The RBI Cyber Security Framework in Banks, issued on 2 June 2016, binds banks, not their software suppliers. But banks pass its expectations down, so a vendor should prepare for questions on policy, monitoring, incident reporting, data protection and vendor oversight. Build evidence for each, step by step.
Who is bound, and why does it reach vendors?
The circular is addressed to scheduled commercial banks (excluding Regional Rural Banks). It does not name software suppliers. Yet it says banks should keep data confidential and intact "irrespective of whether the data is stored or in transit within themselves or with customers or with the third party vendors", and that they should promote among customers, vendors and service providers an understanding of the bank's cyber resilience objectives.
That is how a bank's obligation turns into a clause in your contract. This guide covers only the 2016 circular, which we fetched. Banks are also subject to later RBI directions, so ask your customer which texts they apply to you.
Step 1: Understand what the bank itself must have
From the circular, banks should have:
- A Board approved cyber security policy that is distinct from the broader IT or information security policy.
- An assessment of inherent risk, categorised as low, moderate, high and very high, or similar, before choosing controls.
- A Security Operations Centre for continuous surveillance, with an indicative configuration in an annex to the circular.
- IT architecture designed to facilitate security, with risk and cost trade offs recorded in writing.
- A Cyber Crisis Management Plan covering detection, response, recovery and containment.
- Reporting of unusual cyber incidents, including attempts that failed, to the Reserve Bank in the format the circular gives.
Your product sits inside the first four. Your evidence should help the bank show them.
Step 2: Map your product to the bank's controls
Take a constructed example. You sell a loan origination platform hosted in your cloud account. The bank's SOC wants logs. Their architecture team wants connections to databases to be closed when the business reason ends. The circular warns specifically that connections to networks or databases are sometimes allowed for a period and then not closed through oversight.
So for your product, document: what logs you can stream to the bank, how long you keep them, who at your company can reach the bank's data and how that access is granted and removed.
Step 3: Prepare for the incident clause
Banks must report unusual incidents promptly. Expect your contract to ask you to notify them fast enough for that. Write an internal runbook that states who decides that an event is an incident, who calls the bank, and what facts you will give in the first message. Rehearse it once.
Step 4: Evidence for vendor oversight
The bank will want to know how you secure your own software and suppliers. The NIST Secure Software Development Framework and NIST SP 800-161 Rev. 1 are neutral references you can map your answers to. Keep an inventory of the open source components in each release and a record of how you handle new vulnerabilities in them.
Step 5: Be ready for preparedness testing
The circular says adequacy of the cyber resilience framework should be measured by indicators and tested through independent compliance checks and audits by qualified professionals. Expect the bank to ask for penetration test summaries, and for the right to review your results.
How to check or apply this
- Ask the bank which RBI texts they apply to the engagement and get the clause numbers.
- Build one page that maps your logging, access and data handling to those clauses.
- Write the incident notification runbook and agree timings with the bank.
- Produce a component inventory for each release you deliver.
- Schedule an independent test and keep the summary report.
- Do not claim compliance on the bank's behalf. State what your product provides.
Quick check
Does the RBI framework apply directly to a software vendor?
Not by its text: it is addressed to banks. Vendors meet it through contract terms and questionnaires from the bank.
Is the SOC requirement something the vendor must run?
No. The circular asks banks to set up a SOC. The vendor's job is to make logs and events available to it.
Sources
- Reserve Bank of India, Cyber Security Framework in Banks, 2 June 2016
- NIST SP 800-218, Secure Software Development Framework
- NIST SP 800-161 Rev. 1
Last reviewed: 18 October 2026.
