# RBI Cyber Security Framework: RBI Cyber Security Framework in Banks

> The RBI baseline for cyber security policy, a cyber crisis management plan, a security operations centre and incident reporting in banks.

URL: https://securei3.com/standards/rbi-cyber-security-framework/
Category: India regulations: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


RBI’s Cyber Security Framework in Banks (2016) requires a board-approved cyber security policy distinct from the broader IT policy, a cyber crisis management plan, continuous surveillance through a security operations centre, an IT architecture conducive to security, and prompt reporting of cyber incidents to RBI. It is supplemented by graded frameworks for urban co-operative banks and by later RBI directions.

We assess your controls against the baseline requirements and annexes, strengthen your cyber crisis management plan, run tabletop exercises and help you prepare for supervisory reviews.

## Who it is for

- Commercial banks and small finance banks
- Urban co-operative banks under the graded framework
- Bank technology and SOC service providers

## Benefits

- Inspection-ready cyber governance
- A tested cyber crisis management plan
- Incident reporting that meets RBI timelines

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### Is the 2016 framework still relevant after the 2023 IT Governance Direction?

Yes. The Master Direction consolidates governance and IT risk expectations, while the cyber security framework and its annexes remain the reference for baseline cyber controls and incident reporting. We treat them together.

Related: https://securei3.com/standards/rbi-it-governance/, https://securei3.com/standards/cert-in-directions/, https://securei3.com/standards/iso-27001/, https://securei3.com/standards/iso-27035/

Contact: https://securei3.com/contact/: info@securei3.com