture methodology for new technology or stack revamp	When adopting new or emerging technologies or tools or revamping the technology stack the bank applies a standard enterp...
rbi-cybersecurity-framework-for-banks::31	Para 31: new technology adoption within risk appetite and aligned to strategy	Adoption of new or emerging technologies must be commensurate with the bank's risk appetite, aligned with the business a...
rbi-cybersecurity-framework-for-banks::32	Para 32: product approval and quality assurance for new IT applications	Any new IT application introduced as a business product, whether offered to customers, third parties or employees, goes...
rbi-cybersecurity-framework-for-banks::33	Para 33: IT architecture designed for security, reviewed annually by the ITSC	The IT architecture is designed so that security measures are always in place, reviewed by the ITSC at least annually an...
rbi-cybersecurity-framework-for-banks::34	Para 34: IT service management framework for operational resilience including DR sites	The bank puts in place a robust IT service management framework supporting its information systems and infrastructure to...
rbi-cybersecurity-framework-for-banks::35	Para 35: service level management with segregation of duties	The bank runs a service level management process to manage IT operations while ensuring effective segregation of duties.
rbi-cybersecurity-framework-for-banks::36	Para 36: security classification of information assets by criticality	The bank identifies and maps the confidentiality, integrity and availability classification of information assets accord...
rbi-cybersecurity-framework-for-banks::37	Para 37: avoid outdated and unsupported hardware and software; track EOS and AMC dates	For continuity of operations the bank avoids outdated and unsupported hardware and software and monitors software end-of...
rbi-cybersecurity-framework-for-banks::38	Para 38: technology refresh plan before end of support	The bank develops a technology refresh plan to replace hardware and software in good time before they reach end of suppo...

Chapter IV: IT and information security risk management – RBI Cybersecurity Framework for Banks

8 controls

Controls in the Chapter IV: IT and information security risk management – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 8 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::39	Para 39: risk policy covers IT and cyber risk, reviewed annually by RMCB with ITSC	The risk management policy includes IT and cybersecurity risks and is reviewed and updated at least annually by the Risk...
rbi-cybersecurity-framework-for-banks::40	Para 40: IT and information security risk management framework	The bank establishes a robust IT and information security risk management framework (it may keep a separate cyber risk f...
rbi-cybersecurity-framework-for-banks::41	Para 41: asset risk assessment guided by security standards or control frameworks	The risk assessment of each in-scope information asset is guided by appropriate security standards or IT control framewo...
rbi-cybersecurity-framework-for-banks::42	Para 42: staff and service providers comply with security and acceptable-use policies	All staff and service providers comply with the information security and acceptable-use policies that apply to them.
rbi-cybersecurity-framework-for-banks::43	Para 43: annual review of security infrastructure and policies; tackle phishing and spoofing	The bank reviews its security infrastructure and policies at least annually in light of its experience and emerging thre...
rbi-cybersecurity-framework-for-banks::44	Para 44: inherent risk factors reckoned	In identifying and assessing inherent risk the bank reckons the technologies adopted, alignment with business and regula...
rbi-cybersecurity-framework-for-banks::45	Para 45: riskiness categorised low to very high including business component riskiness	Depending on inherent risk the bank categorises its riskiness as low, moderate, high or very high (or a similar scale),...
rbi-cybersecurity-framework-for-banks::46	Para 46: control evaluation factors including threat intelligence and information sharing	In evaluating controls the bank factors in Board oversight, policies, processes, cyber risk architecture, experienced an...

Chapter V A to G: assets, data leakage, migration, software, physical, capacity and configuration – RBI Cybersecurity Framework for Banks

21 controls

Controls in the Chapter V A to G: assets, data leakage, migration, software, physical, capacity and configuration – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 21 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::47	Para 47: up-to-date inventory of information assets with business criticality	The bank keeps an up-to-date inventory of information assets, including business and customer data, applications, suppor...
rbi-cybersecurity-framework-for-banks::48	Para 48: classify data by sensitivity	The bank classifies data and information according to its classification or sensitivity criteria.
rbi-cybersecurity-framework-for-banks::49	Para 49: enterprise data dictionary	The bank maintains an enterprise data dictionary to enable data sharing among applications and systems and a common unde...
rbi-cybersecurity-framework-for-banks::50	Para 50: protect data inside and outside the network according to sensitivity	The bank manages and protects data within and beyond its network boundaries according to how it is stored, transmitted,...
rbi-cybersecurity-framework-for-banks::51	Para 51: comprehensive data loss or leakage prevention strategy	The bank develops a comprehensive data loss or leakage prevention strategy protecting sensitive business and customer da...
rbi-cybersecurity-framework-for-banks::52	Para 52: similar data leakage arrangements at vendor-managed facilities	Equivalent data leakage prevention arrangements are ensured at vendor-managed facilities.
rbi-cybersecurity-framework-for-banks::53	Para 53: protect customers' data across its lifecycle including with vendors	As owner of customers' personal and sensitive data the bank preserves its confidentiality, integrity and availability wh...
rbi-cybersecurity-framework-for-banks::54	Para 54: remote manage, wipe and lock mobile devices and laptops	The bank implements controls to remotely manage, wipe and lock mobile devices including laptops.
rbi-cybersecurity-framework-for-banks::55	Para 55: data migration policy with integrity checks, audit trails and sign-offs	The bank has a data migration policy setting a systematic process that ensures integrity, completeness and consistency,...
rbi-cybersecurity-framework-for-banks::56	Para 56: inventory of authorised and unauthorised software; optional whitelisting	The bank maintains an up-to-date, centralised inventory of authorised and unauthorised software and may whitelist author...
rbi-cybersecurity-framework-for-banks::57	Para 57: control software installation and block unauthorised software	The bank controls installation of software on all information systems, from PCs and laptops to servers, mobile devices a...
rbi-cybersecurity-framework-for-banks::58	Para 58: monitor patches and advisories; expedite patches for actively exploited flaws	The bank continuously monitors vendor and OEM patch releases and CERT-In and similar advisories and applies security pat...
rbi-cybersecurity-framework-for-banks::59	Para 59: exception policy with justification, duration, approval and senior review	The bank has a policy for exceptions specifying justification, duration, grant process, approving authority and periodic...
rbi-cybersecurity-framework-for-banks::60	Para 60: physical and environmental controls for DC and DR sites	The bank puts in place physical and environmental controls securing the locations of critical assets, including the data...
rbi-cybersecurity-framework-for-banks::61	Para 61: monitoring of environmental control breaches and access logs	The bank monitors breaches of environmental controls, including temperature, water, smoke, access alarms, power, telecom...
rbi-cybersecurity-framework-for-banks::62	Para 62: geographically separated DC and DR	The data centre and DR sites are geographically well separated so that one threat does not affect both.
rbi-cybersecurity-framework-for-banks::63	Para 63: e-surveillance at DC and DR	DC and DR sites are subjected to the necessary e-surveillance mechanisms.
rbi-cybersecurity-framework-for-banks::64	Para 64: systems and infrastructure support business functions and all channels	The bank ensures its information systems and infrastructure support business functions and keep every service delivery c...
rbi-cybersecurity-framework-for-banks::65	Para 65: annual proactive IT capacity assessment and planning	At least annually the bank proactively assesses IT resource capacity needs, planning across components, services, system...
rbi-cybersecurity-framework-for-banks::66	Para 66: documented security baselines for all device categories through the lifecycle	The bank documents and applies baseline security configurations for all categories of devices and systems (endpoints, mo...
rbi-cybersecurity-framework-for-banks::67	Para 67: periodic review of critical devices' configurations and patch levels everywhere	The bank periodically evaluates critical devices such as firewalls, switches and security devices, their configurations...

Chapter V AA to EE: metrics, awareness, customer education, transaction monitoring and forensics – RBI Cybersecurity Framework for Banks

18 controls

Controls in the Chapter V AA to EE: metrics, awareness, customer education, transaction monitoring and forensics – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 18 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::194	Para 194: comprehensive cyber metrics with KPIs and KRIs	The bank develops comprehensive prospective and retrospective metrics such as key performance and key risk indicators, f...
rbi-cybersecurity-framework-for-banks::195	Para 195: performance, recovery and resumption metrics including RPO and RTO	The bank defines system performance, recovery and business resumption metrics, including RPO and RTO, for all critical i...
rbi-cybersecurity-framework-for-banks::196	Para 196: scorecard for IT performance and maturity	The bank uses a scorecard, metrics or methodology to measure IT performance and IT maturity.
rbi-cybersecurity-framework-for-banks::197	Para 197: indicators for adequacy of and adherence to the cyber framework	The adequacy of and adherence to the cybersecurity framework are assessed through indicators of risk and preparedness, w...
rbi-cybersecurity-framework-for-banks::198	Para 198: promote cyber resilience objectives to providers and partners and require aligned action	The bank promotes awareness of its cyber resilience objectives among service providers, partners and other stakeholders...
rbi-cybersecurity-framework-for-banks::199	Para 199: communicate security policies and acceptable use to users, vendors and partners	The bank defines and communicates its security policies to users, employees, vendors and partners, covering secure and a...
rbi-cybersecurity-framework-for-banks::200	Para 200: targeted training for key executive, operational and security administration roles	The bank provides targeted awareness and training for key personnel in executive, operational and security administratio...
rbi-cybersecurity-framework-for-banks::201	Para 201: encourage reporting of suspicious behaviour	The bank encourages reporting of suspicious behaviour to the incident management team.
rbi-cybersecurity-framework-for-banks::202	Para 202: periodic evaluation of employee awareness	The bank evaluates employees' awareness periodically.
rbi-cybersecurity-framework-for-banks::203	Para 203: continuous capacity building; mandatory for new recruits; annual for lower and middle management	The bank establishes continuous and adaptive capacity building in cybersecurity management; awareness programmes are man...
rbi-cybersecurity-framework-for-banks::204	Para 204: Board and senior management sensitised; annual IT and cyber training for all Board members and senior management	The bank keeps the Board and senior management aware of evolving cyber threats by periodic sensitisation and provides an...
rbi-cybersecurity-framework-for-banks::205	Para 205: improve and maintain customer cyber awareness	The bank improves and maintains customer awareness and education on cybersecurity risks.
rbi-cybersecurity-framework-for-banks::206	Para 206: encourage customers to report phishing and act on reports	The bank encourages customers to report phishing emails and sites and takes effective remedial action on reports.
rbi-cybersecurity-framework-for-banks::207	Para 207: educate customers not to share credentials, OTPs and PINs	The bank educates customers about the risks of sharing login credentials, passwords, OTPs, PINs and other authentication...
rbi-cybersecurity-framework-for-banks::208	Para 208: promote cyber resilience objectives among customers	The bank proactively promotes awareness of its cyber resilience objectives among customers.
rbi-cybersecurity-framework-for-banks::209	Para 209: risk-based transaction monitoring across all channels	The bank implements risk-based transaction monitoring or surveillance as part of fraud risk management across all delive...
rbi-cybersecurity-framework-for-banks::210	Para 210: alternate-channel alerts for payments above a customer-set value	The bank notifies customers through alternate channels of every payment or fund transfer above a value the customer sets...
rbi-cybersecurity-framework-for-banks::211	Para 211: network forensics, investigation and DDoS mitigation on standby	The bank has network forensics, forensic investigation and DDoS mitigation support arranged on standby.

Chapter V H: network management and security – RBI Cybersecurity Framework for Banks

11 controls

Controls in the Chapter V H: network management and security – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 11 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::68	Para 68: only authorised, time-limited, audited network access; responsibility with bank officials	Only authorised access to networks is permitted, through a defined process with strict time limits that is consistently...
rbi-cybersecurity-framework-for-banks::69	Para 69: up-to-date organisation-wide network architecture diagram	The bank maintains an up-to-date organisation-level network architecture diagram covering wired and wireless networks.
rbi-cybersecurity-framework-for-banks::70	Para 70: centralised inventory of authorised network devices	The bank keeps an up-to-date centralised inventory of authorised devices connected to its network inside and outside its...
rbi-cybersecurity-framework-for-banks::71	Para 71: network devices configured appropriately and assessed periodically	All network devices are configured appropriately and their configurations periodically assessed against the desired secu...
rbi-cybersecurity-framework-for-banks::72	Para 72: secure wireless networks and access points	The bank puts in place controls securing wireless LANs, access points and wireless client access systems.
rbi-cybersecurity-framework-for-banks::73	Para 73: connect only authorised devices meeting security requirements	The bank identifies authorised hardware and mobile devices on the network and gives them connectivity only when they mee...
rbi-cybersecurity-framework-for-banks::74	Para 74: automatically detect and block unauthorised device connections	The bank has mechanisms to identify unauthorised device connections automatically and block them.
rbi-cybersecurity-framework-for-banks::75	Para 75: detect and remedy unusual activity on systems, servers, network devices and endpoints	The bank has mechanisms to detect and remedy unusual activity in systems, servers, network devices and endpoints.
rbi-cybersecurity-framework-for-banks::76	Para 76: SOPs for all major IT activities	The bank establishes standard operating procedures for all major IT activities including connecting devices to the netwo...
rbi-cybersecurity-framework-for-banks::77	Para 77: multi-layer boundary defences with real-time traffic filtering	Boundary defences are multi-layered with properly configured firewalls, proxies, DMZ perimeter networks and network intr...
rbi-cybersecurity-framework-for-banks::78	Para 78: public-facing IT infrastructure handles IPv6	The bank enables its public-facing IT infrastructure to handle IPv6 traffic.

Chapter V I: application security life cycle – RBI Cybersecurity Framework for Banks

13 controls

Controls in the Chapter V I: application security life cycle – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 13 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::79	Para 79: security across all stages of the application life cycle	The bank builds information security into every stage of the application life cycle.
rbi-cybersecurity-framework-for-banks::80	Para 80: secure coding for internal and collaborative development	The bank implements secure coding practices for internally and collaboratively developed applications.
rbi-cybersecurity-framework-for-banks::81	Para 81: security requirements specified from the start	Besides business functions the bank specifies security requirements for access control, authentication, transaction auth...
rbi-cybersecurity-framework-for-banks::82	Para 82: segregated development, test and production environments	The bank properly segregates development, test and production environments.
rbi-cybersecurity-framework-for-banks::83	Para 83: threat modelling, secure coding, standards-aligned testing and secure deployment	The development process is guided by threat modelling, follows secure coding, includes security testing aligned with glo...
rbi-cybersecurity-framework-for-banks::84	Para 84: address vulnerabilities per OWASP and defence in depth	Development practices proactively address vulnerabilities based on best practice and baselines such as OWASP and apply d...
rbi-cybersecurity-framework-for-banks::85	Para 85: application security assessments beyond the OWASP top 10	Application security assessments must be comprehensive, not confined to the OWASP top 10, drawing on other recognised st...
rbi-cybersecurity-framework-for-banks::86	Para 86: periodic application security testing across the lifecycle in production-like environments	Web and mobile applications are security-tested periodically before and after implementation and after changes, in an en...
rbi-cybersecurity-framework-for-banks::87	Para 87: containerised business apps on mobile devices with remote wipe	The bank uses measures such as encrypted, separated containerised apps for business use on mobile devices, as applicable...
rbi-cybersecurity-framework-for-banks::88	Para 88: new technologies evaluated before use on critical systems	The bank evaluates new technologies against current and evolving threats and introduces them to critical systems only af...
rbi-cybersecurity-framework-for-banks::89	Para 89: vendor maintenance and support enforced by agreement	Software vendors provide maintenance and support for applications, enforced through formal agreements.
rbi-cybersecurity-framework-for-banks::90	Para 90: source code or escrow for critical applications	The bank obtains the source code of all critical applications from vendors, or else a source code escrow or other arrang...
rbi-cybersecurity-framework-for-banks::92	Para 92: vendor certificate that code is free of known vulnerabilities, malware and covert channels	The bank obtains a certificate or written confirmation from the developer or vendor that the application is free of know...

Chapter V J and K: audit logs, patch, vulnerability and change management – RBI Cybersecurity Framework for Banks

11 controls

Controls in the Chapter V J and K: audit logs, patch, vulnerability and change management – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 11 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::100	Para 100: track patch status for internet-connected endpoints and servers, databases, middleware	The bank has systems and processes to identify, track, manage and monitor patch status for operating systems and applica...
rbi-cybersecurity-framework-for-banks::101	Para 101: configuration management and baselines for change integrity	Changes to applications, technology, service components and facilities go through robust configuration management and co...
rbi-cybersecurity-framework-for-banks::102	Para 102: root cause of detected incidents and patching to close them	As part of threat mitigation the bank determines the root cause of every detected incident and applies the patches neede...
rbi-cybersecurity-framework-for-banks::103	Para 103: periodic evaluation of access devices at VLAN, LAN/WAN, external and partner interconnections	The bank periodically evaluates configurations and patch levels of access devices at every access point and node between...
rbi-cybersecurity-framework-for-banks::93	Para 93: audit logging for systems touching critical or sensitive information	Every application or system that can access or affect critical or sensitive information has audit logging and provides a...
rbi-cybersecurity-framework-for-banks::94	Para 94: log settings capture identifying fields and are validated periodically	The bank implements and periodically validates log settings for every device, system and application so that logs carry...
rbi-cybersecurity-framework-for-banks::95	Para 95: audit trails detailed enough for audit, forensics and non-repudiation	Audit trails meet business, regulatory and legal needs and are detailed enough to support audits, serve as digital foren...
rbi-cybersecurity-framework-for-banks::96	Para 96: regular monitoring of audit trails and logs	The bank regularly monitors audit trails and system logs to detect, understand or recover from unauthorised activity or...
rbi-cybersecurity-framework-for-banks::97	Para 97: stakeholders consulted on log scope, frequency and storage	The bank consults all stakeholders before finalising the scope, frequency and storage of log collection.
rbi-cybersecurity-framework-for-banks::98	Para 98: change and patch policy: impact assessment, timely approved changes, justification, rollback	Documented change and patch policies and procedures ensure that the business impact of applying or not applying a patch...
rbi-cybersecurity-framework-for-banks::99	Para 99: risk-based patching strategy with an inventory of patchable components	The bank adopts a documented risk-based strategy to inventory IT components needing patches, identify all applicable pat...

Chapter V L to P: access control, teleworking, customer authentication, mail and removable media – RBI Cybersecurity Framework for Banks

22 controls

Controls in the Chapter V L to P: access control, teleworking, customer authentication, mail and removable media – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 22 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::104	Para 104: access only for a valid business need	Access to information assets is allowed only where there is a valid business need.
rbi-cybersecurity-framework-for-banks::105	Para 105: supervise, log and review elevated access	Personnel with elevated access are closely supervised, with all their system activity logged and periodically reviewed.
rbi-cybersecurity-framework-for-banks::106	Para 106: secure access with data at rest and in transit protected	The bank provides secure access to its assets and services from inside and outside its network, protecting data at rest...
rbi-cybersecurity-framework-for-banks::107	Para 107: protect credentials, tokens and access profiles against leakage and attack	The bank protects user access credentials such as user IDs, authentication information, tokens and access profiles again...
rbi-cybersecurity-framework-for-banks::108	Para 108: no local admin rights on end-user devices except time-bound need	Administrative rights on end-user workstations, PCs and laptops are disallowed; access rights are given on need-to-know...
rbi-cybersecurity-framework-for-banks::109	Para 109: centralised authentication and authorisation with strong passwords, least privilege and SoD	The bank implements a centralised authentication and authorisation system for accessing and administering applications,...
rbi-cybersecurity-framework-for-banks::110	Para 110: risk-based two-factor or multi-factor authentication; mandatory MFA for privileged users of critical systems and activities	Based on risk assessment the bank implements two-factor or multi-factor authentication, which is mandatory for privilege...
rbi-cybersecurity-framework-for-banks::111	Para 111: centralised management, logging and monitoring of privileged access to critical systems	The bank implements systems and controls, for example centralised, to allow, manage, log and monitor privileged, superus...
rbi-cybersecurity-framework-for-banks::112	Para 112: limit invalid logons and deactivate dormant accounts	The bank limits invalid logon attempts and deactivates dormant accounts.
rbi-cybersecurity-framework-for-banks::113	Para 113: monitor abnormal logon patterns	The bank monitors any abnormal change in logon patterns.
rbi-cybersecurity-framework-for-banks::114	Para 114: teleworking: secure remote access, MFA, remote device identification, data protection	For teleworking the bank ensures systems and remote access from alternate locations are secure, implements MFA for logic...
rbi-cybersecurity-framework-for-banks::115	Para 115: customer authentication framework with mutual verification across channels	The bank implements an authentication framework giving positive identity verification of customers and letting customers...
rbi-cybersecurity-framework-for-banks::116	Para 116: bank as identity provider for customer access to partner systems	The bank acts as identity provider when customers are identified and authenticated for access to partner systems, using...
rbi-cybersecurity-framework-for-banks::117	Para 117: secure mail and messaging: anti-spoofing, look-alike domains, malicious content, spam; partners too	The bank implements secure mail and messaging with measures against spoofing and look-alike domain abuse, malicious atta...
rbi-cybersecurity-framework-for-banks::118	Para 118: email server specific controls documented and implemented	The bank documents and implements controls specific to its email servers.
rbi-cybersecurity-framework-for-banks::119	Para 119: restrict permissible email attachment types	The bank controls which attachment types are permitted in email systems.
rbi-cybersecurity-framework-for-banks::120	Para 120: DMARC for email domains; urge third parties to adopt it	The bank implements DMARC for its email domains and impresses on vendors, partners and other third parties to do the sam...
rbi-cybersecurity-framework-for-banks::121	Para 121: removable media prohibited unless authorised for defined use and duration	By default removable devices and media are not permitted unless specifically authorised for a defined use and duration.
rbi-cybersecurity-framework-for-banks::122	Para 122: removable media and BYOD policy with secure erasure	The bank defines and implements a policy restricting and securing the use of removable media and BYOD across device cate...
rbi-cybersecurity-framework-for-banks::123	Para 123: limit media types and information transferable	The bank limits the media types and information that can be copied to or from such devices.
rbi-cybersecurity-framework-for-banks::124	Para 124: scan removable media before access	Removable media is scanned for malware before read or write access is given.
rbi-cybersecurity-framework-for-banks::125	Para 125: consider centralised removable media policies via directory or endpoint tools	The bank considers centralised policies through Active Directory or endpoint management to whitelist, blacklist or restr...

Chapter V Q: third-party arrangements and ATM switch service providers – RBI Cybersecurity Framework for Banks

14 controls

Controls in the Chapter V Q: third-party arrangements and ATM switch service providers – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 14 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::126	Para 126: vendor risk assessment and proportionate controls	For IT and cyber third-party arrangements outside the Outsourcing Directions (paragraphs 126 to 135), the bank runs a ve...
rbi-cybersecurity-framework-for-banks::127	Para 127: bank accountable for security risk in outsourced and partner arrangements	The bank remains accountable for managing and assuring security risks in outsourced and partner arrangements.
rbi-cybersecurity-framework-for-banks::128	Para 128: evaluate need to outsource critical processes; select on risk assessment	The bank carefully evaluates any need to outsource critical processes and selects vendors or partners on a comprehensive...
rbi-cybersecurity-framework-for-banks::129	Para 129: regular due diligence, oversight and management of vendors and partners	The bank regularly performs due diligence, oversight and management of vendors, service providers and partners.
rbi-cybersecurity-framework-for-banks::130	Para 130: policies to evaluate, approve and monitor vendor risk and materiality	The bank has policies and procedures to evaluate, assess, approve, review, control and monitor the risk and materiality...
rbi-cybersecurity-framework-for-banks::131	Para 131: service providers adhere to Indian legal and regulatory requirements	The bank ensures and can demonstrate that service providers comply with all regulatory and legal requirements of the cou...
rbi-cybersecurity-framework-for-banks::132	Para 132: agreements with audit right for the bank and inspection right for RBI	The bank enters into agreements with service providers giving, among other things, the bank a right to audit and the RBI...
rbi-cybersecurity-framework-for-banks::133	Para 133: RBI access to all information resources consumed by the bank	The bank ensures the RBI has access, online or in person, to all information resources it consumes, even where the infra...
rbi-cybersecurity-framework-for-banks::134	Para 134: legal requirements on infrastructure location and cross-border data movement	The bank adheres to legal and regulatory requirements on the geographic location of infrastructure and cross-border move...
rbi-cybersecurity-framework-for-banks::135	Para 135: vet vendor personnel; background checks, NDAs and security compliance agreements	The bank satisfies itself about the credentials of vendor personnel who access and manage critical assets; background ch...
rbi-cybersecurity-framework-for-banks::136	Para 136: cyber controls enforced on ATM switch application service providers	Where the bank manages its ATM switch ecosystem through a third-party ASP's shared services, it ensures the ASP implemen...
rbi-cybersecurity-framework-for-banks::137	Para 137: ATM switch ASP controls written into contracts and scoped to the IT ecosystem	The paragraph 136 controls are factored into the contract with the switch ASP and apply to the ASP's IT ecosystem (infra...
rbi-cybersecurity-framework-for-banks::138	Para 138: 24 baseline cyber controls mandated in ASP contracts	Contracts with ASPs mandate: changing default passwords; no trivial passwords; centralised IAM with strong passwords, ri...
rbi-cybersecurity-framework-for-banks::139	Para 139: share applicable RBI instructions with ATM switch ASPs	The bank shares RBI regulatory instructions, circulars, advisories and alerts applicable to the ATM switch ecosystem wit...

Chapter V R to X: cryptography, straight through processing, surveillance, threat defence, anti-phishing and VA/PT – RBI Cybersecurity Framework for Banks

22 controls

Controls in the Chapter V R to X: cryptography, straight through processing, surveillance, threat defence, anti-phishing and VA/PT – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 22 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::140	Para 140: strong, non-deprecated cryptography compliant with law	Key lengths, algorithms, cipher suites and protocols used for transmission, processing and authentication are strong; th...
rbi-cybersecurity-framework-for-banks::141	Para 141: no manual intervention in data between processes for critical applications	To prevent unauthorised modification, the bank ensures no manual intervention or modification of data while it passes be...
rbi-cybersecurity-framework-for-banks::142	Para 142: tested, automated, authenticated STP interfaces with audit trails	Data transfers between processes or applications are tested, securely automated with checks and balances, and integrated...
rbi-cybersecurity-framework-for-banks::143	Para 143: set up a CSOC for continuous surveillance	The bank sets up a Cyber Security Operations Centre for continuous surveillance and keeps itself updated on emerging thr...
rbi-cybersecurity-framework-for-banks::144	Para 144: multi-point defence against malicious code	The bank builds robust defences against installation, spread and execution of malicious code at multiple points in its e...
rbi-cybersecurity-framework-for-banks::145	Para 145: anti-malware with behavioural detection everywhere, centrally managed	The bank implements anti-malware and antivirus with behavioural detection on endpoints, servers, web and email gateways,...
rbi-cybersecurity-framework-for-banks::146	Para 146: whitelist internet websites and systems	The bank implements whitelisting of internet websites and systems.
rbi-cybersecurity-framework-for-banks::147	Para 147: consider secure web gateways with HTTPS deep inspection	The bank considers secure web gateways able to deep scan network packets including HTTPS traffic through the internet ga...
rbi-cybersecurity-framework-for-banks::148	Para 148: anti-phishing and anti-rogue app takedown services	The bank subscribes to external anti-phishing and anti-rogue app services to identify and take down phishing websites an...
rbi-cybersecurity-framework-for-banks::149	Para 149: periodic VA and PT for all critical and internet-facing systems	The bank conducts VA and PT periodically for all critical and internet-facing systems.
rbi-cybersecurity-framework-for-banks::150	Para 150: VA/PT of critical internet-facing applications, servers and network across the lifecycle	Critical, internet-facing web and mobile applications, servers and network components are tested periodically through th...
rbi-cybersecurity-framework-for-banks::151	Para 151: VA every six months and PT every 12 months for critical and DMZ customer-facing systems	For critical information systems and DMZ systems with a customer interface, VA is done at least every six months and PT...
rbi-cybersecurity-framework-for-banks::152	Para 152: post-implementation VA/PT on production, or documented ISC-approved deviation	After implementation or upgrade, VA/PT is performed on production; if PT must be done in test, the test environment's ve...
rbi-cybersecurity-framework-for-banks::153	Para 153: fix vulnerabilities on time and keep them fixed	The bank fixes identified vulnerabilities and associated risks within set timelines through corrective measures and sust...
rbi-cybersecurity-framework-for-banks::154	Para 154: documented VA/PT approach including scoring, also for cloud-hosted systems	The bank documents its VA/PT approach covering scope, coverage, a vulnerability scoring mechanism such as CVSS and all o...
rbi-cybersecurity-framework-for-banks::155	Para 155: VA/PT by trained, independent experts	VA/PT is conducted by appropriately trained and independent information security experts or auditors.
rbi-cybersecurity-framework-for-banks::156	Para 156: control over audit methodology and auditor competence when engaging VA/PT auditors	The bank controls audit methodology, processes and auditor competence so audit objectives are met, and on selecting, app...
rbi-cybersecurity-framework-for-banks::157	Para 157: reasonable assurance per area stated in VA/PT reports	The bank reviews VA/PT coverage and scope and ensures the reports explicitly state reasonable assurance for each area, a...
rbi-cybersecurity-framework-for-banks::158	Para 158: ongoing review of VA/PT auditor performance including missed vulnerabilities	The bank reviews VA/PT auditor performance on an ongoing basis and acts on deficiencies; a later compromise through vuln...
rbi-cybersecurity-framework-for-banks::159	Para 159: interact with auditors; follow CERT-In audit policy guidelines for empanelled auditors	The bank interacts continuously with VA/PT auditors during the audit, and for CERT-In empanelled auditors follows CERT-I...
rbi-cybersecurity-framework-for-banks::160	Para 160: close monitoring of VA/PT findings by security, IS audit and senior management	VA/PT findings and follow-up actions are monitored closely by the information security or IS audit team and senior manag...
rbi-cybersecurity-framework-for-banks::161	Para 161: quarterly VA/PT closure status to the ITSC and ISC	The status of closure of VA/PT observations is put to the ITSC and the Information Security Committee at least quarterly...

Chapter V Y: business continuity and disaster recovery – RBI Cybersecurity Framework for Banks

12 controls

Controls in the Chapter V Y: business continuity and disaster recovery – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 12 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::163	Para 163: BCP and DR policy on best practice such as ISO 22301, updated on major developments	The BCP and DR policy adopts best practice such as ISO 22301 to reduce the likelihood and impact of disruptions and main...
rbi-cybersecurity-framework-for-banks::164	Para 164: BCP and DR designed for rapid, secure recovery after cyber-attacks within RTOs	BCP and DR capabilities are designed to meet resilience objectives and enable rapid recovery and secure resumption of cr...
rbi-cybersecurity-framework-for-banks::165	Para 165: DR drills half-yearly for critical systems	DR drills for critical information systems occur at least every six months; other systems follow the bank's risk assessm...
rbi-cybersecurity-framework-for-banks::166	Para 166: major DR drill issues fixed and retested before next cycle	Any major issue seen in a DR drill is resolved and tested again so the drill succeeds before the next cycle.
rbi-cybersecurity-framework-for-banks::167	Para 167: DR testing runs DR as primary for at least a full working day	DR testing switches over to the DR or alternate site and runs it as the primary site long enough to cover at least one f...
rbi-cybersecurity-framework-for-banks::168	Para 168: test BCP and DR under different contingency scenarios	The bank regularly tests the BCP and DR under different scenarios to keep them current and effective.
rbi-cybersecurity-framework-for-banks::169	Para 169: backups taken, restore-tested, integrity preserved and secured	The bank backs up data, periodically restores it to confirm usability, preserves backup integrity and secures it against...
rbi-cybersecurity-framework-for-banks::170	Para 170: DR architecture and procedures meet defined RTO and RPO	The DR architecture and procedures are robust enough to meet the defined RTO and RPO for any recovery.
rbi-cybersecurity-framework-for-banks::171	Para 171: minimal ITSC-approved RTO and near zero RPO for critical systems	For critical information systems the bank prioritises a minimal RTO approved by its ITSC and a near-zero RPO.
rbi-cybersecurity-framework-for-banks::172	Para 172: documented reconciliation where RPO is not zero	Where RPO is not zero the bank has a documented methodology to reconcile data when resuming from the alternate location.
rbi-cybersecurity-framework-for-banks::173	Para 173: identical configurations and patches at DC and DR	Configurations and deployed security patches at DC and DR are identical.
rbi-cybersecurity-framework-for-banks::174	Para 174: BCP/DR on interconnected vendor and partner systems with collaborative testing	BCP and DR capability extends to critical interconnected systems and networks including vendors and partners, with readi...

Chapter V Z: cyber incident response, recovery and crisis management – RBI Cybersecurity Framework for Banks

18 controls

Controls in the Chapter V Z: cyber incident response, recovery and crisis management – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 18 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::175	Para 175: incident response and recovery policy with eight elements	The bank has a cyber incident response and recovery management policy and procedures addressing definition, classificati...
rbi-cybersecurity-framework-for-banks::176	Para 176: specialised training for incident handlers	Personnel handling cyber incidents receive specialised training.
rbi-cybersecurity-framework-for-banks::177	Para 177: response plans for varied scenarios with stakeholder coordination	Response plans consider readiness for different incident scenarios based on situational awareness and potential or actua...
rbi-cybersecurity-framework-for-banks::178	Para 178: lessons learned fed into response plans	The bank has a mechanism to incorporate lessons learned dynamically to improve response plans.
rbi-cybersecurity-framework-for-banks::179	Para 179: documented strategies for ransomware, data destruction and DDoS	The bank documents and communicates strategies for advanced attacks such as ransomware and cyber extortion, data destruc...
rbi-cybersecurity-framework-for-banks::180	Para 180: contain attacks by shielding and quarantine	The bank contains cyber-attacks by shielding controls and quarantining affected devices and systems.
rbi-cybersecurity-framework-for-banks::181	Para 181: analyse incidents for severity, impact and root cause; corrective and preventive measures	The bank analyses cyber incidents, with forensics where needed, for severity, impact and root cause, and takes correctiv...
rbi-cybersecurity-framework-for-banks::182	Para 182: report cyber incidents on DAKSH within six hours; notify CERT-In	The bank reports cyber incidents on RBI's DAKSH platform within six hours of detection and proactively notifies CERT-In.
rbi-cybersecurity-framework-for-banks::183	Para 183: escalation and reporting plans to Board, senior management and customers	The bank has clear communication plans for escalating and reporting incidents to the Board, senior management and, as re...
rbi-cybersecurity-framework-for-banks::185	Para 185: external coordination and threat intelligence integration	The bank arranges external coordination and information sharing, integrating threat intelligence and security feeds from...
rbi-cybersecurity-framework-for-banks::186	Para 186: lawful systems to collect and share threat information	The bank establishes systems to collect and share threat information from local, national and international sources thro...
rbi-cybersecurity-framework-for-banks::187	Para 187: improve response and recovery through lessons from incidents, tests and drills	The bank establishes processes to improve incident response and recovery capabilities from lessons of past incidents, te...
rbi-cybersecurity-framework-for-banks::188	Para 188: participate in CERT-In and IDRBT cyber drills	The bank periodically and actively participates in cyber drills and simulations run by bodies such as CERT-In and IDRBT.
rbi-cybersecurity-framework-for-banks::189	Para 189: resilient interconnected systems with collaborative testing and capacity	The bank ensures resilient capabilities across interconnected systems and networks including vendors and partners, demon...
rbi-cybersecurity-framework-for-banks::190	Para 190: crisis communication tested through drills with customers and providers	The bank ensures its crisis communication plan works by periodic drills with stakeholders including customers and servic...
rbi-cybersecurity-framework-for-banks::191	Para 191: SOC, incident response and forensics aligned to cut downtime	The bank aligns its SOC, incident response and digital forensics to reduce business downtime and restore normal operatio...
rbi-cybersecurity-framework-for-banks::192	Para 192: documented Cyber Crisis Management Plan within the Board framework	The bank documents a Cyber Crisis Management Plan forming part of the Board-approved cybersecurity framework.
rbi-cybersecurity-framework-for-banks::193	Para 193: CCMP covers detection, containment, response and recovery for a wide threat set	The CCMP addresses detection, containment, response and recovery; the bank takes measures to prevent attacks and detect...

Chapter VI: Cyber Security Operations Centre – RBI Cybersecurity Framework for Banks

12 controls

Controls in the Chapter VI: Cyber Security Operations Centre – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 12 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::212	Para 212: CSOC framework proportionate to risk, scale and obligations	The bank puts in place a framework for establishing and operating a CSOC commensurate with its technology risk profile,...
rbi-cybersecurity-framework-for-banks::213	Para 213: CSOC governance: Board and management briefing, dashboards, metrics and reporting	CSOC governance includes briefing the Board or ITSC and senior management on threat intelligence, dashboards for oversig...
rbi-cybersecurity-framework-for-banks::214	Para 214: proactive monitoring with tools for detection, response and analytics	The CSOC has proactive monitoring and management capabilities with sophisticated tools for detection, quick response and...
rbi-cybersecurity-framework-for-banks::215	Para 215: log collection, storage, SIEM correlation, dashboard monitoring and alerting	Monitoring systems collect logs from deployed systems and network activity, store and process them, correlate through SI...
rbi-cybersecurity-framework-for-banks::216	Para 216: CSOC systems: root cause, classification, investigation, behaviour analysis, IoCs, analytics, honeypots	CSOC systems address root cause identification of attacks, their classification and containment of similar attacks, inci...
rbi-cybersecurity-framework-for-banks::217	Para 217: CSOC responsibilities across protect, detect, respond and recover	The CSOC is responsible for monitoring, analysing and escalating incidents, developing and executing response measures a...
rbi-cybersecurity-framework-for-banks::218	Para 218: security analytics engine with timely processing and deep packet inspection	The CSOC has a security analytics engine that processes logs in reasonable time, recommends deep-dive options and delive...
rbi-cybersecurity-framework-for-banks::219	Para 219: malware detection and analysis and forensic imaging tools	The CSOC includes tools for malware detection and analysis and imaging solutions for forensics.
rbi-cybersecurity-framework-for-banks::220	Para 220: CSOC architecture scalable, highly available and capable across six outcomes	The CSOC solution architecture meets performance, scalability and high availability needs and can protect critical busin...
rbi-cybersecurity-framework-for-banks::221	Para 221: CSOC staffing across Level 1, 2 and 3	The CSOC is managed continuously by competent personnel who know the bank's products and technology, with round-the-cloc...
rbi-cybersecurity-framework-for-banks::222	Para 222: differentiated hiring, management and retention for CSOC staff	The bank adopts a differentiated, structured approach to hiring, managing and retaining CSOC personnel, recognising the...
rbi-cybersecurity-framework-for-banks::223	Para 223: 24x7 staffing model, training, incentives, SOC metrics and capacity planning	The bank determines staffing for 24x7 monitoring, chooses in-house or managed service models, trains internal and provid...

Chapter VII: Information systems audit – RBI Cybersecurity Framework for Banks

5 controls

Controls in the Chapter VII: Information systems audit – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 5 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::224	Para 224: Audit Committee oversees IS audit	The Audit Committee of the Board is responsible for overseeing the bank's IS audit (also paragraph 10).
rbi-cybersecurity-framework-for-banks::225	Para 225: ACB-approved IS audit policy reviewed annually	The bank has an IS Audit Policy describing mandate, purpose, authority, audit universe and audit periodicity, approved b...
rbi-cybersecurity-framework-for-banks::226	Para 226: ACB reviews critical IT and cyber issues and directs management	The ACB reviews critical IT, information security and cybersecurity issues raised and gives direction and guidance to ma...
rbi-cybersecurity-framework-for-banks::227	Para 227: separate, competent IS audit function; accountability for external IS audits retained	The bank has a separate IS audit function or skilled resources within internal audit; where external resources fill skil...
rbi-cybersecurity-framework-for-banks::228	Para 228: risk-based IS audit planning	The bank plans IS audit using a risk-based approach.

Chapters II and III A to B: Board, IT governance framework and security policies – RBI Cybersecurity Framework for Banks

6 controls

Controls in the Chapters II and III A to B: Board, IT governance framework and security policies – RBI Cybersecurity Framework for Banks domain of RBI Cybersecurity Framework for Banks: 6 controls
Code	Title	Description
rbi-cybersecurity-framework-for-banks::12	Para 12: IT governance framework on the five focus areas	The bank puts in place a robust IT governance framework built on strategic alignment, risk management, resource manageme...
rbi-cybersecurity-framework-for-banks::13	Para 13: enterprise or operational risk policy assesses IT risks periodically	The enterprise-wide or operational risk management policy also provides for periodic assessment of IT-related risks, bot...
rbi-cybersecurity-framework-for-banks::14	Para 14: Information Security Policy with the prescribed contents	The bank has an Information Security Policy covering among other things its objectives, scope, ownership and responsibil...
rbi-cybersecurity-framework-for-banks::15	Para 15: Board-approved Cybersecurity Policy distinct from the IT and information security policies	The bank has a Board-approved Cybersecurity Policy setting a strategy to combat cyber threats suited to its business com...
rbi-cybersecurity-framework-for-banks::7	Para 7: Board approves IT, asset, continuity, security and cyber strategies and policies	The Board approves the strategies and policies for information technology, information assets, business continuity, info...
rbi-cybersecurity-framework-for-banks::8	Para 8: annual Board review of the strategies and policies	The strategies and policies are placed before the Board for review at least once a year.

What is RBI Cybersecurity Framework for Banks and who does it apply to?

RBI Cybersecurity Framework for Banks is a compliance framework from India (Reserve Bank of India) with 16 domains and 216 controls. The Reserve Bank of India's 2026 Directions on cybersecurity, technology risk, resilience and assurance for commercial banks, which replaced the 2016 Cyber Security Framework in Banks and the 2023 IT governance Master Direction: Board and committee governance (IT Strategy Committee, Information Security Committee, an independent CISO reporting to risk), IT and cyber risk management, some 160 baseline controls from asset inventory to DMARC, VA/PT and half-yearly full-day DR switchovers, third-party and ATM switch provider controls, incident reporting on DAKSH within six hours, a Cyber Security Operations Centre and IS audit. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does RBI Cybersecurity Framework for Banks actually require?

RBI Cybersecurity Framework for Banks has 216 controls organised across 16 domains. The largest domains are Chapter V L to P: access control, teleworking, customer authentication, mail and removable media – RBI Cybersecurity Framework for Banks (22 controls), Chapter V R to X: cryptography, straight through processing, surveillance, threat defence, anti-phishing and VA/PT – RBI Cybersecurity Framework for Banks (22 controls), Chapter V A to G: assets, data leakage, migration, software, physical, capacity and configuration – RBI Cybersecurity Framework for Banks (21 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of RBI Cybersecurity Framework for Banks do I already cover?

RBI Cybersecurity Framework for Banks does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement RBI Cybersecurity Framework for Banks?

Start your RBI Cybersecurity Framework for Banks compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about RBI Cybersecurity Framework for Banks requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 216 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required