Overview
The Reserve Bank of India (RBI) built its cybersecurity framework because Indian banks were being attacked faster than their controls were improving. UPI, mobile banking, card-not-present payments and open banking APIs have pushed more of the banking system onto the internet, and every new channel is something an attacker can phish, scrape or abuse. BFSI cybersecurity readiness is now a supervisory matter. RBI inspects it, and it penalises entities that fall short.
This guide walks through the RBI compliance requirements that matter in practice: the RBI Cybersecurity Framework for Banks (2016), the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (2023), Digital Payment Security Controls (2021), and the Outsourcing Directions. It is written for scheduled commercial banks, cooperative banks, NBFCs and payment aggregators alike. Use it to check where you stand, find the gaps an inspector would find, and plan the work.
What Is the RBI Cybersecurity Framework?
The RBI cybersecurity framework is a set of directions that require every RBI-regulated entity to set up, run and keep improving its cybersecurity controls. It started in June 2016 with the circular titled "Cyber Security Framework in Banks", and RBI has added to it several times since.
That 2016 circular is still the base layer. It is where the Board-approved cybersecurity policy, the Cyber Security Operations Centre (C-SOC), continuous surveillance and incident reporting come from. The Master Direction on IT Governance, Risk, Controls and Assurance Practices (2023) then filled in the governance side for banks and NBFCs, from IT strategy and risk management through information security, business continuity and IS audit.
Payments got their own rules. The Master Direction on Digital Payment Security Controls (2021) covers internet banking, mobile banking, cards and UPI, and even requires monitoring app stores for fake apps carrying the bank's name. Payment aggregators and gateways answer to a separate RBI Master Direction with its own cybersecurity and data security conditions. Vendors fall under the Outsourcing Directions, which reach down to the vendor's subcontractors.
Read together, these define BFSI cybersecurity readiness in India. Falling short can bring monetary penalties, limits on business activity, closer supervision, and a published penalty order with your name on it.
Key Domains of RBI Compliance
| Domain | RBI Requirement | Key Controls |
|---|---|---|
| IT Governance | Board-level oversight of IT strategy and cyber risk | IT Strategy Committee, IT Steering Committee, a CISO who reports to the Board |
| Cybersecurity Policy | Board-approved cybersecurity policy reviewed annually | Incident response plan, acceptable use policy, data classification, cyber crisis management plan |
| Cyber Security Operations Centre (C-SOC) | Continuous threat monitoring and incident detection | 24/7 SOC operations, SIEM, threat intelligence feeds, log correlation |
| Network and Infrastructure Security | Layered defences around critical systems | Next-gen firewalls, IDS/IPS, network segmentation, endpoint detection and response |
| Identity and Access Management | Least privilege access and multi-factor authentication | Role-based access control, privileged access management, quarterly access certification |
| Vulnerability Management | Regular VAPT and timely remediation | VA at least half-yearly and PT at least yearly on critical and customer-facing systems, by qualified testers such as CERT-In empaneled auditors |
| Data Security and Privacy | Protection of customer data, PII and payment data | Encryption at rest (AES-256) and in transit (TLS 1.2+), data masking, DLP, storage of payment data in India |
| Incident Response and Reporting | Timely detection, containment, and reporting to RBI and CERT-In | Incident response team, 6-hour CERT-In reporting, root cause analysis within 14 days |
| Business Continuity and DR | The ability to keep running and recover after disruption | Board-approved BCP/DR plans, annual DR drills, defined RPO/RTO targets |
| Third-Party Risk Management | Due diligence and ongoing oversight of IT outsourcing | Vendor risk assessments, SLA monitoring, audit rights, review of the vendor's subcontractors |
| IS Audit | Independent assurance over IT controls and cybersecurity | Annual IS audit by qualified auditors, reporting to the Board Audit Committee, remediation tracking |
RBI Master Direction on IT Governance and Risk Management
The RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (2023) is the most detailed IT governance text RBI has issued for the sector. It applies to scheduled commercial banks, small finance banks, payments banks and NBFCs in the upper and middle layers, among others.
IT governance. The Board owns it. It approves the IT strategy, makes sure IT is funded, and oversees cyber risk through an IT Strategy Committee, which in practice means the committee minutes need to show real discussion of cyber risk and not only project updates.
IT risk management. Banks need an enterprise-wide IT risk framework that sits inside the main risk function, not beside it. That includes ongoing threat assessment, residual risk tracking, a risk appetite with measurable thresholds and quarterly risk reporting to the Board.
Information security. Data classification, access controls, cryptographic standards, network, application and endpoint security, and security awareness training for all staff, Board members included.
IT operations. Change, patch, capacity and configuration management. Every production change goes through a documented change process that an auditor can follow, with segregation of duties so the person who writes a change is not the one who approves it.
IS audit. An independent Information Systems audit function reviews IT controls, cybersecurity and regulatory compliance at least annually and reports to the Board Audit Committee with remediation dates.
Business continuity. A tested Business Continuity Plan and Disaster Recovery strategy, with Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) set for every critical system and proven in annual exercises. A DR drill that only fails over the database, while the payment switch stays put, does not prove much.
BFSI Cybersecurity Readiness Checklist
- Board-approved Cybersecurity Policy, reviewed annually, with a named owner
- A Chief Information Security Officer (CISO) reporting directly to the Board or MD/CEO, not to the CIO
- IT Strategy Committee and IT Steering Committee with written charters
- A Cyber Security Operations Centre (C-SOC) with 24/7 monitoring and detection
- SIEM (Security Information and Event Management) correlating logs from every critical system, including core banking, the payment switch and internet banking
- VAPT at the frequency RBI sets (VA at least half-yearly, PT at least yearly for critical systems), and quarterly or more often on internet-facing assets if you can manage it
- MFA on critical systems, privileged accounts and remote access
- Role-based access control with quarterly access certification and privileged access management
- A Cyber Crisis Management Plan (CCMP) with escalation steps and communication protocols
- Incidents reported to CERT-In within 6 hours and to RBI within the prescribed timelines
- Data classified by sensitivity, with encryption at rest (AES-256) and in transit (TLS 1.2+)
- An IT asset inventory that is actually current: hardware, software, network devices, data stores, and the internet-facing domains and apps marketing launched without telling IT
- Annual Business Continuity and Disaster Recovery drills, with written results and gaps closed
- Vendor and third-party risk assessments for every IT outsourcing arrangement
- Annual Information Systems (IS) audit by qualified auditors, reported to the Board Audit Committee
- Anti-phishing, anti-malware and email authentication (DMARC, SPF, DKIM) across the organization, plus monitoring for lookalike domains and fake apps using your brand
- Cybersecurity awareness training at least annually for employees, contractors and Board members
- Digital Payment Security Controls on every electronic channel: UPI, NEFT, RTGS, cards
- A red team programme that tests detection and response against realistic attacker behaviour
- An IT risk register with risk appetite thresholds the Board reviews quarterly
BFSI Threat Landscape in India
Indian financial institutions are a busy target. Ransomware crews have gone after cooperative banks, NBFCs and payment processors, usually getting in through an old unpatched system and spreading because the network is flat. Phishing and social engineering aimed at customers and staff sit behind a large share of the fraud reported to RBI: fake KYC-update SMS messages, cloned net banking pages, and fake customer care numbers placed in search results.
Attackers also go through IT service providers, since one vendor with remote access to several banks is a better prize than any single bank. UPI (processing over 10 billion transactions monthly), open banking and digital lending have moved risk into APIs and authentication flows. Customer data theft is a standing risk, and the DPDP Act 2023 now adds regulatory penalties on top.
Nation-state groups and organised criminals have both shown sustained interest in India's financial infrastructure, including SWIFT systems and core banking platforms. Sharing threat intelligence through the Indian Banks Centre for Analysis of Risks and Threats (IB-CART), set up by IDRBT, is encouraged and worth doing, because a phishing domain seen by one bank on Monday is often aimed at another by Wednesday.
Cybersecurity Testing Requirements
RBI cyber security guidelines expect several kinds of security testing, each catching different problems.
Vulnerability Assessment (VA): RBI's directions set a floor of half-yearly VA for critical and customer-facing systems; many banks scan internet-facing systems, critical applications and network infrastructure quarterly or continuously. Remediation runs to defined SLAs; a common target is critical within 7 days and high-severity within 30 days.
Penetration Testing (PT): at least annually on critical systems, by qualified testers such as CERT-In empaneled auditors. Cover network, application, wireless and social engineering, from outside and inside.
Red team exercises suit large and mid-size banks. A good one tries what a real intruder would: phish an employee, move laterally, reach the SWIFT environment, pull data out, and see whether the SOC notices at each step.
Source code review applies to critical applications that handle financial transactions, before they go to production: static and dynamic analysis plus manual review of authentication, authorization and input validation.
Phishing simulations test staff and measure click-through rates. Feed the results into targeted training for the teams that click most.
Cyber drills: RBI expects regulated entities to take part in industry-wide cyber drills and tabletop exercises and to show they can respond.
Automation helps with the volume. Hunto's autonomous security agents can orchestrate continuous VAPT, track remediation and produce audit-ready evidence, so testing becomes an ongoing activity rather than an annual event.
Third-Party and Outsourcing Risk Management
RBI has issued specific directions on technology outsourcing, because banks and NBFCs now depend on vendors for much of their critical IT.
Before signing with an IT vendor, do due diligence on its finances, security, regulatory standing, business continuity and concentration risk; if half the sector uses the same provider, its outage is a sector outage. Material outsourcing needs Board approval and an SLA covering data security, audit and inspection rights, incident notification, business continuity and exit.
The contract must give RBI and your auditors unrestricted rights to access, inspect and audit the vendor's premises, systems and operations. Under RBI's payment data storage directive, payment system data must be stored only in India; where it is processed abroad, it has to come back to India within the prescribed timelines.
Look past the vendor to its own subcontractors, and their security posture and concentration risk. Cloud is permitted for regulated entities, subject to controls on data sovereignty, encryption, access management, vendor due diligence and exit planning.
Annual questionnaires do not keep up once the vendor count reaches the dozens or hundreds; a vendor can let a certificate expire or leave a storage bucket open the week after it answered. Hunto provides AI-driven vendor risk intelligence that keeps evaluating supplier security posture from the outside, flags new risks and keeps the records audit-ready, so the periodic review starts from current data.
Incident Response and Reporting Requirements
Report material cyber incidents to CERT-In within 6 hours of detection: unauthorized access, data breaches, ransomware, outages, website defacement, compromise of critical systems. RBI separately wants significant cyber incidents reported through its own channels within the timelines in the Cybersecurity Framework circular. These are two filings, not one. Put a named person against each in the runbook; in the middle of the night nobody will remember who files what.
Keep a Cyber Crisis Management Plan (CCMP) and test it. It should cover escalation, roles, internal and external communication, evidence preservation and when to bring in law enforcement. Afterwards, write the root cause analysis within 14 days: attack chain, impact, what was fixed, what stops a repeat.
RBI encourages banks to report incidents to IB-CART too. Tabletop exercises and simulation drills are how you show examiners the plan works, and every step from detection to post-incident review needs a written record.
The 6-hour window goes quickly when most of it is spent working out whether an alert is real. Hunto's incident response automation shortens the investigation and keeps the forensic record intact, which helps with both the CERT-In deadline and the paperwork RBI examiners ask for later.
Achieving Continuous RBI Compliance with Hunto
RBI compliance does not end with an inspection report. Controls drift, vendors change, new apps go live, and the evidence has to keep up. Most BFSI organizations also answer to more than RBI (SEBI, IRDAI, CERT-In, the DPDP Act 2023), so the same firewall rule or access review often counts toward several frameworks. Spreadsheets cannot track that for long.
Hunto's autonomous cybersecurity platform is built for regulated industries, and the parts that matter here are fairly concrete. It watches controls continuously and flags drift or misconfiguration before an examiner does. It collects compliance evidence from cloud, on-premise and SaaS systems, which shortens audit preparation. It compares your security posture with RBI requirements and ranks the gaps. It matches threat intelligence against your asset inventory, so a vulnerability on a server attackers are actively probing goes ahead of one on an isolated test box. Incident response automation supports the 6-hour CERT-In reporting requirement, and compliance dashboards show your RBI position on any given day, mapped to specific requirements.