RBI Guidelines on Cyber Security (2016) & Digital Payment Security Controls (2021)

large PSU banks had implemented them in letter, but most banks lacked a dedicated cyber programme distinct from generic IT-security work.

are out (covered later by separate UCB/RRB addendums).

Requirement: Cyber-Security Policy; One-line essence: Board-approved, strategy + approach to combat cyber threats; confirmation to CSITE Cell, DBS, RBI Central Office.

Requirement: Cyber Security Policy to be distinct from broader IT Policy / IS Security Policy; One-line essence: Cannot be a chapter of the IT policy — it must stand alone.

Requirement: Arrangement for Continuous Surveillance; One-line essence: Periodic VA at reasonable intervals; mandatory Security Operations Centre (SOC) for 24x7 surveillance.

Requirement: IT Architecture should be Conducive to Security; One-line essence: Security embedded in IT architecture, not bolted on.

Requirement: Comprehensively Address Network and Database Security; One-line essence: No unauthorised access to networks / DBs; documented access processes; clear accountability.

Requirement: Ensure Protection of Customer Information; One-line essence: Treat customer data as a bank-owned asset; preserve CIA.