RBI vendor confirmation: free of known vulnerabilities and source code

Section 12 of the RBI 2023 IT governance direction asks regulated entities to obtain a certificate or written confirmation from the application developer or vendor that the application is free of known vulnerabilities, malware and covert channels, again on material code changes. It also asks for source code of critical applications, or escrow. Vendors to banks should expect both.

The relevant clauses

In section 12 on project management:

• (e) Maintenance and support from software vendors must be enforced through a formal agreement.
• (f) Obtain source codes for all critical applications from vendors. Where that is not possible, put in place a source code escrow or other arrangement to cover vendor default, and make sure updates and fixes are included in the escrow.
• (g) Obtain a certificate or written confirmation that the application is free of known vulnerabilities, malware and covert channels in the code, also whenever material changes including upgrades occur.
• (h) New IT applications proposed as a business product go through product approval and quality assurance.

Writing a confirmation you can stand behind

"Free of known vulnerabilities" is a strong statement. Known as of when, and known to whom? A careful vendor letter:

1. Names the application and exact version or build.
2. States the date and the sources checked, such as the vulnerability databases used and the scan tools and versions.
3. Attaches the dependency inventory (SBOM) that was scanned.
4. Lists any known issues with status: fixed, not reachable, mitigated, or accepted with a reason.
5. Says what malware and code integrity checks were done, such as build provenance and scanning.
6. Commits to reissue on material change, since the direction asks for that.

Avoid promising zero vulnerabilities forever. A new CVE can appear tomorrow against a component you shipped yesterday. A reissue process and a patch commitment is the honest answer.

Why an SBOM helps

The confirmation is only as good as your knowledge of what is inside the build. An SBOM generated at release time lets you scan against current databases and show the result. Reachability analysis can show which findings can actually be hit from your code, which makes the status column more credible.

Escrow

Source code escrow means a neutral third party holds the code against vendor failure. The direction asks that updates and fixes are included. Decide with your lawyers how to handle trade secrets, release conditions and build instructions.

Try it yourself

Open the demo and note how the component list becomes the evidence behind a statement about known vulnerabilities.

Click through it at your own pace, or open it full screen.

Safeguard can produce SBOMs and dependency scan results to attach. The wording of any confirmation remains your decision.

Quick check

Sources

• RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 7 November 2023

Last reviewed: 19 October 2026.