RBI's Cyber Security Framework in Banks (circular of 2 June 2016) expects a Board approved cyber security policy distinct from the IT policy, a Security Operations Centre, a Cyber Crisis Management Plan, incident reporting to RBI, and measurable preparedness indicators. Evidence is the written trail showing each exists and works. Later RBI directions may add to it.
What is the circular and who must follow it?
The circular, reference RBI/2015-16/418, is addressed to all scheduled commercial banks excluding Regional Rural Banks. It builds on RBI's 2011 guidelines on information security, electronic banking, technology risk management and cyber frauds, and says the measures cannot be static. It also contains an Annex 1 baseline of minimum controls, which this post does not summarise; read the annex in the original circular.
RBI has since issued other directions on IT governance and outsourcing of IT services, which we did not fetch for this post. Treat this as one layer and check RBI's current master directions for your institution type. Vendors serving banks should expect customers to ask for evidence against these themes.
What evidence maps to each expectation?
Board approved Cyber Security Policy. Paragraph 3 asks banks to put in place a Board approved cyber security policy. Paragraph 4 says it should be distinct and separate from the broader IT or information security policy. Evidence: the policy document, Board approval minutes with date, and a version history showing reviews.
Inherent risk and control assessment. Paragraph 5 asks banks to assess inherent risk, considering technologies, connections, delivery channels, online and mobile products and technology services, and classify riskiness as low, moderate, high and very high or similar. Evidence: the assessment, the control evaluation covering Board oversight, threat intelligence arrangements, vendor management and incident management.
Continuous surveillance and SOC. Paragraph 6 says vulnerability testing at reasonable intervals is very important and that a SOC be set up. Evidence: SOC operating procedures, monitoring coverage list, vulnerability scan schedule and results, remediation tracking with closure dates.
Architecture reviews and written trade offs. Paragraph 7 asks the IT Sub Committee of the Board to review IT architecture, and says risk cost versus potential cost trade off decisions should be recorded in writing for later supervisory assessment. Evidence: committee minutes and recorded risk acceptances with an owner and date. Unwritten risk decisions do not count.
Network and database access. Paragraph 9 notes that temporary connections to networks or databases are often not closed. Evidence: a register of temporary access with expiry, closure proof, and named bank officials responsible.
Customer information. Paragraph 10 expects confidentiality, integrity and availability to be preserved across the data lifecycle, including data held by third party vendors. Evidence: data inventory, encryption standards, vendor contracts and vendor assessments.
Cyber Crisis Management Plan. Paragraph 11 asks for a CCMP as part of the Board approved strategy, and paragraph 12 says it should address detection, response, recovery and containment, including threats such as DDoS, ransomware, destructive malware and phishing. Evidence: the plan, exercise reports, and lessons learned with follow up actions.
Preparedness indicators. Paragraph 13 asks for indicators to measure risk and preparedness, tested through independent compliance checks and audits by qualified professionals. Evidence: the indicator set, dashboards or reports over time, and independent audit reports.
Incident reporting. Paragraphs 14 and 15 expect banks to report all unusual cyber incidents, successful or attempted, to RBI in the prescribed format. Evidence: incident register, copies of submissions with timestamps, and an internal rule for what counts as reportable.
Gap assessment. Paragraph 16 asks that material control gaps be identified early, with remediation under Board and IT Sub Committee oversight. Evidence: gap register, remediation plans and progress minutes.
What does a supplier to a bank see in practice?
Constructed example: a software vendor with a bank customer gets a request for the vendor's vulnerability management procedure, last three scan reports, the open critical findings and their due dates, the incident notification clause and the escalation contact. Each item traces back to paragraphs 6, 10 and 14. Having these as ready documents shortens review.
What to do
- Confirm which RBI directions apply to your institution, not only this circular.
- Keep policy, Board approval and review history in one controlled folder.
- Build the risk assessment and record risk acceptances in writing.
- Keep SOC and scan evidence with dates, owners and closure proof.
- Run and document a crisis exercise at least yearly.
- Define indicators, report them regularly, and schedule independent audits.
- Keep an incident register that covers attempts, with the RBI submission trail.
- For vendors: map your controls to these paragraphs and prepare a standard evidence pack.
Safeguard's compliance automation can gather control evidence such as vulnerability scan history and remediation records. It does not certify a bank or a vendor against RBI requirements.
Quick check
Must the cyber security policy be separate from the IT policy?
Per paragraph 4 of the circular, yes: it should be distinct and separate so the risks from cyber threats stand out.
Do attempted attacks have to be reported?
The circular says banks need to report all unusual cyber incidents, whether successful or attempts that did not succeed.
Sources
- Cyber Security Framework in Banks, RBI/2015-16/418, 2 June 2016, Reserve Bank of India, fetched 18 October 2026
Last reviewed: 18 October 2026.
