RBI IT Framework for NBFCs

ActiveSpecialized framework

The Reserve Bank of India (RBI) Information Technology Framework for Non-Banking Financial Companies (NBFCs) establishes IT governance, security, and risk management requirements for non-banking financial institutions in India. This framework covers areas including IT strategy, cybersecurity, business continuity, and outsourcing arrangements for NBFCs. It applies to all deposit-taking and systemically important non-deposit taking NBFCs regulated by the Reserve Bank of India.

Mandatory?	Mandatory for deposit-taking and systemically important NBFCs regulated by RBI
Who validates?	RBI supervisory examination. No self-assessment.
Renewal	Annual compliance reporting
Scope	Non-Banking Financial Companies; IT governance and security
Governing body	Reserve Bank of India, RBI IT Framework for NBFCs (2017). Official source

Controls by category

95 controls are Mapped to RBI IT Framework for NBFCs.

1 IT Governance

Control	Status
Virtual machines should have system updates installed	Mapped
Virtual machines should have a vulnerability assessment solution enabled	Mapped
Kubernetes clusters should use a non-vulnerable Kubernetes version	Mapped
SQL managed instances should have vulnerability assessment enabled	Mapped
Subscriptions should have a contact email address for security issues	Mapped
Azure subscriptions should have email notifications for high severity alerts enabled	Mapped
Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled	Mapped
SQL databases should have vulnerability findings resolved	Mapped
SQL servers should have vulnerability assessment enabled	Mapped

1.1 IT Governance

Control	Status
Virtual machines should use just-in-time network access control for management ports	Mapped
Virtual machine network interfaces should have IP forwarding disabled	Mapped
Virtual machines should have management ports closed	Mapped

3 Information Security

Control	Status
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped

3.1.a Identification and Classification of Information Assets

Control	Status
Azure subscriptions should not have blocked accounts with read and write permissions	Mapped
Azure subscriptions should not have blocked accounts with owner permissions	Mapped
Azure subscriptions should not have guest accounts with owner permissions	Mapped
Azure subscriptions should not have guest accounts with read permissions	Mapped
Azure subscriptions should not have guest accounts with write permissions	Mapped
Custom RBAC roles should not be used	Mapped

3.1.b Segregation of Functions

Control	Status
App Service apps should have remote debugging disabled	Mapped
Function apps should have 'Client Certificates (Incoming client certificates)' enabled	Mapped
Function apps should have remote debugging disabled	Mapped
Virtual machines should use system-assigned managed identity with the Guest Configuration extension	Mapped

3.1.c Role based Access Control

Control	Status
Virtual machines should use just-in-time network access control for management ports	Mapped
Azure subscriptions should not have blocked accounts with read and write permissions	Mapped
Azure subscriptions should not have blocked accounts with owner permissions	Mapped
Azure subscriptions should not have guest accounts with owner permissions	Mapped
Azure subscriptions should not have guest accounts with read permissions	Mapped
Azure subscriptions should not have guest accounts with write permissions	Mapped
Azure subscriptions should limit owners to 3	Mapped
Azure subscriptions should have more than one owner	Mapped
Azure subscriptions should have a log profile for Activity Log	Mapped
Subscriptions should have a contact email address for security issues	Mapped
Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled	Mapped

3.1.f Maker-checker

Control	Status
Azure subscriptions should not have blocked accounts with read and write permissions	Mapped
Azure subscriptions should not have blocked accounts with owner permissions	Mapped
Azure subscriptions should not have guest accounts with owner permissions	Mapped
Azure subscriptions should not have guest accounts with read permissions	Mapped
Azure subscriptions should not have guest accounts with write permissions	Mapped
Custom RBAC roles should not be used	Mapped
Azure subscriptions should limit owners to 3	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Microsoft Defender for open-source relational databases enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Subscriptions should have a contact email address for security issues	Mapped
Azure subscriptions should have email notifications for high severity alerts enabled	Mapped
Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled	Mapped
Unprotected Azure SQL servers should have Azure Defender for SQL enabled	Mapped

3.1.g Trails

Control	Status
Application Insights components should prohibit log ingestion and querying from public networks	Mapped
Application Insights components should have a Log Analytics workspace configured for Azure Monitor Logs	Mapped
Virtual machines should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped
Linux virtual machines should have the network traffic data collection agent installed	Mapped
Windows virtual machines should have the network traffic data collection agent installed	Mapped
Virtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped
Azure subscriptions should limit owners to 3	Mapped
Log Analytics workspaces should prohibit log ingestion and querying from public networks	Mapped
Log Analytics workspaces should prohibit ingestion that is not based on Azure Active Directory	Mapped
Azure subscriptions should have a log profile for Activity Log	Mapped
Azure Monitor log profiles should have log collection enabled for 'write', 'delete', and 'action' categories	Mapped
Azure Monitor should have activity log collection enabled for all regions	Mapped
Monitor log profiles should have retention set to 365 days or greater	Mapped
Storage accounts containing activity log containers should use customer-managed keys for encryption	Mapped
Network security groups should have flow logs configured	Mapped
Flow log resources should have flow logging enabled	Mapped
Network Watcher flow logs should have traffic analytics enabled	Mapped
PostgreSQL servers should have 'log_checkpoints' set to 'ON'	Mapped
PostgreSQL servers should have 'log_connections' set to 'ON'	Mapped
PostgreSQL servers should have 'log_disconnections' set to 'ON'	Mapped
PostgreSQL servers should have 'log_duration' set to 'ON'	Mapped
Azure subscriptions should have auto provisioning of the Log Analytics agent enabled	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for open-source relational databases enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
SQL servers auditing to storage accounts should have retention set to 90 days or more	Mapped
Unprotected Azure SQL servers should have Azure Defender for SQL enabled	Mapped

3.1.h Public Key Infrastructure (PKI)

Control	Status
App Configuration stores should have encryption enabled	Mapped
App Service environments should have internal encryption enabled	Mapped
App Service apps should use the latest TLS version	Mapped
App Service API apps should require HTTPS for all access	Mapped
Function apps should use the latest TLS version	Mapped
Function apps should require HTTPS for all access	Mapped
Automation account variables should have encryption enabled	Mapped
Key vaults should have a firewall enabled	Mapped
Key vaults should have deletion protection enabled	Mapped
Key Vault secrets should have an expiration date	Mapped
Key vaults should have soft delete enabled	Mapped
Azure Key Vaults should use private link	Mapped
Azure Data Explorer clusters should have disk encryption enabled	Mapped
MySQL servers should use customer-managed keys to encrypt data at rest	Mapped
MySQL servers should have infrastructure encryption enabled	Mapped
MySQL servers should have 'Enforce SSL connection' enabled	Mapped
PostgreSQL servers should use customer-managed keys to encrypt data at rest	Mapped
PostgreSQL servers should have 'Enforce SSL connection' enabled	Mapped
PostgreSQL servers should have infrastructure encryption enabled	Mapped
SQL databases should have Transparent Data Encryption enabled	Mapped
Storage accounts should use customer-managed key for encryption	Mapped
Storage account encryption scopes should use customer-managed keys to encrypt data at rest	Mapped
Storage accounts should have infrastructure encryption enabled	Mapped
Storage accounts should have secure transfer enabled	Mapped

3.3 Vulnerability Management

Control	Status
Virtual machines should have system updates installed	Mapped
Virtual machines should have a vulnerability assessment solution enabled	Mapped
Kubernetes clusters should use a non-vulnerable Kubernetes version	Mapped
SQL managed instances should have vulnerability assessment enabled	Mapped
SQL databases should have vulnerability findings resolved	Mapped
SQL servers should have vulnerability assessment enabled	Mapped
Synapse workspaces should have vulnerability assessment enabled	Mapped

3.8 Digital Signatures

Control	Status
Function apps should have 'Client Certificates (Incoming client certificates)' enabled	Mapped
App Service apps should have 'Client Certificates (Incoming client certificates)' enabled	Mapped

4.2 IT Operations

Control	Status
Linux virtual machines should have the network traffic data collection agent installed	Mapped

4.4.a IT Operations

Control	Status
Virtual machines should have a vulnerability assessment solution enabled	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped

4.4.b IT Operations

Control	Status
Linux virtual machines should have the network traffic data collection agent installed	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped

5 Policy for Information System Audit (IS Audit)

Control	Status
Application gateways should have Web Application Firewall (WAF) enabled	Mapped
Application gateways should use the specified Web Application Firewall (WAF) mode	Mapped
Virtual machines should have all network ports restricted by their associated network security groups	Mapped
Internet-facing virtual machines should use network security groups for protection	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Azure Front Door services should have Web Application Firewall (WAF) enabled	Mapped
Virtual machine network interfaces should have IP forwarding disabled	Mapped
Subnets should have a network security group configured	Mapped
Network security groups should have flow logs configured	Mapped
Flow log resources should have flow logging enabled	Mapped

5.2 Policy for Information System Audit (IS Audit)

Control	Status
MariaDB servers should have geo-redundant backup enabled	Mapped
MySQL servers should have geo-redundant backup enabled	Mapped
PostgreSQL servers should have geo-redundant backup enabled	Mapped

6 Business Continuity Planning (BCP) and Disaster Recovery

Control	Status
Virtual machines should have disaster recovery configured	Mapped
MariaDB servers should have geo-redundant backup enabled	Mapped
MySQL servers should have geo-redundant backup enabled	Mapped
PostgreSQL servers should have geo-redundant backup enabled	Mapped
Recovery Services vaults should use private link	Mapped
Azure Recovery Services vaults should use private link for backup	Mapped
Azure SQL databases should have long-term geo-redundant backup enabled	Mapped

6.2 Recovery strategy / Contingency Plan

Control	Status
Virtual machines should have disaster recovery configured	Mapped
MariaDB servers should have geo-redundant backup enabled	Mapped
MySQL servers should have geo-redundant backup enabled	Mapped
PostgreSQL servers should have geo-redundant backup enabled	Mapped
Azure Recovery Services vaults should use private link for backup	Mapped
Azure SQL databases should have long-term geo-redundant backup enabled	Mapped

6.3 Recovery strategy / Contingency Plan

Control	Status
MariaDB servers should have geo-redundant backup enabled	Mapped
MySQL servers should have geo-redundant backup enabled	Mapped
PostgreSQL servers should have geo-redundant backup enabled	Mapped
Azure Recovery Services vaults should use private link for backup	Mapped
Azure SQL databases should have long-term geo-redundant backup enabled	Mapped

6.4 Recovery strategy / Contingency Plan

Control	Status
Virtual machines should have disaster recovery configured	Mapped
Recovery Services vaults should use private link	Mapped
Azure Recovery Services vaults should use private link for backup	Mapped

Framework	Control overlap	Note
FedRAMP High	High 76%
NIST SP 800-53 Rev 5	High 75%
NIST SP 800-171 Rev 2	High 74%