Overview
The Reserve Bank of India (RBI) has issued multiple cybersecurity circulars and frameworks that apply to banks, NBFCs, payment system operators, and other regulated entities. The primary framework is the RBI Cybersecurity Framework for Banks (2016), supplemented by subsequent circulars on IT governance, third-party risk, digital lending, and payment security. Compliance is mandatory, and RBI conducts regular inspections through its IT examination process. This checklist consolidates the key requirements across major RBI cybersecurity directives.
Key RBI Cybersecurity Requirements
| Requirement | Circular/Framework | Applicability |
|---|---|---|
| Cybersecurity Policy | Cybersecurity Framework 2016 | All scheduled commercial banks |
| Cyber Security Operations Centre (C-SOC) | Cybersecurity Framework 2016 | All banks with digital operations |
| Incident Reporting to CERT-In and RBI | Multiple circulars | All regulated entities |
| Board-approved IT Strategy | IT Governance Framework | All banks and NBFCs |
| CISO Appointment | Cybersecurity Framework 2016 | All banks |
| Red Team Exercises | 2024 IT Examination Framework | Large and mid-size banks |
| Third-party IT Risk Assessment | Outsourcing Guidelines | All banks and NBFCs |
| Data Localization | Payment Data Storage 2018 | All payment system operators |
Implementation Checklist
- Establish a Board-approved cybersecurity policy reviewed at least annually
- Appoint a Chief Information Security Officer (CISO) who reports directly to the Head of Risk Management or MD/CEO
- Set up a Cyber Security Operations Centre with 24/7 monitoring capability
- Implement a cyber crisis management plan with defined roles, escalation paths, and communication protocols
- Deploy Security Information and Event Management (SIEM) for centralized log analysis
- Conduct vulnerability assessment and penetration testing (VAPT) at least once a year by CERT-In empaneled auditors
- Submit cyber incident reports to RBI and CERT-In within 6 hours of detection
- Perform comprehensive IT audit by RBI-approved IS auditors annually
- Implement data localization requirements for payment data stored and processed in India
- Maintain a detailed asset inventory including hardware, software, network devices, and data repositories
Annex 1, control 14.1: anti-phishing and anti-rogue (anti-rouge) app services
Control 14 of the Annex 1 baseline is two lines long. 14.1 reads, as printed in RBI’s PDF: “Subscribe to Anti-phishing/anti-rouge app services from external service providers for identifying and taking down phishing websites/rouge applications.” Yes, “rouge”. The circular misspells it, which is why bank teams copying from it search for “anti-rouge app services”. Later texts fix the spelling. The 2019 graded framework for urban co-operative banks repeats it at Level II, Annex II 8.1 (“anti-rogue application services”), and the 2024 Master Directions for non-bank payment system operators carry it at para 27. The Digital Payment Security Controls directions (February 2021) go further for mobile apps. Para 29 asks regulated entities to “actively monitor for the non-genuine/ unauthorised/ malicious applications (with similar name/ features) on popular app-stores and the Web and respond accordingly to bring them down.” In an inspection, the subscription alone is weak evidence. What holds up is a record per case: the fake site or app, when it was found, who it was reported to (registrar, host, app store, CERT-In), and the date it went offline. Keep the Annex 3 timelines next to it, because a phishing campaign against customers can also be a reportable incident.
IT Governance and Risk Management
RBI expects regulated entities to treat IT risk as a critical component of operational risk. The Board must approve the IT strategy and review cybersecurity posture at quarterly intervals. The IT Sub-Committee of the Board should include members with technology expertise. Banks must maintain a separate IT risk register, conduct business impact analysis, and ensure that technology investments align with the overall risk appetite. The RBI IT examination process evaluates governance maturity, access controls, business continuity, vendor risk management, and the effectiveness of security monitoring.
Outsourcing and Third-Party Risk
RBI outsourcing guidelines require banks and NBFCs to maintain comprehensive oversight of all IT service providers. All outsourcing arrangements must be Board-approved and documented with clear service level agreements. Regulated entities must conduct due diligence before engaging third parties and periodically assess their security posture. Cloud service providers must store data within India unless explicitly permitted otherwise. The regulated entity retains full responsibility for all outsourced activities, and RBI retains the right to inspect or audit any service provider.
Common Examination Findings
- Delayed cyber incident reporting beyond the 6-hour window
- Inadequate network segmentation between production and development environments
- Weak privileged access management with shared administrative credentials
- Insufficient Board-level reporting on cybersecurity metrics
- Lack of red teaming or advanced penetration testing
- Incomplete data localization compliance for payment data
- Outdated or missing business continuity and disaster recovery testing