RBI Cyber Security Framework
Take a leap in developing and implementing next-generation
cyber defense of the banking infrastructure
“Cyber Security Framework in Banks” circular from RBI sets the guidelines for Banks in India towards developing and implementing next generation cyber defense capabilities. The RBI cyber security framework addresses three core areas: (1) Establish Cyber Security Baseline and Resilience (2) Operate Cyber Security Operations Centre (C-SOC) (3) Cyber Security Incident Reporting (CSIR).
“Banks need to take effective measures to prevent cyber-attacks and to promptly detect any cyber-intrusions so as to respond/recover/contain the fall out.”
ValueMentor Services helped more than 25 banks in India maintain or excel the cyber security requirements outlined in the RBI Cyber Security Framework.
RBI Cyber Security Framework – Overview
Cyber Security Policy
Define and adopt a comprehensive cyber security policy in developing and establishing the cyber security framework.
Cyber Security Strategy
Develop the cyber security strategy that supports the Bank’s security policy, business goals and objectives
Cyber Security Organization
Establish a cyber security function and define the roles and responsibilities for implmenting, managing and improving the cyber defense.
Cyber Risk / Gap Assessment
Perform Gap Assessment against the Cyber Security Framework requirements. Assess cyber security risks of the organization
Security Testing
Perform security testing / penetration testing of the systems, applications and network to identify the vulnerabilities and mitigate them
Network and Database Security
Review and enhance the network and database security configurations. Harden the systems to minimize the attack vectors
Physical & Environmental Security
Ensure that the physical and environmental controls are implemented to provide adequate security for the information assets
Third Party Risk Management
Identify the critical 3rd parties such as vendors and assess the risks introduced by such relation ships.
Cyber Security Awareness
Educate employees, contractors and customers about cyber security so that human mistakes can be avoided
Cyber Crisis Management Plan
Establish a crisis management plan in line with the guidelines from CERT-IN, RBI CSF and national cyber crisis management plan
Cyber Security Operation Centre
Establish a security operations centre for proactive monitoring using sophisticated tools for detection and quick response.
Incident Response & Management
Define the incident response and management process and establish reporting process to notify RBI on cyber security incidents
RBI Cyber Security Framework Services
Establish Cyber Security Baseline
Establish Cyber Security Operation Centre (C-SOC)
C-SOC Functional Requirements
Define the functional requirements of the security operations centre
Integration Requirements
Integrate the CSOC with security solutions to generage alerts
Process Requirements
Define the CSOC processes, playbooks and operation manuals. Develop the IR process and playbooks to meet the RBI CSF CSOC requirements
Governance Requirements
Define the governance structure of the CSOC and management framework
People Requirements
Ensure the right skillsets are available within the CSOC operations
Technology Requirements
Deploy the CSOC technologies such as SIEM integrated with threat inteligence feeds / services. Develop
Cyber Security Incident Reporting (CSIR)
Template for reporting Cyber Incidents
An advanced black-box penetration testing engagement is performed based on a minimal information received about the target environement. The testing process may span between few days to months depending on the engagement model.
Cyber Security Incident Reporting (CSIR) Form
An advanced grey-box testing simulates the tactics used by adversaries such as APT groups or nation states. The intent is not just to identify vulnerabilities, but to identify the exploitation opportunities by these adversaries on your data and customers
Would you like to speak to a Security Analyst?
Related Insights
RBI CSF Overview
The ever-changing digital payment landscape has caused customary banks and budgetary establishments to embrace the most recent advances to improve...
RBI IS Audits
The IS Audit is an integral component of a discerning bank’s pursuit of robust IT security and actionable oversight. Solid corporate governance...
IT Act 2008 Consultancy
Information security in India is not just a business requirement, but a legal requirement in India. Compliance with Indian IT Act ensures that your...