# RBI Cyber Security Framework in Banks & Master Direction on IT Governance

Framework id: `rbi_csf`. Regulatory. Publisher: Reserve Bank of India (RBI). Version: 2016/2023. Region: India. Mapping licence: CC BY-SA 4.0.
Source text: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=10435&Mode=0

Each line is a clause, the NIST SP 800-53 controls OSA maps to it, and OSA's estimate of how far those controls cover it.
Clause titles and coverage figures are OSA's own summaries and estimates. No line-by-line check against the source text is recorded for this framework, so quote the source, not this card.

## Clauses (51, average coverage 77%)
- Annex1.1 Inventory Management of Business IT Assets: CM-08, CM-09, CM-12, PM-05, RA-09 (88%)
- Annex1.2 Preventing Execution of Unauthorised Software: CM-07, CM-10, CM-11, CM-14, SI-07, SI-16 (90%)
- Annex1.3 Environmental Controls: PE-01, PE-02, PE-03, PE-04, PE-05, PE-06, PE-09, PE-10, PE-11, PE-12, PE-13, PE-14, PE-15, PE-17, PE-18 (87%)
- Annex1.4 Network Management and Security: SC-07, SC-08, AC-04, SI-04, SC-05, SC-20, SC-21, SC-22, SC-32, SC-47, CM-06 (86%)
- Annex1.5 Secure Configuration: CM-02, CM-03, CM-06, CM-07, CM-05, SC-41 (90%)
- Annex1.6 Application Security Life Cycle: SA-03, SA-04, SA-08, SA-10, SA-11, SA-15, SA-17, SA-20, SA-21, CM-04 (88%)
- Annex1.7 Patch/Vulnerability and Change Management: SI-02, CM-03, CM-04, CM-05, RA-05, RA-07 (88%)
- Annex1.8 User Access Control and Management: AC-01, AC-02, AC-03, AC-05, AC-06, AC-07, AC-11, AC-12, IA-01, IA-02, IA-04, IA-05, IA-12, PS-04, PS-05 (90%)
- Annex1.9 Authentication Framework for Customers: IA-02, IA-05, IA-08, IA-12, SC-23, AC-07 (72%)
- Annex1.10 Secure Mail and Messaging Systems: SC-08, SI-08, SC-07, SC-13 (82%)
- Annex1.11 Vendor Risk Management: SA-04, SA-09, SR-01, SR-02, SR-03, SR-05, SR-06, SA-21, PS-07 (78%)
- Annex1.12 Removable Media: MP-01, MP-02, MP-03, MP-04, MP-05, MP-06, MP-07, MP-08, SC-41 (92%)
- Annex1.13 Advanced Real-time Threat Defence and Management: SI-03, SI-04, SI-05, SC-44, SC-26, RA-10, PM-16, SC-35 (85%)
- Annex1.14 Anti-Phishing: SI-08, AT-02, AT-06, SC-07 (78%)
- Annex1.15 Data Leak Prevention Strategy: SC-07, SC-28, AC-04, MP-04, AC-23, SI-19, SI-20, PT-02, PT-03 (80%)
- Annex1.16 Maintenance, Monitoring and Analysis of Audit Logs: AU-01, AU-02, AU-03, AU-04, AU-05, AU-06, AU-07, AU-08, AU-09, AU-11, AU-12, AU-13, SI-04 (90%)
- Annex1.17 Audit Log Settings: AU-02, AU-03, AU-08, AU-09, AU-12, AU-14 (88%)
- Annex1.18 Vulnerability Assessment, Penetration Test and Red Team Exercises: CA-02, CA-08, RA-05, PM-14, RA-09, RA-10 (82%)
- Annex1.19 Incident Response and Management: IR-01, IR-02, IR-03, IR-04, IR-05, IR-06, IR-07, IR-08, IR-09 (78%)
- Annex1.20 Risk-Based Transaction Monitoring: SI-04, AU-06, AU-13, AC-04, PM-16 (65%)
- Annex1.21 Metrics: PM-06, CA-07, PM-14, PM-31 (72%)
- Annex1.22 Forensics: AU-06, AU-09, AU-10, AU-11, IR-04, IR-09 (75%)
- Annex1.23 User/Employee/Management Awareness: AT-01, AT-02, AT-03, AT-04, AT-05, AT-06, PM-13, PM-15 (85%)
- Annex1.24 Customer Education and Awareness: AT-02, PM-27, PT-06 (45%)
- ITGRCA.4 IT Governance Framework: PM-01, PM-02, PM-03, PM-09, PL-01, PL-08, PL-09 (72%)
- ITGRCA.5 Role of Board of Directors: PM-01, PM-02, PM-09, PS-09 (60%)
- ITGRCA.6 IT Strategy Committee of the Board: PM-01, PM-02, PM-07 (50%)
- ITGRCA.7 Senior Management and IT Steering Committee: PM-01, PM-02, PM-03, PM-09, PM-29 (55%)
- ITGRCA.8 Head of IT Function: PM-02, PS-09 (48%)
- ITGRCA.9 IT Services Management: CM-03, SI-02, IR-04, CA-07, SI-13, SA-09 (62%)
- ITGRCA.10 Third-Party Arrangements: SA-04, SA-09, SR-01, SR-02, SR-03, SR-05, SR-06, SA-21, PS-07, PM-30 (75%)
- ITGRCA.11 Capacity Management: AU-04, CP-02, SC-05, SI-13, PE-11 (58%)
- ITGRCA.12 Project Management: SA-03, SA-04, SA-15, PM-07, SA-20 (55%)
- ITGRCA.13 Change and Patch Management: CM-03, CM-04, CM-05, SI-02, RA-05, RA-07 (85%)
- ITGRCA.14 Data Migration Controls: CM-03, CM-04, SI-07, SA-10, MP-04, MP-05 (65%)
- ITGRCA.15 Audit Trails: AU-01, AU-02, AU-03, AU-06, AU-08, AU-09, AU-10, AU-11, AU-12, AU-14 (88%)
- ITGRCA.16 Cryptographic Controls: SC-12, SC-13, SC-08, SC-28, SC-17, IA-07 (85%)
- ITGRCA.17 Straight Through Processing: SI-07, SI-10, AC-04, AU-02 (55%)
- ITGRCA.18 Physical and Environmental Controls: PE-01, PE-02, PE-03, PE-04, PE-05, PE-06, PE-08, PE-09, PE-10, PE-11, PE-12, PE-13, PE-14, PE-15, PE-17, PE-18, PE-20 (88%)
- ITGRCA.19 Access Controls: AC-01, AC-02, AC-03, AC-04, AC-05, AC-06, AC-07, AC-11, AC-12, AC-16, AC-24, IA-01, IA-02, IA-04, IA-05, IA-06, IA-12 (90%)
- ITGRCA.20 Controls on Teleworking: AC-17, AC-19, AC-20, SC-08, SC-10, SC-23, PE-17 (82%)
- ITGRCA.21 Metrics: PM-06, CA-07, PM-14, PM-31 (70%)
- ITGRCA.22 Periodic Review of IT-Related Risks: RA-01, RA-03, RA-07, RA-09, PM-09, PM-28, CA-05 (80%)
- ITGRCA.23 IT and Information Security Risk Management Framework: PM-01, PM-09, RA-01, RA-03, PM-28, RA-07, RA-09, PL-09, PM-29, PM-30, PM-32 (82%)
- ITGRCA.24 Information Security Policy and Cyber Security Policy: PM-01, PL-01, PM-09, PM-10, PM-11, PM-24 (78%)
- ITGRCA.25 Risk Assessment: RA-01, RA-02, RA-03, RA-05, RA-07, RA-08, RA-09 (85%)
- ITGRCA.26 Vulnerability Assessment / Penetration Testing: CA-02, CA-08, RA-05, PM-14, RA-09, RA-10 (80%)
- ITGRCA.27 Cyber Incident Response and Recovery Management: IR-01, IR-02, IR-03, IR-04, IR-05, IR-06, IR-07, IR-08, CP-02, CP-10 (75%)
- ITGRCA.28 BCP and DR Policy: CP-01, CP-02, CP-03, CP-04, PM-08, PM-09, PM-11 (80%)
- ITGRCA.29 Disaster Recovery Management: CP-02, CP-04, CP-06, CP-07, CP-08, CP-09, CP-10, CP-11, CP-12, CP-13, SC-24, SI-17 (82%)
- ITGRCA.30 IS Audit: CA-02, CA-07, AU-06, CA-05, PM-14, CA-06 (72%)

## More
- A pattern's controls with their clauses in this framework: /api/v1/patterns/{id}/crosswalk?framework=rbi_csf
- Control-to-clause mappings as JSON: /api/v1/frameworks/rbi_csf?fields=mappings&per_page=100
- Rationale and gaps for each clause, as JSON: https://raw.githubusercontent.com/opensecurityarchitecture/osa-data/main/data/framework-coverage/rbi-csf.json
- Page for people: /frameworks/rbi-csf/