RBI's 2016 Cyber Security Framework in Banks circular does not mention SBOMs or software supply chains by name. But it makes the bank accountable for data held by vendors and for cyber resilience across stakeholders, so banks ask suppliers for dependency evidence. If you sell software to Indian banks, expect that question.
What is the circular, and who does it bind?
It is a circular dated 2 June 2016, reference DBS.CO/CSITE/BC.11/33.01.001/2015-16, addressed to all scheduled commercial banks excluding regional rural banks. It binds banks, not their suppliers directly. Suppliers meet it through contracts, security questionnaires and audits that banks run to show they have followed it.
RBI has issued further guidance since then, and this post covers only the 2016 circular. Check the current RBI directions on IT governance, outsourcing and cyber resilience before you quote a requirement to a customer.
Which parts of the circular reach a software vendor?
The circular's own text points to several expectations that land on vendors in practice.
- A Board approved cyber security policy. Banks must have a policy, approved by their Board, that is distinct and separate from the broader IT or information security policy so it can highlight cyber threats and the measures against them.
- Risk based controls. The circular says size, systems, technological complexity, digital products and threat perception vary, so banks must identify their inherent risks and controls, considering technologies adopted, connections established and delivery channels. Your product is one of the technologies adopted.
- Third party data. Banks must protect the confidentiality, integrity and availability of information, whether it is stored or in transit within the bank, with customers or with third party vendors. Custodial information confidentiality should not be compromised in any situation.
- Vendor management is named among the matters the policy should outline, alongside preventive, detective and corrective controls and incident management.
- Vendors and service providers should be encouraged to understand the bank's cyber resilience objectives, and banks should require and ensure appropriate action to support synchronized implementation and testing.
- Continuous surveillance and a Security Operations Centre, so vulnerability testing at reasonable intervals and real time monitoring are expected.
- A Cyber Crisis Management Plan, because traditional business continuity arrangements may not be adequate for cyber risk.
- Incident reporting. Banks must report all unusual cyber incidents to RBI, including attempts that did not succeed, and report promptly in the prescribed format.
Where does an SBOM fit?
Nothing in these paragraphs says "produce an SBOM". The link is practical. A bank that must show it controls risk from technologies adopted, and from data held by vendors, needs to answer a simple question when a vulnerable component is announced: does any system we run contain it? A dependency inventory for each vendor product is the fastest evidence you can hand over.
A constructed example: a library flaw is announced on a Friday. The bank's security team has forty vendor products in scope. The vendors who can send a component list within hours let the bank close the question that day. The vendors who need a week leave an open item that the bank must explain internally and, depending on impact, to its supervisor.
What should a vendor prepare?
- A current SBOM per product release, in a standard format, with exact versions.
- A process for producing a statement of impact when a new vulnerability is published: affected, not affected, or under review, with dates.
- A description of how you handle bank data in transit and at rest, matching your actual architecture.
- A vulnerability management summary: how you find, rank and patch issues, and how fast.
- An incident notification procedure with named contacts, so the bank can meet its own reporting duties.
- Evidence of testing, such as penetration test summaries, that you can share under NDA.
What to do
- Read the circular text yourself and map each paragraph to your product and contract.
- Check later RBI directions that apply to your customers' segment.
- Generate and archive an SBOM for every release.
- Write the vulnerability impact statement template before you need it.
- Align your questionnaire answers with what you can show, and never claim a certification you do not hold.
- Rehearse the Friday scenario once with your own team.
Safeguard can generate SBOMs and scan dependencies, and it has compliance automation features that help you collect evidence. It does not make you compliant with an RBI requirement by itself.
Quick check
Does the RBI circular require an SBOM?
Not in its text. It sets expectations on policy, third party data, vendor management and incident reporting. An SBOM is a practical way to evidence those expectations.
Does the circular apply directly to software vendors?
It addresses banks. Vendors feel it through the contracts and due diligence their bank customers use to follow it.
Sources
Last reviewed: 18 October 2026.
