RBI Cyber Security Framework in Banks & Master Direction on IT Governance
India's mandatory cybersecurity framework for scheduled commercial banks, NBFCs, and financial institutions regulated by the Reserve Bank of India. Combines the 2016 Cyber Security Framework (24 baseline control areas covering SOC, network security, access control, incident reporting) with the 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices (ITGRCA) covering IT governance, infrastructure management, risk assessment, BCP/DR, and IS audit. Requires 2-6 hour incident reporting to RBI and CERT-In notification.
AC (21) AT (5) AU (15) CA (8) CM (14) CP (12) IA (12) IR (9) MA (7) MP (8) PE (22) PL (8) PM (25) PS (9) PT (8) RA (7) SA (16) SC (44) SI (22) SR (11)
AC Access Control
| Control | Name | RBI CSF References |
|---|---|---|
| AC-01 | Access Control Policies and Procedures | Annex1.8ITGRCA.19ITGRCA.24 |
| AC-02 | Account Management | Annex1.8ITGRCA.19 |
| AC-03 | Access Enforcement | Annex1.8ITGRCA.19 |
| AC-04 | Information Flow Enforcement | Annex1.4Annex1.15ITGRCA.19 |
| AC-05 | Separation Of Duties | Annex1.8ITGRCA.19 |
| AC-06 | Least Privilege | Annex1.8ITGRCA.19 |
| AC-07 | Unsuccessful Login Attempts | Annex1.8 |
| AC-08 | System Use Notification | Annex1.8 |
| AC-10 | Concurrent Session Control | Annex1.8 |
| AC-11 | Session Lock | Annex1.8 |
| AC-12 | Session Termination | Annex1.8 |
| AC-14 | Permitted Actions Without Identification Or Authentication | Annex1.8 |
| AC-17 | Remote Access | Annex1.8ITGRCA.20 |
| AC-18 | Wireless Access Restrictions | Annex1.4ITGRCA.19 |
| AC-19 | Access Control For Portable And Mobile Devices | Annex1.8Annex1.12 |
| AC-20 | Use Of External Information Systems | Annex1.8ITGRCA.20 |
| AC-21 | Information Sharing | Annex1.15 |
| AC-22 | Publicly Accessible Content | Annex1.8 |
| AC-23 | Data Mining Protection | Annex1.15 |
| AC-24 | Access Control Decisions | Annex1.8ITGRCA.19 |
| AC-25 | Reference Monitor | Annex1.9 |
AT Awareness and Training
AU Audit and Accountability
| Control | Name | RBI CSF References |
|---|---|---|
| AU-01 | Audit And Accountability Policy And Procedures | Annex1.16Annex1.17ITGRCA.15 |
| AU-02 | Auditable Events | Annex1.16Annex1.17ITGRCA.15 |
| AU-03 | Content Of Audit Records | Annex1.17ITGRCA.15 |
| AU-04 | Audit Storage Capacity | Annex1.16ITGRCA.15 |
| AU-05 | Response To Audit Processing Failures | Annex1.16ITGRCA.15 |
| AU-06 | Audit Monitoring, Analysis, And Reporting | Annex1.16Annex1.20Annex1.22 |
| AU-07 | Audit Reduction And Report Generation | Annex1.16ITGRCA.15 |
| AU-08 | Time Stamps | Annex1.17 |
| AU-09 | Protection Of Audit Information | Annex1.16ITGRCA.15 |
| AU-10 | Non-Repudiation | Annex1.17 |
| AU-11 | Audit Record Retention | Annex1.16ITGRCA.15 |
| AU-12 | Audit Record Generation | Annex1.16Annex1.17ITGRCA.15 |
| AU-13 | Monitoring for Information Disclosure | Annex1.16 |
| AU-14 | Session Audit | Annex1.16Annex1.17 |
| AU-16 | Cross-Organizational Audit Logging | Annex1.16 |
CA Security Assessment and Authorization
| Control | Name | RBI CSF References |
|---|---|---|
| CA-01 | Certification, Accreditation, And Security Assessment Policies And Procedures | Annex1.18ITGRCA.22ITGRCA.30 |
| CA-02 | Security Assessments | Annex1.18ITGRCA.26ITGRCA.30 |
| CA-03 | Information System Connections | Annex1.4Annex1.11 |
| CA-05 | Plan Of Action And Milestones | Annex1.18ITGRCA.26 |
| CA-06 | Security Accreditation | ITGRCA.5ITGRCA.22 |
| CA-07 | Continuous Monitoring | Annex1.21ITGRCA.21ITGRCA.30 |
| CA-08 | Penetration Testing | Annex1.18ITGRCA.26 |
| CA-09 | Internal System Connections | Annex1.4 |
CM Configuration Management
| Control | Name | RBI CSF References |
|---|---|---|
| CM-01 | Configuration Management Policy And Procedures | Annex1.5ITGRCA.13 |
| CM-02 | Baseline Configuration | Annex1.5 |
| CM-03 | Configuration Change Control | Annex1.7ITGRCA.13 |
| CM-04 | Monitoring Configuration Changes | Annex1.7ITGRCA.13 |
| CM-05 | Access Restrictions For Change | Annex1.7ITGRCA.13 |
| CM-06 | Configuration Settings | Annex1.5 |
| CM-07 | Least Functionality | Annex1.2Annex1.5 |
| CM-08 | Information System Component Inventory | Annex1.1ITGRCA.9 |
| CM-09 | Configuration Management Plan | Annex1.1 |
| CM-10 | Software Usage Restrictions | Annex1.2 |
| CM-11 | User-Installed Software | Annex1.2 |
| CM-12 | Information Location | Annex1.1 |
| CM-13 | Data Action Mapping | Annex1.15 |
| CM-14 | Signed Components | Annex1.2Annex1.6 |
CP Contingency Planning
| Control | Name | RBI CSF References |
|---|---|---|
| CP-01 | Contingency Planning Policy And Procedures | Annex1.19ITGRCA.28 |
| CP-02 | Contingency Plan | Annex1.19ITGRCA.28ITGRCA.29 |
| CP-03 | Contingency Training | ITGRCA.29 |
| CP-04 | Contingency Plan Testing And Exercises | ITGRCA.29 |
| CP-06 | Alternate Storage Site | ITGRCA.29 |
| CP-07 | Alternate Processing Site | ITGRCA.29 |
| CP-08 | Telecommunications Services | ITGRCA.29 |
| CP-09 | Information System Backup | ITGRCA.29 |
| CP-10 | Information System Recovery And Reconstitution | Annex1.19ITGRCA.29 |
| CP-11 | Alternate Communications Protocols | ITGRCA.29 |
| CP-12 | Safe Mode | ITGRCA.28 |
| CP-13 | Alternative Security Mechanisms | ITGRCA.28 |
IA Identification and Authentication
| Control | Name | RBI CSF References |
|---|---|---|
| IA-01 | Identification And Authentication Policy And Procedures | Annex1.8Annex1.9ITGRCA.19 |
| IA-02 | User Identification And Authentication | Annex1.8Annex1.9ITGRCA.19 |
| IA-03 | Device Identification And Authentication | Annex1.4ITGRCA.19 |
| IA-04 | Identifier Management | Annex1.8ITGRCA.19 |
| IA-05 | Authenticator Management | Annex1.8Annex1.9ITGRCA.19 |
| IA-06 | Authenticator Feedback | Annex1.8 |
| IA-07 | Cryptographic Module Authentication | ITGRCA.16 |
| IA-08 | Identification and Authentication (Non-Organizational Users) | Annex1.9 |
| IA-09 | Service Identification and Authentication | Annex1.11 |
| IA-10 | Adaptive Authentication | Annex1.9 |
| IA-11 | Re-authentication | Annex1.8 |
| IA-12 | Identity Proofing | Annex1.9 |
IR Incident Response
| Control | Name | RBI CSF References |
|---|---|---|
| IR-01 | Incident Response Policy And Procedures | Annex1.19ITGRCA.27 |
| IR-02 | Incident Response Training | Annex1.19Annex1.23ITGRCA.27 |
| IR-03 | Incident Response Testing And Exercises | Annex1.19ITGRCA.27 |
| IR-04 | Incident Handling | Annex1.19Annex1.22ITGRCA.27 |
| IR-05 | Incident Monitoring | Annex1.19ITGRCA.27 |
| IR-06 | Incident Reporting | Annex1.19ITGRCA.27 |
| IR-07 | Incident Response Assistance | Annex1.19ITGRCA.27 |
| IR-08 | Incident Response Plan | Annex1.19ITGRCA.27 |
| IR-09 | Information Spillage Response | Annex1.19 |
MA Maintenance
| Control | Name | RBI CSF References |
|---|---|---|
| MA-01 | System Maintenance Policy And Procedures | Annex1.7ITGRCA.9 |
| MA-02 | Controlled Maintenance | Annex1.7ITGRCA.9 |
| MA-03 | Maintenance Tools | Annex1.7 |
| MA-04 | Remote Maintenance | Annex1.7ITGRCA.20 |
| MA-05 | Maintenance Personnel | Annex1.7Annex1.11 |
| MA-06 | Timely Maintenance | Annex1.7ITGRCA.9 |
| MA-07 | Field Maintenance | Annex1.7 |
MP Media Protection
| Control | Name | RBI CSF References |
|---|---|---|
| MP-01 | Media Protection Policy And Procedures | Annex1.12Annex1.15 |
| MP-02 | Media Access | Annex1.12 |
| MP-03 | Media Labeling | Annex1.12 |
| MP-04 | Media Storage | Annex1.12Annex1.15 |
| MP-05 | Media Transport | Annex1.12 |
| MP-06 | Media Sanitization And Disposal | Annex1.12 |
| MP-07 | Media Use | Annex1.12 |
| MP-08 | Media Downgrading | Annex1.12 |
PE Physical and Environmental Protection
| Control | Name | RBI CSF References |
|---|---|---|
| PE-01 | Physical And Environmental Protection Policy And Procedures | Annex1.3ITGRCA.18 |
| PE-02 | Physical Access Authorizations | Annex1.3ITGRCA.18 |
| PE-03 | Physical Access Control | Annex1.3ITGRCA.18 |
| PE-04 | Access Control For Transmission Medium | Annex1.3ITGRCA.18 |
| PE-05 | Access Control For Display Medium | Annex1.3ITGRCA.18 |
| PE-06 | Monitoring Physical Access | Annex1.3ITGRCA.18 |
| PE-08 | Access Records | Annex1.3ITGRCA.18 |
| PE-09 | Power Equipment And Power Cabling | Annex1.3ITGRCA.18 |
| PE-10 | Emergency Shutoff | Annex1.3ITGRCA.18 |
| PE-11 | Emergency Power | Annex1.3ITGRCA.18 |
| PE-12 | Emergency Lighting | Annex1.3ITGRCA.18 |
| PE-13 | Fire Protection | Annex1.3ITGRCA.18 |
| PE-14 | Temperature And Humidity Controls | Annex1.3ITGRCA.18 |
| PE-15 | Water Damage Protection | Annex1.3ITGRCA.18 |
| PE-16 | Delivery And Removal | Annex1.1 |
| PE-17 | Alternate Work Site | ITGRCA.20 |
| PE-18 | Location Of Information System Components | Annex1.3ITGRCA.18 |
| PE-19 | Information Leakage | Annex1.3 |
| PE-20 | Asset Monitoring and Tracking | Annex1.3ITGRCA.18 |
| PE-21 | Electromagnetic Pulse Protection | Annex1.3 |
| PE-22 | Component Marking | Annex1.3 |
| PE-23 | Facility Location | ITGRCA.18 |
PL Planning
| Control | Name | RBI CSF References |
|---|---|---|
| PL-01 | Security Planning Policy And Procedures | ITGRCA.4ITGRCA.24 |
| PL-02 | System Security Plan | ITGRCA.4ITGRCA.24 |
| PL-04 | Rules Of Behavior | ITGRCA.24 |
| PL-07 | Concept of Operations | ITGRCA.4 |
| PL-08 | Security and Privacy Architectures | ITGRCA.4ITGRCA.24 |
| PL-09 | Central Management | ITGRCA.4 |
| PL-10 | Baseline Selection | Annex1.5 |
| PL-11 | Baseline Tailoring | Annex1.5 |
PM Program Management
| Control | Name | RBI CSF References |
|---|---|---|
| PM-01 | Information Security Program Plan | ITGRCA.4ITGRCA.24 |
| PM-02 | Information Security Program Leadership Role | ITGRCA.8ITGRCA.24 |
| PM-03 | Information Security and Privacy Resources | ITGRCA.4ITGRCA.5 |
| PM-04 | Plan of Action and Milestones Process | Annex1.18ITGRCA.26 |
| PM-05 | System Inventory | Annex1.1ITGRCA.9 |
| PM-06 | Measures of Performance | Annex1.21ITGRCA.21 |
| PM-07 | Enterprise Architecture | ITGRCA.4ITGRCA.12 |
| PM-08 | Critical Infrastructure Plan | ITGRCA.4 |
| PM-09 | Risk Management Strategy | ITGRCA.22ITGRCA.25 |
| PM-10 | Authorization Process | ITGRCA.5ITGRCA.6 |
| PM-11 | Mission and Business Process Definition | ITGRCA.4 |
| PM-12 | Insider Threat Program | Annex1.23 |
| PM-13 | Security and Privacy Workforce | ITGRCA.24 |
| PM-14 | Testing, Training, and Monitoring | Annex1.18ITGRCA.26 |
| PM-15 | Security and Privacy Groups and Associations | Annex1.11ITGRCA.10 |
| PM-16 | Threat Awareness Program | Annex1.13 |
| PM-22 | Personally Identifiable Information Quality Management | Annex1.15 |
| PM-25 | Minimization of Personally Identifiable Information Used in Testing, Training, and Research | Annex1.15 |
| PM-26 | Complaint Management | Annex1.14Annex1.23 |
| PM-27 | Privacy Reporting | Annex1.24 |
| PM-28 | Risk Framing | ITGRCA.22ITGRCA.25 |
| PM-29 | Risk Management Program Leadership Roles | Annex1.11ITGRCA.10 |
| PM-30 | Supply Chain Risk Management Strategy | Annex1.11ITGRCA.10 |
| PM-31 | Continuous Monitoring Strategy | Annex1.11ITGRCA.10 |
| PM-32 | Purposing | Annex1.11 |
PS Personnel Security
| Control | Name | RBI CSF References |
|---|---|---|
| PS-01 | Personnel Security Policy And Procedures | Annex1.23ITGRCA.24 |
| PS-02 | Position Categorization | Annex1.8 |
| PS-03 | Personnel Screening | Annex1.8 |
| PS-04 | Personnel Termination | Annex1.8ITGRCA.19 |
| PS-05 | Personnel Transfer | Annex1.8ITGRCA.19 |
| PS-06 | Access Agreements | Annex1.8 |
| PS-07 | Third-Party Personnel Security | Annex1.11ITGRCA.10 |
| PS-08 | Personnel Sanctions | Annex1.8 |
| PS-09 | Position Descriptions | ITGRCA.8ITGRCA.24 |
PT Personally Identifiable Information Processing and Transparency
| Control | Name | RBI CSF References |
|---|---|---|
| PT-01 | Policy and Procedures | Annex1.15ITGRCA.24 |
| PT-02 | Authority to Process Personally Identifiable Information | Annex1.15 |
| PT-03 | Personally Identifiable Information Processing Purposes | Annex1.15 |
| PT-04 | Consent | Annex1.15 |
| PT-05 | Privacy Notice | Annex1.24 |
| PT-06 | System of Records Notice | Annex1.16 |
| PT-07 | Specific Categories of Personally Identifiable Information | Annex1.15 |
| PT-08 | Computer Matching Requirements | Annex1.15 |
RA Risk Assessment
| Control | Name | RBI CSF References |
|---|---|---|
| RA-01 | Risk Assessment Policy And Procedures | ITGRCA.22ITGRCA.25 |
| RA-02 | Security Categorization | Annex1.1ITGRCA.9 |
| RA-03 | Risk Assessment | ITGRCA.22ITGRCA.25 |
| RA-05 | Vulnerability Scanning | Annex1.7Annex1.18ITGRCA.26 |
| RA-07 | Risk Response | ITGRCA.22ITGRCA.25 |
| RA-09 | Criticality Analysis | Annex1.1ITGRCA.9 |
| RA-10 | Threat Hunting | Annex1.13 |
SA System and Services Acquisition
| Control | Name | RBI CSF References |
|---|---|---|
| SA-01 | System And Services Acquisition Policy And Procedures | Annex1.6ITGRCA.12 |
| SA-02 | Allocation Of Resources | ITGRCA.11 |
| SA-03 | Life Cycle Support | Annex1.6ITGRCA.12 |
| SA-04 | Acquisitions | Annex1.6Annex1.11ITGRCA.10 |
| SA-05 | Information System Documentation | Annex1.6 |
| SA-08 | Security Engineering Principles | Annex1.6ITGRCA.12 |
| SA-09 | External Information System Services | Annex1.11ITGRCA.10 |
| SA-10 | Developer Configuration Management | Annex1.6ITGRCA.13 |
| SA-11 | Developer Security Testing | Annex1.6Annex1.18 |
| SA-15 | Development Process, Standards, and Tools | Annex1.6ITGRCA.12 |
| SA-16 | Developer-Provided Training | Annex1.6 |
| SA-17 | Developer Security and Privacy Architecture and Design | Annex1.6 |
| SA-20 | Customized Development of Critical Components | Annex1.6 |
| SA-21 | Developer Screening | Annex1.6 |
| SA-22 | Unsupported System Components | Annex1.2Annex1.7 |
| SA-23 | Specialization | Annex1.6 |
SC System and Communications Protection
| Control | Name | RBI CSF References |
|---|---|---|
| SC-01 | System And Communications Protection Policy And Procedures | Annex1.4ITGRCA.16 |
| SC-02 | Application Partitioning | Annex1.6 |
| SC-03 | Security Function Isolation | Annex1.6 |
| SC-04 | Information Remnance | Annex1.4 |
| SC-05 | Denial Of Service Protection | Annex1.4Annex1.13 |
| SC-07 | Boundary Protection | Annex1.4Annex1.15ITGRCA.19 |
| SC-08 | Transmission Integrity | Annex1.4Annex1.10ITGRCA.16 |
| SC-10 | Network Disconnect | Annex1.8 |
| SC-12 | Cryptographic Key Establishment And Management | ITGRCA.16 |
| SC-13 | Use Of Cryptography | ITGRCA.16 |
| SC-15 | Collaborative Computing | Annex1.8 |
| SC-17 | Public Key Infrastructure Certificates | ITGRCA.16 |
| SC-18 | Mobile Code | Annex1.2 |
| SC-20 | Secure Name / Address Resolution Service (Authoritative Source) | Annex1.4 |
| SC-21 | Secure Name / Address Resolution Service (Recursive Or Caching Resolver) | Annex1.4 |
| SC-22 | Architecture And Provisioning For Name / Address Resolution Service | Annex1.4 |
| SC-23 | Session Authenticity | Annex1.9 |
| SC-24 | Fail in Known State | Annex1.4 |
| SC-25 | Thin Nodes | Annex1.4 |
| SC-26 | Decoys | Annex1.13 |
| SC-27 | Platform-independent Applications | Annex1.4 |
| SC-28 | Protection of Information at Rest | Annex1.15ITGRCA.16 |
| SC-29 | Heterogeneity | Annex1.4 |
| SC-30 | Concealment and Misdirection | Annex1.4 |
| SC-31 | Covert Channel Analysis | Annex1.4 |
| SC-32 | System Partitioning | Annex1.4 |
| SC-34 | Non-modifiable Executable Programs | Annex1.5 |
| SC-35 | External Malicious Code Identification | Annex1.13 |
| SC-36 | Distributed Processing and Storage | ITGRCA.29 |
| SC-37 | Out-of-band Channels | Annex1.4 |
| SC-38 | Operations Security | Annex1.4 |
| SC-39 | Process Isolation | Annex1.4 |
| SC-40 | Wireless Link Protection | Annex1.4 |
| SC-41 | Port and I/O Device Access | Annex1.4 |
| SC-42 | Sensor Capability and Data | Annex1.15 |
| SC-43 | Usage Restrictions | Annex1.12 |
| SC-44 | Detonation Chambers | Annex1.13 |
| SC-45 | System Time Synchronization | Annex1.17 |
| SC-46 | Cross Domain Policy Enforcement | Annex1.4 |
| SC-47 | Alternate Communications Paths | Annex1.4 |
| SC-48 | Sensor Relocation | Annex1.4 |
| SC-49 | Hardware-enforced Separation and Policy Enforcement | Annex1.4 |
| SC-50 | Software-enforced Separation and Policy Enforcement | Annex1.6 |
| SC-51 | Hardware-based Protection | Annex1.5 |
SI System and Information Integrity
| Control | Name | RBI CSF References |
|---|---|---|
| SI-01 | System And Information Integrity Policy And Procedures | Annex1.13ITGRCA.23 |
| SI-02 | Flaw Remediation | Annex1.7ITGRCA.13 |
| SI-03 | Malicious Code Protection | Annex1.13 |
| SI-04 | Information System Monitoring Tools And Techniques | Annex1.4Annex1.13Annex1.16Annex1.20 |
| SI-05 | Security Alerts And Advisories | Annex1.7Annex1.13 |
| SI-06 | Security Functionality Verification | Annex1.16 |
| SI-07 | Software And Information Integrity | Annex1.5Annex1.13 |
| SI-08 | Spam Protection | Annex1.10Annex1.14 |
| SI-10 | Information Accuracy, Completeness, Validity, And Authenticity | Annex1.6 |
| SI-11 | Error Handling | Annex1.6 |
| SI-12 | Information Output Handling And Retention | Annex1.15 |
| SI-13 | Predictable Failure Prevention | ITGRCA.29 |
| SI-14 | Non-persistence | Annex1.5 |
| SI-15 | Information Output Filtering | Annex1.6 |
| SI-16 | Memory Protection | Annex1.13 |
| SI-17 | Fail-safe Procedures | Annex1.19 |
| SI-18 | Personally Identifiable Information Quality Operations | Annex1.15 |
| SI-19 | De-identification | Annex1.15 |
| SI-20 | Tainting | Annex1.15 |
| SI-21 | Information Refresh | Annex1.15 |
| SI-22 | Information Diversity | Annex1.4 |
| SI-23 | Information Fragmentation | Annex1.4 |
SR Supply Chain Risk Management
| Control | Name | RBI CSF References |
|---|---|---|
| SR-01 | Policy and Procedures | Annex1.11ITGRCA.10 |
| SR-02 | Supply Chain Risk Management Plan | Annex1.11ITGRCA.10 |
| SR-03 | Supply Chain Controls and Processes | Annex1.11ITGRCA.10 |
| SR-05 | Acquisition Strategies, Tools, and Methods | Annex1.11ITGRCA.10 |
| SR-06 | Supplier Assessments and Reviews | Annex1.11 |
| SR-07 | Supply Chain Operations Security | Annex1.11 |
| SR-08 | Notification Agreements | Annex1.18 |
| SR-09 | Tamper Resistance and Detection | Annex1.12 |
| SR-10 | Inspection of Systems or Components | Annex1.18 |
| SR-11 | Component Authenticity | Annex1.6 |
| SR-12 | Component Disposal | Annex1.1 |