The Reserve Bank's 2023 Directions pull its rules on IT governance, risk, controls, audit and business continuity into one text. They set Board and committee duties, an independent CISO, vulnerability and penetration testing cycles, DR drills and an IS audit policy.
Free account needed to download. You come straight back to the file.
Who it is for. Commercial banks (including small finance banks, payments banks and foreign bank branches), NBFCs in the Top, Upper and Middle Layers, credit information companies, and the all-India financial institutions EXIM Bank, NABARD, NaBFID, NHB and SIDBI.
What this list covers. RBI Directions of 7 November 2023, in force from 1 April 2024; RBI has been consolidating its directions by type of entity, so check the current text for yours: 48 requirements. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| Para 4 | Build an IT governance framework | Put in place a framework covering strategy, risk, resources, performance and continuity. It says who decides what, who is accountable, and how IT and cyber risk are overseen. |
| Para 4(c) | Bring IT risk into the risk policy | Make the enterprise or operational risk policy assess IT risk, both inherent and potential, on a regular basis. |
| Para 5 | Board approval of policies | The Board approves the strategy and policies for IT, information assets, continuity, information security and cyber security (including incident response), and reviews them at least once a year. |
| Para 6(a)-(b) | Board-level IT Strategy Committee | Set up an IT Strategy Committee of at least three directors. An independent director with substantial IT expertise chairs it, and members must be able to judge IT and cyber risk. |
| Para 6(c)-(d) | What the IT Strategy Committee does | Meet at least quarterly. Check IT planning, strategy fit, accountability, risk processes and budgets, and review business continuity and disaster recovery at least once a year. |
| Para 7(a) | Senior management duties | Senior management executes the IT strategy, keeps IT running effectively, builds a culture of IT risk awareness and cyber hygiene, and keeps the cyber security posture robust. |
| Para 7(b)-(d) | IT Steering Committee | Form a senior committee with IT and business members that meets at least quarterly. It supports strategic IT planning, oversees continuity, ensures compliant architecture and updates the Strategy Committee and CEO. |
| Para 8 | Head of IT function | Appoint a senior, technically competent Head of IT. They align projects with IT policy and strategy, set up DR and continuity, and act as first line of defence for IT controls and risk. |
| Ref | Control | What it requires |
|---|---|---|
| Para 9(a)-(b) | IT service management | Run a service management framework that keeps the whole IT estate, including DR sites, resilient. Manage service levels in a way that keeps duties segregated. |
| Para 9(c) | Classify information assets | Map the confidentiality, integrity and availability classification of each information asset to how critical it is to operations. |
| Para 9(d)-(e) | Retire unsupported technology | Avoid outdated and unsupported hardware and software. Track end-of-support and maintenance contract dates, and plan the replacement of technology before support ends. |
| Para 10 | Third-party risk outside IT outsourcing | Where arrangements fall outside the IT outsourcing Directions, assess vendor risk and apply proportionate controls for concentration, conflicts of interest, single points of failure, customer data, availability and supply chain. |
| Para 11 | Capacity management | Assess IT capacity needs at least annually against past peaks, current demand and the IT strategy. The IT Strategy Committee reviews the assessment and the actions taken. |
| Para 12(a)-(d) | Project and architecture discipline | Run IT projects with a defined method and stakeholder oversight, plan new technology with an architecture framework within risk appetite, and keep an enterprise data dictionary. |
| Para 12(e)-(f) | Vendor support and source code | Secure vendor maintenance by formal agreement. Obtain source code for critical applications, or hold it in escrow with all updates and fixes, to cover vendor default. |
| Para 12(g) | Vendor assurance on code | Get a written confirmation from the developer or vendor that the application is free of known vulnerabilities, malware and covert channels, and again after each material change or upgrade. |
| Para 12(h) | Approve new IT products | Put any new IT application offered as a business product through product approval and quality assurance before launch. |
| Para 13 | Change and patch management | Document policies for changes and patches: assess business impact, apply them securely and on time with approval, justify and record each change, and be able to recover from a failed change. |
| Para 14 | Data migration controls | Have a documented data migration policy that protects integrity, completeness and consistency, with sign-off by business users and application owners at each stage and audit trails kept. |
| Para 15 | Audit trails | Give every application that touches critical or sensitive information audit logging detailed enough for audit, forensics and non-repudiation, and monitor the logs regularly for unauthorised activity. |
| Para 16 | Cryptographic controls | Use strong key lengths, algorithms, cipher suites and protocols for transmission, processing and authentication, using published international standards that are not deprecated or known to be weak. |
| Para 17 | Straight through processing | For critical applications, allow no manual change to data in transit between processes. Transfers must be tested, automated, authenticated and covered by audit trails. |
| Para 18 | Physical and environmental controls | Apply suitable physical and environmental controls at data centre and DR sites, keep the two geographically far enough apart not to share one threat, and put them under e-surveillance. |
| Para 19 | Access controls | Grant access only for a valid business need under documented standards approved by the IT Strategy Committee, supervise and log elevated access, and use multi-factor authentication for privileged users of critical systems. |
| Para 20 | Teleworking controls | Secure remote access to systems holding information assets, require multi-factor authentication for critical systems, identify every remote device connected, and protect data shared during remote work. |
| Para 21 | Metrics | Define performance, recovery and resumption metrics, including RPO and RTO, for critical systems, take a risk-based approach for others, and score IT performance and maturity. |
| Ref | Control | What it requires |
|---|---|---|
| Para 22 | Annual review of IT risk | Include IT and cyber risks in the risk management policy. The Board's Risk Management Committee, with the IT Strategy Committee, reviews and updates it at least once a year. |
| Para 23 | IT and information security risk framework | Set up a framework with a security function and internal controls, defined roles including third parties, identified critical systems, and controls for secure storage, transmission and processing. |
| Para 24(a) | Security and cyber policies | Write an information security policy covering objectives, scope, ownership, exceptions, compliance review and penalties, plus a cyber security policy and a Cyber Crisis Management Plan. |
| Para 24(b) | Information Security Committee | Form a committee under the IT Strategy Committee, headed from the risk function and including the CISO. It owns security policy, projects, awareness, incident review and audit findings. |
| Para 24(c) | Appoint an independent CISO | Name a senior CISO, preferably General Manager rank, with no reporting line to the Head of IT and no business targets, with the right expertise, a reasonable term, a staffed office and a threat-based budget. |
| Para 24(d) | Define the CISO's role | Document the CISO's duties: cyber strategy and compliance, enforcing policy, running the SOC, reporting to the executive over risk, and a quarterly cyber risk review to the Board, risk committee or IT Strategy Committee. |
| Para 25 | Risk assessment and annual review | Assess risk for each information asset using accepted standards, require staff and providers to follow security and acceptable-use policy, and review security policy and infrastructure at least annually. |
| Para 26(a) | VA every six months, PT every twelve | For critical systems and internet-facing systems in the DMZ with customer interfaces, run vulnerability assessment at least every six months and penetration testing at least every twelve, and throughout the lifecycle. |
| Para 26(b)-(d) | Who tests, and where | Use a risk-based approach for non-critical systems and independent, trained testers. After go-live, test production; if a test environment is unavoidable, make it match production and record deviations. |
| Para 26(e)-(f) | Fix findings and document the approach | Fix vulnerabilities in a time-bound way and keep them fixed, including known CVEs. Document the VA/PT approach, scope and scoring (such as CVSS), and apply it to cloud-hosted systems. |
| Para 27(a)-(c) | Incident response policy and procedures | Write a response and recovery policy covering classification, assessment, communication and containment, analyse each incident for severity and root cause, and keep written procedures that name key roles. |
| Para 27(d) | Escalation and reporting | Plan escalation to the Board, senior management and customers. Notify CERT-In and RBI of incidents as required; housing finance companies report to NHB. Reporting to IB-CART is encouraged. |
| Para 27(e) | Learn from incidents and drill | Improve response and recovery using lessons from incidents and tests, and test the crisis communication plan regularly with stakeholders, including service providers. |
| Ref | Control | What it requires |
|---|---|---|
| Para 28 | Continuity and DR policy | Base the continuity and DR policy on recognised practice (for example ISO 22301), update it after major developments, and design capability to resume critical operations, with security controls, after a cyber attack. |
| Para 29(a)-(d) | DR drills | Drill critical systems at least half-yearly. Fix and retest major issues. Run on the DR site as primary for at least one full working day, and test the plan against different contingencies. |
| Para 29(e) | Back up and test restores | Back up data and restore it periodically to prove it is usable. Keep backups intact and protected from unauthorised access. |
| Para 29(f)-(h) | RTO and RPO | Build DR to meet the defined RTO and RPO, aim for minimal RTO and near-zero RPO on critical systems, and document how data is reconciled where RPO is not zero. |
| Para 29(i) | Match DC and DR | Keep system configurations and security patches identical at the data centre and the DR site. |
| Para 29(j) | Test continuity with partners | Ensure continuity and DR capability in critical connected systems, including those of vendors and partners, and show readiness through joint resilience tests that meet your RTO. |
| Ref | Control | What it requires |
|---|---|---|
| Para 30(a)-(c) | Audit Committee oversight | The Audit Committee of the Board oversees IS audit, approves an IS audit policy (mandate, authority, universe, frequency) and reviews it yearly, and reviews critical IT and cyber issues. |
| Para 30(d) | A competent IS audit function | Keep a separate IS audit function, or skilled resources within internal audit. Accountability stays with internal audit even where outside experts do the work. |
| Para 30(e)-(f) | Risk-based and continuous audit | Plan IS audit on risk, and consider continuous auditing of critical systems, with control and risk assessments done more often. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
Commercial banks, NBFCs in the Top, Upper and Middle Layers, credit information companies and the named all-India financial institutions. Local area banks and core investment companies are outside them, and foreign bank branches follow a comply-or-explain approach.
For critical systems, and internet-facing systems in the DMZ with a customer interface, vulnerability assessment at least every six months and penetration testing at least every twelve. Other systems follow a risk-based approach.
Yes. The CISO may not report directly to the Head of IT Function and may not be given business targets, and reports to the executive overseeing risk management.
No. It is a plain-English summary in our own words, following the paragraph numbers. The Directions are the authority, and the RBI's separate rules on outsourcing of IT services and cyber incident reporting also apply.