RBI Cyber Security Framework for Banks

Introduction

The Reserve Bank of India (RBI) Cyber Security Framework for Banks, issued through the circular DBS.CO/CSITE/BC.11/33.01.001/2015-16 dated 2 June 2016, is the foundational supervisory instrument governing cyber resilience across India's scheduled commercial banks. Prompted by the rising frequency, sophistication and systemic impact of cyber attacks on the financial sector, the RBI mandated that every bank put in place a board-approved Cyber Security Policy that is distinct from the broader Information Technology or Information Security policy, and that the policy be commensurate with the bank's size, systems, technology, delivery channels and digital exposure.

The framework is unusual among Indian regulatory instruments in that it is prescriptive at the control level. It is accompanied by an Annex (commonly cited as Annex 1) enumerating baseline cyber security and resilience requirements, an Annex 2 setting out the format and timelines for reporting cyber incidents to the RBI, and Annex 3 which addresses the setting up and operation of a Cyber Security Operations Centre (C-SOC). Subsequent RBI communications have layered additional expectations on top of this core: the graded 'Cyber Security Framework - Coverage of ATM Switch and SWIFT related systems', the Master Direction on Digital Payment Security Controls (2021), and the guidance for Urban Cooperative Banks (UCBs) under a technology-risk-tiered approach. This guide focuses on the core 2016 framework and its Annex 1 baseline controls, which remain the reference standard for a bank's cyber security posture assessment.

This deep-dive is written for Chief Information Security Officers (CISOs), Heads of IT, internal auditors, the Board-level IT Strategy Committee and independent assessors who must plan, execute or defend a self-assessment or supervisory examination against the framework. It provides an auditor-grade decomposition of every control theme in Annex 1, a master assessment checklist, an evidence taxonomy, a phased implementation approach, and mappings to adjacent frameworks such as the NIST Cybersecurity Framework, ISO/IEC 27001 and the PCI DSS.

What is the RBI Cyber Security Framework

The RBI Cyber Security Framework for Banks is a mandatory, board-driven cyber risk management and resilience regime. Its central premise is that cyber risk is a distinct and continuously evolving risk category that cannot be managed as a subset of general IT risk. Accordingly it requires banks to establish dedicated governance, a dedicated policy, dedicated monitoring capability (the C-SOC), and dedicated incident reporting to the regulator.

The framework rests on several structural pillars. First, governance: a board-approved Cyber Security Policy and clearly articulated accountability, typically vested in a CISO who reports independently of the CIO/Head of IT. Second, a baseline security posture: the Annex 1 controls, which every bank must implement irrespective of size. Third, arrangement for continuous surveillance through a C-SOC capable of detecting, containing and responding to incidents in near real time. Fourth, cyber crisis management: a documented Cyber Crisis Management Plan (CCMP) addressing detection, response, recovery and containment. Fifth, supervisory reporting: unusual cyber security incidents must be reported to the RBI within a defined window (typically two to six hours of detection depending on the communication in force), together with periodic self-assessments.

Crucially, the framework adopts a risk-based and proportionate philosophy. While the Annex 1 baseline is universal, the RBI expects larger and more digitally exposed banks to go materially beyond the baseline, adopting adaptive and pre-emptive controls proportionate to their threat surface. This proportionality later matured, for cooperative banks, into an explicit four-level graded framework where controls scale with the bank's digital footprint.

The framework is outcome-oriented: the RBI is less interested in the mere existence of a document and more in demonstrable capability - can the bank detect an intrusion, contain it, recover critical services within its Recovery Time Objectives, report to the regulator on time, and evidence that its controls operate effectively and continuously?

Who must comply

The core 2016 framework is addressed to all scheduled commercial banks (excluding Regional Rural Banks in the original circular, though RRBs and cooperative banks were subsequently brought under proportionate regimes). The obligation flows to the entire banking group and its outsourced and third-party technology arrangements. The table below summarises applicability.

• The bank's Board bears ultimate responsibility; the framework explicitly requires board approval of the Cyber Security Policy.
• Accountability cannot be outsourced - use of managed security services or cloud does not transfer regulatory responsibility away from the bank.
• Group entities, subsidiaries and interconnected systems (payment switches, SWIFT, internet/mobile banking) fall within the assessable perimeter.
• Vendors with access to bank data or systems must be held to equivalent control standards and are examinable through the bank's third-party risk process.

Structure of the RBI Cyber Security Framework

The framework is delivered as a short principal circular supported by three Annexes. The substantive control content sits in Annex 1, which enumerates baseline cyber security and resilience requirements grouped into control themes. Practitioners commonly decompose Annex 1 into the control families summarised below. The exact numbering in the circular is thematic rather than a formal control catalogue; this guide organises the requirements into 18 assessable domains to support structured assessment.

Master assessment checklist

This is the operative section of the guide. Each Annex 1 domain is decomposed into the specific items an assessor must verify and the typical evidence that substantiates each. No control theme has been omitted. Where the RBI expects a documented artefact, a demonstrable technical control and an operating record, all three should be examined - the mantra is document, implement, evidence.

D1 - Inventory Management of Business IT Assets

D2 - Preventing Execution of Unauthorised Software

D3 - Environmental Controls

D4 - Network Management and Security

D5 - Secure Configuration

D6 - Application Security Life Cycle (ASLC)

D7 - Patch / Vulnerability and Change Management

D8 - User Access Control / Management

D9 - Authentication Framework for Customers

D10 - Secure Mail and Messaging Systems

D11 - Vendor / Outsourcing Risk Management

D12 - Removable Media Controls

D13 - Advanced Real-time Threat Defence and Management

D14 - Anti-Phishing

D15 - Data Leak Prevention Strategy

D16 - Audit Logs and Continuous Surveillance (C-SOC)

D17 - Incident Response and Management

D18 - Risk-based Transaction Monitoring, Metrics and Awareness

Scoping

Scoping determines the boundary of systems, data, people, facilities and third parties subject to assessment. For the RBI framework, scope is inherently broad: the framework applies to the bank as a whole, so scope-reduction techniques familiar from card-data assessments do not apply in the same way. The objective of scoping here is to prioritise assessment depth by criticality, not to exclude systems from applicability.

• In-scope systems: core banking system (CBS), internet and mobile banking, payment switches (ATM/POS), SWIFT/RTGS/NEFT/UPI/IMPS interfaces, treasury, and all supporting infrastructure.
• In-scope data: customer PII, account and transaction data, authentication credentials, and any data whose compromise affects confidentiality, integrity or availability of banking services.
• In-scope facilities: primary and disaster-recovery data centres, network operations centres, the C-SOC, and branch infrastructure with system access.
• In-scope people: employees, contractors, privileged administrators, and vendor personnel with system or data access.
• In-scope third parties: managed service providers, cloud providers, ATM switch operators, and any outsourced technology function.
• Connected environments: ATM Switch and SWIFT-related systems attract additional, specifically enumerated controls under the graded coverage guidance and must be scoped explicitly.
• Interconnections and trust relationships between the bank and payment networks, aggregators and fintech partners must be mapped and assessed.

Implementation approach

A pragmatic implementation programme progresses through five phases. Each phase produces defined deliverables that also serve as assessment evidence. Larger banks may run phases in parallel across business units; smaller banks should sequence them to manage capacity.

Phase 1 - Governance and Baseline Establishment

• Activities: constitute cyber security governance (Board oversight, IT Strategy Committee, CISO office); draft the board-approved Cyber Security Policy distinct from the IT policy; define risk appetite and control ownership.
• Deliverables: approved Cyber Security Policy; CISO charter and reporting line; governance RACI; policy suite (access, network, incident, vendor, DLP).

Phase 2 - Gap Assessment and Remediation Planning

• Activities: perform a self-assessment against Annex 1; conduct discovery of assets and data flows; identify control gaps and quantify risk; prioritise remediation.
• Deliverables: current-state gap assessment; risk register; prioritised remediation roadmap with owners and timelines; board-reported gap summary.

Phase 3 - Control Implementation

• Activities: deploy technical controls (network segmentation, EDR, PAM, DLP, MFA, whitelisting, DMARC); harden configurations; establish patch/vulnerability cadence; embed ASLC into the SDLC.
• Deliverables: implemented control configurations; hardening baselines; VAPT remediation evidence; secure-SDLC gates operational.

Phase 4 - Detection, Response and C-SOC Operationalisation

• Activities: stand up or contract the C-SOC; onboard log sources to SIEM; author use cases and runbooks; finalise the CCMP and RBI incident-reporting procedure; conduct drills.
• Deliverables: operational C-SOC with 24x7 coverage; SIEM use-case library; approved CCMP; incident-reporting workflow tested; tabletop/drill reports.

Phase 5 - Continuous Assurance and Improvement

• Activities: institutionalise periodic self-assessment, VAPT, red-teaming, metrics reporting and management review; track threat intelligence; mature controls beyond baseline for higher-exposure areas.
• Deliverables: periodic self-assessment submissions to RBI; KPI/KRI dashboards; continuous improvement backlog; independent assurance reports.

Maturity / capability model

The core 2016 framework does not itself define numeric maturity levels, but the RBI's proportionality philosophy - later formalised for UCBs as a four-level graded framework - maps naturally onto a capability maturity model. Assessors should rate each domain against the levels below to produce a defensible maturity heat-map and to justify where a bank must exceed the baseline.

Assessment and audit approach

1. Confirm scope and applicability: identify the bank's tier, digital exposure, connected environments (ATM switch, SWIFT) and third-party landscape.
2. Review governance: examine the board-approved Cyber Security Policy, CISO reporting line, committee minutes and risk appetite.
3. Perform document review: obtain and assess the policy suite, CCMP, incident-reporting procedure and prior self-assessments against Annex 1.
4. Conduct control walkthroughs: interview owners and observe control operation across each of the 18 domains.
5. Perform technical validation: review configurations, run or review VAPT results, sample logs and alerts, and test detection use cases.
6. Sample evidence for operating effectiveness: test a representative period for access recertification, patch SLAs, incident handling and log monitoring.
7. Assess incident and crisis readiness: verify RBI reporting timeliness, review incident records and drill outcomes.
8. Evaluate third-party assurance: examine contracts, audit reports and monitoring for outsourced and cloud services.
9. Rate maturity per domain and identify gaps against the baseline and against the bank's required (exposure-adjusted) posture.
10. Report findings with risk ratings, root causes and prioritised remediation; agree management action plans and retest dates.

Evidence request list

The following categorised evidence list expedites both self-assessment and supervisory examination. Assessors should request current versions and a sample of operating records for the review period.

• Governance: board-approved Cyber Security Policy; CISO charter and org chart; IT Strategy Committee minutes; risk appetite statement.
• Policies and standards: access control, network security, hardening baselines, patch/vulnerability, DLP, vendor risk, incident response, e-mail security policies.
• Asset and data: IT asset inventory/CMDB; data classification matrix; data-flow diagrams; network architecture diagrams.
• Access management: RBAC role definitions; PAM configuration and session logs; MFA enforcement; access recertification reports; JML records.
• Vulnerability and change: VAPT reports and retests; patch deployment reports; vulnerability register with ageing; change management records.
• Detection and monitoring: C-SOC charter and roster; SIEM log-source inventory; use-case library; alert/ticket samples; log retention and NTP configuration.
• Incident and crisis: CCMP; RBI incident reports (Annex 2) with timestamps; RCA reports; drill/tabletop records.
• Application security: secure coding standard; SAST/DAST/VAPT reports; SDLC change and environment segregation evidence; component/SBOM inventory.
• Third-party: vendor due-diligence and risk-tiering; executed contracts with security schedules; vendor audit/SOC 2/ISO 27001 reports.
• Awareness and testing: training completion records; phishing simulation results; customer awareness campaign evidence.
• Prior assurance: previous self-assessments submitted to RBI; internal/external audit reports; prior examination observations and closure evidence.

Roles and responsibilities

KPIs to track

• Percentage of critical/security patches applied within SLA.
• Mean time to detect (MTTD) and mean time to respond (MTTR) for security incidents.
• Number and timeliness of cyber incidents reported to the RBI within the mandated window.
• Percentage of log sources onboarded to the SIEM versus in-scope critical systems.
• Open high/critical vulnerabilities and their ageing beyond SLA.
• Percentage of privileged accounts under PAM with session recording.
• Access recertification completion rate and orphan/dormant account count.
• Phishing simulation click and report rates; staff awareness training completion.
• VAPT findings closure rate and average time to remediate.
• C-SOC alert triage backlog and false-positive ratio.
• Third-party assessments completed versus due; high-risk vendors with expired assurance.
• Percentage of Annex 1 domains at or above target maturity level.

Readiness checklist

• Board-approved Cyber Security Policy exists and is distinct from the IT/IS policy.
• CISO is appointed with an independent reporting line and defined charter.
• A complete, classified IT asset inventory is maintained.
• Network segmentation isolates critical systems; firewall rules are reviewed periodically.
• Application whitelisting and endpoint privilege control are enforced.
• Hardening baselines are applied and configuration compliance is scanned.
• VAPT is performed at defined frequency and findings are remediated within SLA.
• Patch management operates to severity-based SLAs across the estate.
• RBAC, PAM and MFA govern access; recertification runs periodically.
• Customer channels use multi-factor / adaptive authentication.
• SPF, DKIM and DMARC protect the bank's e-mail domains.
• EDR, anti-APT and DDoS mitigation are deployed and current.
• An anti-phishing / brand-monitoring and takedown capability is in place.
• DLP covers endpoint, network and storage with data classification.
• A 24x7 C-SOC monitors a SIEM covering all critical log sources.
• A board-aware CCMP and tested incident-response workflow exist.
• Cyber incidents are reported to the RBI within the mandated window.
• Vendor risk is assessed, contracted and monitored with right-to-audit.
• Staff and customer awareness programmes run periodically.
• Periodic self-assessment against Annex 1 is completed and submitted.

Common gaps

• Cyber Security Policy not truly distinct from the IT policy, or not board-approved as required.
• CISO reporting into the CIO/Head of IT, compromising the independence the framework expects.
• Incomplete or stale asset inventory, undermining every downstream control.
• C-SOC that logs but does not effectively detect - immature use cases and high false-positive rates.
• Delayed RBI incident reporting due to unclear triggers, ownership or escalation thresholds.
• Application whitelisting and endpoint privilege control implemented in monitor-only mode, not enforced.
• Privileged access not vaulted or session-recorded; shared admin accounts persisting.
• VAPT performed but findings not closed within SLA; retests missing.
• DMARC published in monitor (p=none) mode indefinitely, offering no enforcement against spoofing.
• Vendor and cloud environments treated as out of scope, with no independent assurance obtained.
• DLP deployed without data classification, generating noise rather than protection.
• CCMP untested - no drills or tabletop exercises to validate response readiness.
• Self-assessment treated as a documentation exercise rather than evidence-based control testing.
• ATM switch and SWIFT-connected systems not subjected to the additional graded controls.

RBI Cyber Security Framework mapped to other frameworks

The RBI framework's Annex 1 domains align closely with international control catalogues, enabling banks with existing ISO 27001 or NIST programmes to reuse evidence. The mapping below is indicative and should be validated control-by-control.

How CyberSigma helps

Frequently asked questions

Need help with RBI Cyber Security Framework?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.