The RBI cyber security framework for banks asks for a board-approved cyber security policy, a security operations centre, regular testing, a crisis plan and prompt incident reporting. The 2023 Master Direction on IT governance adds board committees, a CISO role, testing cadences and vendor risk expectations.
Which documents are we talking about?
Two RBI publications matter here. The first is a circular dated 2 June 2016, addressed to scheduled commercial banks excluding regional rural banks, titled as a cyber security framework. The second is the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, issued 7 November 2023 and effective 1 April 2024. The notification page describes it as consolidating earlier IT, cyber security, business continuity and IS audit circulars.
I read the notification pages on the RBI site, not the full annexures, so use this as an orientation and read the originals before building a compliance plan.
What did the 2016 framework ask for?
In plain terms:
- A cyber security policy approved by the Board, separate from the general IT security policy, covering inherent risk and an evaluation of existing controls.
- A Cyber Crisis Management Plan as part of the board-approved strategy, because traditional continuity and recovery arrangements may not be enough for cyber risk.
- A Security Operations Centre for continuous surveillance, monitoring and management of cyber risks in real time.
- Baseline controls in an annexure, described as indicative and not exhaustive.
- Periodic vulnerability testing, an IT architecture designed for security, and closing network or database access when it is no longer needed.
- Protection of customer data including data held by vendors.
- Reporting of all unusual cyber incidents to RBI, including unsuccessful attempts, promptly and in a prescribed format. The circular page gives no hour-based deadline.
What does the 2023 Master Direction add?
The Direction applies to commercial banks, NBFCs in the Top, Upper and Middle Layers, credit information companies and certain all India financial institutions. Highlights:
- Board approval of IT, information security and cyber security policies, reviewed at least annually.
- An IT Strategy Committee of at least three directors, chaired by an independent director with IT expertise, meeting at least quarterly.
- A CISO who is a senior executive, with no direct reporting line to the head of IT and no business targets, and who reviews cyber risk with the board or committee at least quarterly.
- For critical systems and customer-facing systems in the DMZ, vulnerability assessments at least every six months and penetration tests at least every 12 months, by trained independent experts, with vulnerabilities fixed within a set timeframe.
- Change and patch policies with business impact assessment, approvals and recovery steps.
- Vendor risk assessment covering concentration, single points of failure, supply chain risk and, for critical applications, source code access or escrow and written confirmation that the software is free of known vulnerabilities.
- An IS audit function overseen by the Audit Committee.
How does this land on an engineering team?
Constructed example. A mid-size bank's engineering lead maps each requirement to an artifact. Six-month vulnerability assessment: scan reports and fix tickets. Twelve-month penetration test: report and retest. Vendor confirmation of no known vulnerabilities: a component inventory and scan result for the delivered build, dated. The artifact list becomes the audit binder.
What to do
- Get the original RBI texts and extract each "shall" into a tracker.
- Assign an owner and an evidence type to every line.
- Set assessment and testing calendars at the stated frequencies.
- Define remediation timeframes by severity and record exceptions with approval.
- Ask critical vendors for dated component inventories and scan results for each delivery.
- Prepare a board-ready quarterly cyber risk summary.
- Rehearse incident reporting with the exact RBI format.
Safeguard's dependency scanning and compliance automation can help produce the records in steps 4 and 5. Safeguard does not certify a bank against RBI requirements.
Quick check
Does the RBI framework give a fixed incident reporting deadline?
The 2016 circular page says incidents should be reported promptly in the prescribed format and gives no hour-based deadline. Check later RBI instructions for current timelines.
How often must critical systems be vulnerability tested?
The 2023 Master Direction calls for assessments at least every six months and penetration tests at least every 12 months for critical and DMZ customer-facing systems.
Sources
- RBI: Cyber Security Framework in Banks, circular of 2 June 2016
- RBI: Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023
Last reviewed: 18 October 2026.
