RBI Cyber Security Framework for Banks
Having the policies is rarely the problem. Inspections go wrong on evidence, like a crisis plan nobody rehearsed or an incident reported in days that was due in hours. Below: what the framework asks for, and where banks fall short.
Overview of the Framework
The framework came out as circular DBS.CO/CSITE/BC.11/33.01.001/2015-16, "Cyber Security Framework in Banks", dated June 2, 2016, addressed to Scheduled Commercial Banks. Its first demand is simple: a board-approved cyber security policy, separate from the broader IT policy, so cyber risk gets board attention in its own right.
The rest hangs off that policy. Annex 1 lists baseline controls, from IT asset inventory and patching to anti-phishing and vendor risk. Control 14.1 is the one we get asked about most. It tells banks to “Subscribe to Anti-phishing/anti-rouge app services from external service providers for identifying and taking down phishing websites/rouge applications”, with RBI’s own spelling of rogue. Annex 2 covers the Cyber Security Operations Centre (C-SOC). There is a Cyber Crisis Management Plan, and unusual incidents go to RBI within 2 to 6 hours. Detection, triage and escalation all have to fit in that window.
The 2016 circular is no longer the whole story. RBI's 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices, effective April 2024, now carries much of the governance load. Urban co-operative banks follow a separate graded framework. Treat 2016 as the floor.
Key Framework Requirements
Cyber Security Policy
Board-approved and distinct from the IT policy. If yours is a section inside the IT policy, an inspector will notice.
Security Operations Centre
Running it round the clock is the easy part. Proving alerts were triaged and closed is harder.
CISO Appointment
Someone with real authority, not a title bolted onto the IT head's job.
Cyber Incident Reporting
2 to 6 hours for unusual incidents. Without a drill, the first real one usually misses it.
Vulnerability Assessment
Test exposed systems regularly. The finding that matters is the one still open next time.
Audit and Compliance
Independent audit, with evidence on hand. Screenshots from audit week aren't monitoring.
Threat Intelligence Sharing
Use channels like IDRBT's IB-CART, then actually block what other banks report.
Customer Protection
MFA and transaction monitoring, plus watching for fake sites and apps that harvest credentials.
Third-Party Risk Management
Your core banking vendor sits inside your risk. Contracts should let you audit them.
Maturity Levels
Level 1: Basic
Every bank owes the Annex 1 baseline, which starts with policy, asset inventory, access control, patching and logging.
Level 2: Intermediate
Banks with real digital volume need a working C-SOC and a crisis plan that has been tested.
Level 3: Advanced
Large banks: threat hunting, red teaming, intelligence feeding detection rules. The circular doesn't number levels; this is our reading of how expectations scale.
RBI Cyber Security Framework Checklist
The framework says which controls a bank must have, not how to prove they work. This checklist turns it into questions you answer yes, partly or no. Every “partly” needs a named owner and a date. Every “yes” needs evidence an inspector can see, such as a log, a report or a signed record.
It is written for the CISO, the compliance head and internal audit at scheduled commercial banks. Urban co-operative banks follow their own graded framework (see our RBI framework guide for UCBs), but most of these questions still apply.
Governance
- Is there a board-approved cyber security policy that stands apart from the IT policy?
- Does a CISO with real authority report on cyber risk to the board or its IT strategy committee?
- Has the policy been read against the 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices, not only the 2016 circular?
Annex 1 baseline controls
- Is there a current inventory of IT assets, including internet-facing servers and subdomains?
- Are patches tracked to closure, with exceptions signed off?
- Is there a subscription to anti-phishing and anti-rogue app services that find and take down fake sites and apps (control 14.1)?
- Are vendors with access to bank systems or data covered by contracts that allow audit?
Detection and response
- Does a C-SOC (Annex 2) watch the bank round the clock, and can you show how real alerts were triaged and closed?
- Is there a Cyber Crisis Management Plan, and has it been rehearsed?
- Can an unusual incident be reported to RBI within 2 to 6 hours, and has a drill proved it?
Testing and evidence
- Are internet banking, mobile apps and exposed servers tested regularly, with retests on what failed?
- Are findings still open from the last test listed with an owner and a date?
- Is evidence collected all year, not as screenshots in audit week?
Free RBI Cyber Security Framework Self-Assessment
First check which text binds you. The 2016 circular was addressed to scheduled commercial banks; urban co-operative banks have their own graded framework, and other RBI-regulated entities follow the directions written for them.
Then be strict about evidence. A policy on paper does not show that a control works. Expect to be asked for the asset inventory, the latest VAPT reports for internet-facing systems, and records of how your SOC escalated real alerts. The self-assessment follows the framework's domains, so your CISO and board get a plain picture of where you stand and what to fix first.
What you get by email
- The checklist above as an editable sheet, one row per control, with columns for status, evidence and owner
- Maturity scoring across governance, technology and operations
- A gap list that ranks what to fix first
- A one-page summary template for the board
- For urban co-operative banks, a read of which level of the 2019 graded framework (Level I to IV) your bank falls into
Get the checklist and self-assessment
By submitting, you agree to our Privacy Policy.
How TIKAJ Helps Banks Comply
We don't write your policy. We cover the outside view, meaning what attackers can see and what they are already doing with your brand.
We'd love to hear from you
Want Us to Reach Out?
Enjoying your scroll? Thanks for dropping by. If you'd like to hear from us, just leave your email and we'll reach out.
Prefer to email? Reach us at hello@tikaj.com
Achieve RBI Compliance with TIKAJ
Send us your last audit observations. We'll say which ones we can help close and which need work inside the bank.