Overview
The Reserve Bank of India (RBI) has issued multiple cybersecurity circulars and frameworks that apply to banks, NBFCs, payment system operators, and other regulated entities. The primary framework is the RBI Cybersecurity Framework for Banks (2016), supplemented by subsequent circulars on IT governance, third-party risk, digital lending, and payment security. Compliance is mandatory, and RBI conducts regular inspections through its IT examination process. This checklist consolidates the key requirements across major RBI cybersecurity directives.
Key RBI Cybersecurity Requirements
| Requirement | Circular/Framework | Applicability |
|---|---|---|
| Cybersecurity Policy | Cybersecurity Framework 2016 | All scheduled commercial banks |
| Cyber Security Operations Centre (C-SOC) | Cybersecurity Framework 2016 | All banks with digital operations |
| Incident Reporting to CERT-In and RBI | Multiple circulars | All regulated entities |
| Board-approved IT Strategy | IT Governance Framework | All banks and NBFCs |
| CISO Appointment | Cybersecurity Framework 2016 | All banks |
| Red Team Exercises | 2024 IT Examination Framework | Large and mid-size banks |
| Third-party IT Risk Assessment | Outsourcing Guidelines | All banks and NBFCs |
| Data Localization | Payment Data Storage 2018 | All payment system operators |
Implementation Checklist
- Establish a Board-approved cybersecurity policy reviewed at least annually
- Appoint a Chief Information Security Officer (CISO) who reports directly to the Head of Risk Management or MD/CEO
- Set up a Cyber Security Operations Centre with 24/7 monitoring capability
- Implement a cyber crisis management plan with defined roles, escalation paths, and communication protocols
- Deploy Security Information and Event Management (SIEM) for centralized log analysis
- Conduct vulnerability assessment and penetration testing (VAPT) at least once a year by CERT-In empaneled auditors
- Submit cyber incident reports to RBI and CERT-In within 6 hours of detection
- Perform comprehensive IT audit by RBI-approved IS auditors annually
- Implement data localization requirements for payment data stored and processed in India
- Maintain a detailed asset inventory including hardware, software, network devices, and data repositories
IT Governance and Risk Management
RBI expects regulated entities to treat IT risk as a critical component of operational risk. The Board must approve the IT strategy and review cybersecurity posture at quarterly intervals. The IT Sub-Committee of the Board should include members with technology expertise. Banks must maintain a separate IT risk register, conduct business impact analysis, and ensure that technology investments align with the overall risk appetite. The RBI IT examination process evaluates governance maturity, access controls, business continuity, vendor risk management, and the effectiveness of security monitoring.
Outsourcing and Third-Party Risk
RBI outsourcing guidelines require banks and NBFCs to maintain comprehensive oversight of all IT service providers. All outsourcing arrangements must be Board-approved and documented with clear service level agreements. Regulated entities must conduct due diligence before engaging third parties and periodically assess their security posture. Cloud service providers must store data within India unless explicitly permitted otherwise. The regulated entity retains full responsibility for all outsourced activities, and RBI retains the right to inspect or audit any service provider.
Common Examination Findings
- Delayed cyber incident reporting beyond the 6-hour window
- Inadequate network segmentation between production and development environments
- Weak privileged access management with shared administrative credentials
- Insufficient Board-level reporting on cybersecurity metrics
- Lack of red teaming or advanced penetration testing
- Incomplete data localization compliance for payment data
- Outdated or missing business continuity and disaster recovery testing