Home / Knowledge hub / RBI cyber security framework
Knowledge hub
RBI cyber security framework
Reserve Bank of India rules for cyber resilience at banks and payment firms.
What it means
The RBI cyber security framework is the collection of circulars and master directions in which the Reserve Bank of India sets cyber security expectations for the entities it regulates. The 2016 Cyber Security Framework in Banks was the first, and later directions cover areas such as digital payment security and payment system operators.
In plain terms, it asks regulated entities to have a board-approved cyber security policy, baseline technical controls, a security operations capability, a plan for cyber crises, and a duty to report incidents to the regulator. The detail differs by type of entity, so check which directions apply to you.
Why it matters
If you are a bank, payment company or other regulated entity, these are binding. If you are a technology supplier to one, the rules arrive through your contract: the customer must show its regulator that its vendors are controlled, so your product gets assessed. Failing that can mean a lost deal or a supervisory finding on the customer's side.
Typical asks are regular vulnerability assessment and penetration testing of internet-facing systems, secure configuration, logging, and fast incident reporting. Having evidence ready is what shortens an audit. See also CERT-In directions and the DPDP Act. Regulators expect evidence, not assurances.
How it shows up
You meet it as a vendor questionnaire from a bank, a clause requiring annual penetration tests, a request for your test reports and proof that fixes were verified, or a requirement for logs and data to stay in India. Teams building payment features often hit the digital payment security directions first.
Mistakes repeat: giving a report with no evidence that findings were closed, leaving internet-facing APIs out of scope, and not having a named person who can report an incident quickly. Keep a current inventory, retest after fixes and retain the pentest report and retest report where the customer can ask for them. Read the actual circulars; this page is not legal advice.
Questions people ask
RBI cyber security framework, answered
Who must follow the RBI cyber security framework?
Entities regulated by the Reserve Bank of India, such as banks and certain non-bank payment and financial firms, depending on the direction. The exact list is in each circular.
Suppliers are bound indirectly through their customers' contracts.
Does it require penetration testing?
The framework expects regular vulnerability assessment and penetration testing of systems, especially those facing the internet. Specifics and frequency are set in the circulars and by each entity's own policy.
Read the current text for your category.
Is it the same as CERT-In requirements?
No. CERT-In is the national agency whose directions apply broadly, including incident reporting. The RBI framework is sector-specific and sits on top for regulated financial entities.
A regulated firm often has to meet both.
What do banks ask their software vendors?
Usually for security questionnaires, penetration test reports, evidence that findings were fixed, details of where data is stored and an incident contact.
Having these ready speeds up onboarding. Expect them to ask for proof that fixes held.
Where are the official documents?
On the Reserve Bank of India website, under notifications and master directions. Look up the entity category you fall under, because the rules differ.
Take legal advice before relying on a summary.
Sources
Where this comes from
Related
Terms that sit next to this one
CERT-In directions
Indian rules requiring certain incidents to be reported within six hours.
DPDP Act 2023
India's law on how organisations may collect, use and protect personal data.
PCI DSS
The security standard for any business that handles payment card data.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Retest report
A short report confirming which earlier findings are now closed and which remain.
Can you show the fix held?
We can evidence what a regulated buyer asks for: findings backed by the request and response, and fixes proven by re-running the exact exploit against the new code. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.