3.1 Applicable Entities
RBI has issued multiple circulars on cyber security applicable to different categories of regulated entities. Understanding which circulars apply to which entities is the first step in compliance.
Key Circulars and Their Scope
| Circular | Date | Applicable To |
|---|---|---|
| Cyber Security Framework for Banks | June 2016 | All Scheduled Commercial Banks |
| Master Direction - IT Framework for NBFCs | June 2017 | All NBFCs with asset size > Rs. 500 Cr |
| Cyber Security Framework for UCBs | December 2018 | Urban Cooperative Banks |
| IT Governance Framework for Payment System Operators | April 2021 | All authorized PSOs |
| Master Direction on IT Governance for NBFCs | November 2023 | All NBFCs (updated requirements) |
Entity Categories and Requirements
Scheduled Commercial Banks (SCBs)
- Subject to the most comprehensive cyber security framework
- Board-approved cyber security policy mandatory
- Security Operations Centre (SOC) required
- CERT-In reporting for all cyber incidents
- Regular vulnerability assessment and penetration testing
Non-Banking Financial Companies (NBFCs)
NBFCs are categorized based on asset size. NBFCs with assets over Rs. 500 crore must implement comprehensive IT frameworks. Smaller NBFCs have proportionate requirements but must still maintain basic cyber hygiene.
Payment System Operators (PSOs)
- Card networks (Visa, Mastercard, RuPay operators)
- Prepaid Payment Instrument (PPI) issuers
- BBPS operating units
- ATM networks and White Label ATM operators
- Cross-border money transfer operators
RBI mandates that all payment system data must be stored only in India. This applies to full end-to-end transaction data including processing information. Payment system operators must ensure complete data localization by the specified timelines.
3.2 Cyber Security Policy Requirements
RBI mandates a Board-approved Cyber Security Policy separate from the general IT/IS Policy. This policy must address specific areas and be reviewed annually.
Mandatory Policy Components
- Risk Assessment: Methodology for identifying and assessing cyber risks to critical assets
- Security Architecture: Network segmentation, firewall policies, access controls
- Security Operations: SOC functions, monitoring, log management
- Incident Management: Detection, response, recovery, and notification procedures
- Audit and Compliance: Internal audit, external audit, compliance monitoring
- Awareness Training: Employee training programs on cyber security
Governance Structure
Banks must appoint a Chief Information Security Officer (CISO) at senior management level. The CISO should report to the MD/CEO or CRO, NOT to the CIO/CTO, to ensure independence of security function from IT operations.
Policy Review Cycle
Annual Compliance Calendar
Baseline Security Controls
- Inventory Management: Complete inventory of hardware, software, data assets
- Network Security: Firewalls, IDS/IPS, network segregation, DMZ
- Access Control: Role-based access, privileged access management, MFA
- Encryption: Data at rest and in transit encryption, key management
- Patch Management: Timely application of security patches
- Anti-Malware: Endpoint protection, email security, web filtering
- Backup: Regular backups, offsite storage, periodic restoration testing
3.3 Security Operations Centre (SOC) Requirements
RBI mandates establishment of a Security Operations Centre for continuous monitoring and rapid incident response. The SOC can be in-house or outsourced to a managed security service provider (MSSP).
SOC Functions
- Continuous Monitoring: 24x7 monitoring of security events across all critical systems
- Log Analysis: Centralized log management with correlation and analysis
- Threat Intelligence: Integration of threat feeds, IOC monitoring
- Incident Response: First-line response, escalation, containment
- Vulnerability Management: Continuous vulnerability scanning, prioritization
Technical Requirements
| Component | Requirement |
|---|---|
| SIEM | Security Information and Event Management for log correlation |
| Log Retention | Minimum 1 year for security logs, 5 years for transaction logs |
| Monitoring Coverage | All critical systems including core banking, internet banking, mobile banking |
| Alert Response | Defined SLAs for alert triage and escalation |
| Reporting | Regular reports to CISO, Board, and RBI as required |
If SOC is outsourced to an MSSP, the bank remains responsible for compliance. Ensure the MSSP agreement includes: SLAs, data confidentiality, RBI audit access, incident escalation procedures, and right to inspect.
Cyber Crisis Management Plan (CCMP)
- Crisis Team: Defined roles for CISO, CTO, Legal, Communications, Business
- Escalation Matrix: Clear triggers for escalation to Board and RBI
- Communication Plan: Templates for customer, media, regulator communication
- Recovery Procedures: Step-by-step recovery for various attack scenarios
- Drill Frequency: Annual table-top exercises and simulations
3.4 Incident Reporting
RBI has mandated specific incident reporting requirements. Failure to report incidents within specified timelines can result in regulatory action.
Reporting to RBI
Cyber incidents of severe/high impact must be reported to RBI within 2-6 hours of detection. All incidents must be followed up with detailed Root Cause Analysis (RCA) within 2-4 weeks.
| Incident Severity | Initial Report | Detailed RCA | Report To |
|---|---|---|---|
| Critical (data breach, system compromise) | Within 2 hours | Within 2 weeks | RBI CSITE, CERT-In |
| High (attempted breach, malware) | Within 6 hours | Within 4 weeks | RBI CSITE |
| Medium (policy violations, failed attacks) | Next business day | Monthly summary | Internal CISO |
| Low (minor incidents) | Weekly summary | Quarterly review | Internal SOC |
Reporting to CERT-In
Under CERT-In directions (April 2022), the following must be reported within 6 hours:
- Targeted scanning/probing of critical networks
- Compromise of critical systems/information
- Unauthorized access to IT systems
- Defacement of websites or intrusion
- Malicious code attacks (ransomware, cryptomining)
- Attacks on servers, critical infrastructure
- Data breach or data leak
- Fake mobile apps
All RBI-regulated entities must maintain logs of ICT systems for 180 days rolling. Logs must be maintained within Indian jurisdiction. This requirement applies from June 28, 2022.
Incident Classification Framework
Customer Notification
- Data Breach: Customers must be notified if their personal/financial data is compromised
- Service Disruption: Proactive communication for extended outages
- Fraud Alerts: Immediate notification of suspicious transactions
- Channel: SMS, email, in-app notification as appropriate
Key Takeaways
- RBI cyber security framework applies to banks, NBFCs, UCBs, and payment system operators with entity-specific requirements
- Board-approved Cyber Security Policy separate from IT Policy is mandatory
- CISO must be appointed at senior level with independence from IT operations
- SOC (in-house or outsourced) required for continuous monitoring
- Critical incidents must be reported to RBI within 2-6 hours
- CERT-In log retention requirement: 180 days within Indian jurisdiction
- Payment data localization is mandatory for PSOs
Part 3 Assessment Quiz
Test Your Knowledge
10 questions on RBI Cyber Security Framework