RBI Cyber Security Framework for UCBs

ActiveSpecialized framework

Best for: All Urban Cooperative Banks (UCBs) regulated by the Reserve Bank of India, regardless of size or asset base. The RBI circular applies uniformly to scheduled and non-scheduled UCBs. If your institution holds a UCB license from RBI and operates core banking or digital payment channels, this framework applies. Technology service providers and managed security vendors serving UCBs should also align to these requirements to support their clients' compliance obligations.

Mandatory?	Mandatory for Urban Cooperative Banks regulated by RBI
Who validates?	RBI supervisory examination. No self-assessment.
Renewal	Annual compliance reporting
Scope	Urban Cooperative Banks; IT systems and cybersecurity controls
Governing body	Reserve Bank of India (RBI), Department of Supervision, RBI Cyber Security Framework for UCBs (2018). Official source

Get started

Point the module source at the RBI Cyber Security Framework for UCBs endpoint and pin a version range you reviewed:

module "..." {
  source  = "rbicybersecurity.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

rbicybersecurity.compliance.tf lists every RBI Cyber Security Framework for UCBs module with its versions, inputs and outputs.

Enforce 57 RBI Cyber Security Framework for UCBs controls with one registry endpoint change.

Start free trial Get started

What compliance.tf covers and what you handle

Area	Compliance.tf automates	You handle
Encryption at Rest	Runs controls checking DynamoDB table encryption (both default and KMS CMK), API Gateway cache encryption, and CloudTrail log encryption with customer-managed keys. Flags any resource using only default encryption when the framework expects KMS CMK.	Key rotation schedules, IAM access policies on CMKs, and a key custodian register are your responsibility. RBI expects documented key management procedures, not just the technical controls.
Encryption in Transit	Validates that API Gateway stages have SSL certificates attached and checks ACM certificate expiry within 30 days. Detects endpoints without TLS enforcement.	Procure and renew certificates before expiry, enforce minimum TLS version policies across all banking channels, and document SSL/TLS configurations for audit evidence.
Audit Trail and Logging	Checks for multi-region CloudTrail enablement, S3 data event logging (read and write), CloudWatch integration, API Gateway stage logging, and log group retention of at least 365 days.	Log review is a function, not a configuration. Your SOC or designated monitoring team owns alerting thresholds and SIEM integration. Periodic log analysis is explicitly called out in RBI's monitoring provisions.
Network Exposure Prevention	Detects Auto Scaling launch configs with public IPs enabled, DMS replication instances with public accessibility, and API Gateway stages missing WAF web ACL association.	Design and maintain network architecture diagrams, implement firewall rules beyond AWS-native controls, conduct periodic penetration testing, and document network segmentation rationale.
Backup and Disaster Recovery	Verifies DynamoDB tables are included in AWS Backup plans. Flags tables without any backup configuration.	Define recovery time objectives (RTO) and recovery point objectives (RPO) per RBI guidelines, conduct periodic DR drills, maintain offsite backup documentation, and test restoration procedures at least annually.
Governance and Account Structure	Checks whether the AWS account belongs to an AWS Organizations structure, confirming centralized governance and policy enforcement.	Establish an IT Steering Committee and a dedicated information security function as mandated by RBI. Document organizational reporting lines, define roles and responsibilities, and maintain board-approved cybersecurity policies.

Controls by category

57 of 80 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 23 are Mapped only: RBI Cyber Security Framework for UCBs lists them, no compliance.tf module checks them.

Audit Logging and Trail Management

Auditors verify that all API and infrastructure activity is logged across every region with no gaps. They expect evidence of centralized log aggregation via CloudWatch integration and will flag accounts where trails cover only a single region. Common finding: CloudTrail enabled but S3 data event logging missing, leaving object-level access unaudited.

Control	Status
CloudTrail trails should have at least one enabled trail present in a region	Mapped
CloudTrail trails should be integrated with CloudWatch logs	Mapped
API Gateway stages should have logging enabled	Mapped

Data Protection and Encryption

KMS customer-managed keys, not AWS default encryption, are what assessors want to see on DynamoDB tables, CloudTrail logs, and API Gateway cache. Valid SSL certificates on all external endpoints are checked as well. Expired or soon-to-expire ACM certificates are a recurring finding during assessments.

Control	Status
API Gateway REST API stages should have a client certificate configured	Mapped
API Gateway stages should have cache encryption at rest enabled	Mapped
CloudTrail trails should have logs encrypted using a customer managed KMS key	Mapped
DynamoDB tables should have AWS KMS encryption enabled	Enforced
DynamoDB tables should have encryption enabled	Enforced

Log Retention and Evidence Preservation

Unset retention policies on CloudWatch log groups are one of the most common findings in this category. The minimum bar is 365 days, and assessors check this directly during RBI supervisory inspections. Left unaddressed, default groups either accumulate cost indefinitely or get cleaned up, destroying the forensic record in the process.

Control	Status
CloudWatch log groups should have retention period of at least 365 days	Enforced

Network Security and Access Restrictions

RBI expects UCBs to prevent unauthorized network exposure of banking infrastructure. Auditors check that compute instances and database replication endpoints are not directly internet-accessible, and WAF association on API stages is verified to confirm protection against OWASP Top 10 threats. Legacy launch configurations that still assign public IPs are a persistent problem.

Control	Status
DMS replication instances should not be publicly accessible	Enforced

Additional controls (70)

AWS IAM (2)

Control	Status
IAM password policies should prevent password reuse	Mapped
IAM password policies should have strong configurations	Mapped

AWS KMS (1)

Control	Status
KMS CMK rotation should be enabled	Enforced

AWS Lambda (2)

Control	Status
Lambda functions should be in a VPC	Enforced
Lambda functions should restrict public URL	Enforced

Amazon CloudFront (1)

Control	Status
CloudFront distributions should use the recommended TLS security policy	Enforced

Amazon CloudWatch Logs (1)

Control	Status
Log groups should have encryption at rest enabled	Enforced

Amazon DynamoDB (1)

Control	Status
DynamoDB tables should have point-in-time recovery enabled	Enforced

Amazon EBS (1)

Control	Status
Attached EBS volumes should have encryption enabled	Enforced

Amazon EC2 (2)

Control	Status
EC2 instances should be in a VPC	Mapped
EC2 instances should not have a public IP address	Enforced

Amazon EFS (2)

Control	Status
EFS file systems should have encryption at rest enabled	Enforced
EFS file systems should be encrypted with CMK	Enforced

Amazon ElastiCache (1)

Control	Status
ElastiCache Redis clusters should have automatic backups enabled with a retention period of 15 days or greater	Enforced

Amazon OpenSearch Service (5)

Control	Status
OpenSearch domains should have audit logging enabled	Enforced
OpenSearch domains should have encryption at rest enabled	Enforced
OpenSearch domains should use HTTPS	Enforced
OpenSearch domains should have logging to CloudWatch Logs enabled	Enforced
OpenSearch domains node-to-node encryption should be enabled	Enforced

Amazon RDS (12)

Control	Status
RDS DB clusters should have automatic minor version upgrade enabled	Enforced
RDS DB instance automatic minor version upgrade should be enabled	Enforced
RDS DB instance backup should be enabled	Mapped
RDS DB instances backup retention period should be greater than or equal to 7	Enforced
RDS DB instances should be integrated with CloudWatch logs	Enforced
RDS DB instance encryption at rest should be enabled	Enforced
RDS DB instances should have logging enabled	Enforced
RDS for MariaDB DB instances should publish logs to CloudWatch Logs	Enforced
RDS DB instances should not use public subnet	Enforced
RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs	Enforced
RDS DB instances should prohibit public access	Enforced
RDS for SQL Server DB instances should publish logs to CloudWatch Logs	Enforced

Amazon Redshift (8)

Control	Status
Redshift clusters should have audit logging enabled	Enforced
Redshift clusters should have automatic snapshots enabled	Enforced
Redshift clusters should have automatic upgrades to major versions enabled	Enforced
Redshift cluster encryption in transit should be enabled	Enforced
Redshift clusters should have audit logging and encryption enabled	Enforced
Redshift clusters should have KMS encryption enabled	Enforced
Redshift clusters should have required maintenance settings	Enforced
Redshift clusters should prohibit public access	Enforced

Amazon S3 (11)

Control	Status
S3 buckets should have cross-region replication enabled	Enforced
S3 buckets should have default encryption enabled	Enforced
S3 buckets should have default encryption enabled using KMS	Enforced
S3 buckets should have logging enabled	Enforced
S3 buckets should not be accessible to all authenticated users	Enforced
S3 buckets should have object logging enabled	Mapped
S3 buckets should have policies that prohibit public access	Enforced
S3 buckets should prohibit public read access	Enforced
S3 buckets should prohibit public write access	Enforced
S3 buckets should have versioning enabled	Enforced
S3 public access should be blocked at account level	Enforced

Amazon SNS (1)

Control	Status
SNS topics should be encrypted at rest	Enforced

Amazon SageMaker (3)

Control	Status
SageMaker endpoint configuration encryption should be enabled	Mapped
SageMaker notebook instances should not have direct internet access	Mapped
SageMaker notebook instance encryption should be enabled	Mapped

Amazon VPC (3)

Control	Status
VPC security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports (IPv4)	Mapped
VPC security groups should not allow ingress from ::/0 to remote server administration ports	Mapped
VPC subnet auto assign public IP should be disabled	Enforced

Elastic Load Balancing (8)

Control	Status
ELB application and classic load balancer logging should be enabled	Enforced
ELB application load balancers should be configured to drop HTTP headers	Enforced
ELB application load balancers should drop invalid HTTP headers	Enforced
ELB application and network load balancers should use recommended security policies	Enforced
ELB application and network load balancer listeners should use ACM certificates	Enforced
ELB application and network load balancer listeners should use secure protocols	Enforced
ELB network load balancers should have TLS listener security policy configured	Mapped
ELB listeners should use approved SSL/TLS protocol versions	Mapped

Other (5)

Control	Status
Elasticsearch domains should have audit logging enabled	Mapped
ES domain encryption at rest should be enabled	Mapped
ES domains should be in a VPC	Mapped
Elasticsearch domain should send logs to CloudWatch	Mapped
Elasticsearch domain node-to-node encryption should be enabled	Mapped

Framework	Control overlap	Note
NIST SP 800-53 Rev 5	High 94%
NIST SP 800-171 Rev 2	High 93%
FedRAMP Moderate Baseline Rev 4	High 91%

Frequently asked questions

Does this framework apply to all cooperative banks or only certain categories?

It applies to all Urban Cooperative Banks (UCBs) regulated by RBI, both scheduled and non-scheduled. State cooperative banks and district central cooperative banks fall under separate NABARD guidelines, not this framework. If your banking license is from RBI and you are classified as a UCB, you must comply.

What is the compliance timeline and reporting cadence?

UCBs were expected to implement baseline controls upon issuance of the circular in December 2019. Ongoing compliance requires annual self-assessment and submission of a cyber security posture report to RBI's Regional Office. RBI supervisory inspection teams may also evaluate controls during scheduled or thematic inspections.

Is there a formal certification or just self-assessment?

RBI does not mandate third-party certification. Compliance is demonstrated through self-assessment reports submitted to RBI, internal audit findings, and evidence produced during RBI inspections. That said, many UCBs engage external IS auditors (CERT-In empaneled or CISA-certified professionals) to strengthen their assessment credibility.

How does this framework interact with RBI's broader IT governance guidelines?

This cyber security framework supplements the RBI Master Direction on Information Technology Framework for UCBs (2018). The IT Framework covers broader IT governance, IS audit, and IT service management. The cyber security circular adds specific requirements for SOC operations, incident reporting to CERT-In and RBI, vulnerability management, and advanced threat detection. Both must be addressed together.

What happens if a UCB fails to comply?

RBI can issue supervisory directions, impose monetary penalties under Section 46 of the Banking Regulation Act 1949, or restrict certain digital banking services. Repeated non-compliance may trigger enhanced supervisory scrutiny, restrictions on branch expansion, or other corrective action under RBI's Prompt Corrective Action framework for UCBs.

Enforce 57 RBI Cyber Security Framework for UCBs controls with one module source change.