RBI Cloud Security
Guidelines for Banks & NBFCs
Practical, actionable compliance controls for RBI-regulated entities adopting cloud. Covers IT Framework, payment data localisation, DCRSS requirements, cyber resilience, and vendor risk — mapped to cloud-specific configurations.
Key circulars: RBI IT Framework 2016, DPSS Circular Apr 2018, RBI Cyber Security Framework 2016, DCRSS 2019.
Payment Data — India Only
All end-to-end transaction data, intermediary data, and customer payment data must reside exclusively in Indian regions. No exceptions for domestic transactions.
# AWS SCP to block non-India replication
Deny: s3:PutBucketReplication if destination not ap-south-*
Deny: rds:CreateDBInstanceReadReplica if region not ap-south-*Core Banking Data Localisation
CBS, general ledger, customer master, account data — all must be hosted in India. Primary and Disaster Recovery sites both in India.
# Azure Policy — restrict to India regions only
"field": "location",
"in": ["centralindia","southindia","westindia"]Cross-Border Transfer (International Txns)
For international transactions: foreign processing allowed but copy must be deleted within 24 hours. A bring-back copy must be stored in India.
# Automate 24h deletion via lifecycle policy
# S3: Expiry rule on /intl-processing/ prefix = 1 dayEncryption at Rest — CMK
Sensitive customer and payment data must be encrypted with Customer Managed Keys (CMK/BYOK). Default cloud provider keys not sufficient for regulated data.
# AWS: aws-kms CMK for all RDS, S3, EBS
# Azure: CMK via Key Vault for Blob, SQL, VM
# GCP: CMEK for GCS, BigQuery, CloudSQLData Classification & Tagging
All cloud resources storing regulated data must be tagged with data classification. Automated policy enforcement based on tags to apply appropriate controls.
# Tag: DataClass=PII_Payment, Regulator=RBI
# Deny public access if DataClass=PII_PaymentBackup Data Localisation
Backups of regulated data must also reside in India. Cross-region backup to foreign regions not permitted. Use same-country geo-redundant storage.
# AWS Backup: Copy to ap-south-2 only (not us-east, eu-west)
# Azure: GRS within India pair (Central ↔ South India)Privileged Access Management
All privileged cloud access (cloud admin, security admin) must go through PAM solution. No standing admin access. Time-limited, approved, recorded sessions.
# AWS: IAM Identity Center + Session Manager
# Azure: PIM with JIT activation + approval
# GCP: Workload Identity + Access ApprovalNo Root/Global Admin Standing Access
AWS root account access keys must be deleted. Azure Global Admin must be PIM-protected. Break-glass accounts require hardware MFA and monitored usage.
aws iam delete-access-key --access-key-id ROOT_KEY
# Alert on: root account usage → CloudWatch → SNSMulti-Factor Authentication
MFA mandatory for all human identities — especially those accessing payment systems or customer data. TOTP minimum; FIDO2/hardware key for admin roles.
# SCP: Deny console access without MFA
{"Condition":{"BoolIfExists":{"aws:MultiFactorAuthPresent":"false"}}}Service Account Hygiene
No long-lived service account keys. Use managed identities, workload identity, or instance profiles. Rotate any existing keys within 90 days.
# GCP: Disable SA key creation via Org Policy
# AWS: Use instance profiles, not IAM user keys
# Azure: Use Managed Identities for workloadsQuarterly Access Reviews
All cloud IAM permissions must be reviewed quarterly using IAM Access Advisor / Entra ID Access Reviews. Remove unused permissions and dormant accounts.
aws iam generate-service-last-accessed-details
aws iam get-service-last-accessed-details --job-id JOBVendor Access Controls
Cloud vendor support access must be explicitly approved per-request. Never grant standing access to CSP support teams. Log all vendor access sessions.
# AWS: Support role with limited STS assume time
# Azure: Customer Lockbox enabled for all regulated workloadsNo Direct Internet Exposure
Payment processing systems must not be directly internet-facing. WAF + Load Balancer + private subnet architecture mandatory. Public IPs audited regularly.
# AWS Config Rule: ec2-instance-no-public-ip
# Alert: Any SG rule allowing 0.0.0.0/0 to port 80/443 without WAFNetwork Segmentation
Core banking, payment processing, customer data tiers must be in separate VPCs/VNets with no default cross-tier communication. Explicit allow rules only.
# AWS: Separate VPCs per tier, Transit Gateway routing
# Azure: Hub-Spoke topology with Azure Firewall
# GCP: VPC with Firewall Policies, no default routesDDoS Protection
DDoS protection mandatory for customer-facing banking applications. AWS Shield Advanced, Azure DDoS Standard, or GCP Cloud Armor Adaptive Protection required.
# AWS: Shield Advanced on ALB + CloudFront
# Azure: DDoS Standard on VNet containing public endpoints
# GCP: Cloud Armor with Adaptive Protection enabledTLS Enforcement
All in-transit data must use TLS 1.2 minimum. TLS 1.0/1.1 must be disabled. Certificate rotation automated. Internal traffic between microservices — mTLS preferred.
# AWS: ALB security policy: ELBSecurityPolicy-TLS13-1-2-2021-06
# Azure: App Gateway minimum TLS 1.2 in SSL policy
# Check: ssl-check.sh against all public endpointsPrivate Endpoints for PaaS Services
All PaaS services (databases, storage, key vaults) accessed from application tier must use private endpoints — no public internet routing of banking data.
# AWS: VPC Endpoints for S3, RDS, KMS, Secrets Manager
# Azure: Private Endpoints for SQL, Key Vault, Storage
# GCP: Private Service Connect for Cloud SQL, GCSVPC Flow Logs & Network Monitoring
Enable VPC/NSG flow logs on all payment and customer data networks. Ingest into SIEM. Alert on unexpected outbound traffic, large data transfers, unusual ports.
aws ec2 enable-vpc-classic-link-dns-support
# Baseline: normal bytes/packets per flow per hourDR in India — Mandatory
Disaster Recovery site for all RBI-regulated workloads must be in India. DR cannot be a foreign cloud region. RPO and RTO defined per criticality tier.
# AWS: ap-south-1 (Primary) + ap-south-2 (DR)
# Azure: Central India (Primary) + South India (DR)
# GCP: asia-south1 (Primary) + asia-south2 (DR)RTO/RPO for Critical Banking Systems
Core banking and payment systems must meet RBI DCRSS requirements: Critical systems RPO ≤ 4h, RTO ≤ 2h. Annual DR drills mandatory.
# Critical: RPO 4h, RTO 2h (RBI DCRSS Tier 1)
# Important: RPO 24h, RTO 4h
# DR drill: Document results, submit to BoardBackup Integrity & Testing
All backups must be verified for integrity (checksums). Restoration testing quarterly. Immutable backups for critical data using WORM storage or Object Lock.
# AWS S3 Object Lock (WORM) for audit/payment logs
# Azure Blob immutable storage for regulatory data
# Test: quarterly restore test with documented resultMulti-AZ for Production Workloads
All production banking workloads must run Multi-AZ / zone-redundant. Single-AZ deployments for regulated data not permitted. Auto-failover enabled.
# AWS RDS: Multi-AZ enabled, automated failover
# Azure SQL: Zone-redundant Always On
# GCP CloudSQL: HA replica in different zoneRansomware-Resilient Architecture
Separate backup accounts with cross-account vaulting. Break-glass recovery process. Immutable audit logs. Air-gapped DR copy at minimum quarterly frequency.
# AWS Backup Vault Lock — deny delete for 7 years
# Separate AWS account for backup vaults
# No backup admin access from prod accountChange Management Controls
All changes to production banking infrastructure require CAB approval, tested in staging, and deployed with automated rollback capability.
# CloudFormation/ARM changesets require approval
# Blue/Green or canary deployments for zero-downtime
# Rollback: automated trigger on error rate > 1%CloudTrail / Activity Log — All Regions
Multi-region CloudTrail / Azure Activity Log / GCP Audit Logs must be enabled. Global services trail mandatory. Log file validation (SHA-256) required.
aws cloudtrail create-trail --is-multi-region-trail \
--include-global-service-events \
--enable-log-file-validationTamper-Proof Log Storage
Audit logs must be stored in a separate, tamper-proof account. S3 bucket with MFA Delete, Object Lock, and restricted write access (no delete from production accounts).
# Dedicated security/audit AWS account
# S3 bucket: Block all public access, MFA Delete ON
# Object Lock: Compliance mode, 5-year retention5-Year Log Retention (RBI)
RBI requires financial records and audit logs to be retained for 5 years minimum. Payment data audit logs — 7 years for fraud investigation purposes.
# S3 Lifecycle: Hot 90d → Standard-IA 1yr → Glacier 5yr
# AWS Glue / Athena for ad-hoc forensic queries
# Azure: Log Analytics workspace + Archive tierReal-Time Alerting on Critical Events
Immediate alerts on: root/global-admin usage, MFA disabled, CloudTrail stopped, security group allows 0.0.0.0/0, IAM policy changes, data bucket made public.
# AWS: CloudWatch metric filters → SNS alerts
# CIS Benchmark alarms: all 15 critical alarms
# Azure: Defender for Cloud alerts severity High+System Audit Report (SAR) — Annual
Annual SAR must be submitted to RBI DPSS confirming data localisation, security controls, and incident report. Conducted by RBI-empanelled auditors.
# SAR evidence package: exports from CloudTrail,
# Config compliance, GuardDuty findings, IAM review
# Include: data flow diagram, architecture reviewIncident Reporting — 6 Hours
All cybersecurity incidents affecting banking systems must be reported to RBI within 6 hours of detection. Follow-up detailed report within 72 hours. RCA within 30 days.
# IR runbook: detect → isolate → report (6h) →
# contain → eradicate → RCA (30d)
# RBI portal: https://cms.rbi.org.inCloud Contract — RBI Clauses
CSP contracts must include: regulatory audit rights, data localisation confirmation, incident notification SLA, business continuity obligations, and data portability on exit.
# Required contract clauses:
# - RBI audit access (physical + logical)
# - Data stored in India confirmation
# - 24h incident notification to bank
# - Data deletion on contract terminationConcentration Risk Management
Over-reliance on a single CSP is a risk. RBI expects banks to manage cloud concentration risk with documented multi-cloud or hybrid strategy and exit plan.
# Document: primary CSP + fallback strategy
# Annual test: failover capability to alternate CSP
# Assess: % of critical workloads per CSPCSP Security Posture Assessment
Annual assessment of CSP's security posture: SOC 2 Type II, ISO 27001, CSA STAR, PCI DSS certifications. Escalate gaps to Board Risk Committee.
# AWS: aws.amazon.com/compliance/programs
# Azure: servicetrust.microsoft.com
# GCP: cloud.google.com/security/complianceSub-processor Management
Banks must know all sub-processors used by the CSP. CSP must notify before adding new sub-processors. Right to object to new sub-processors required.
# Review CSP sub-processor list quarterly
# Focus: data processing sub-processors in foreign regions
# Document approved sub-processor listExit Strategy & Portability
Documented exit strategy: timeline, data export format, destination infra, and parallel run period. Test export of all regulated data formats annually.
# Data export test: export 1TB sample dataset
# Verify: schema compatibility with new platform
# Document: estimated exit timeline and costBoard-Level Cloud Governance
Board-approved Cloud Strategy Policy required. Cloud risk appetite defined. Quarterly Board/IT Committee reporting on cloud security KPIs and incidents.
# KPIs to report: patch SLA compliance %, MFA coverage %,
# open critical findings, DR test results,
# data residency violations (target: 0)Industry-observed average compliance levels across RBI-regulated entities on cloud (2025 assessment data)
✅ RBI Cloud Compliance — Self-Assessment Tool
Select your entity type and in-scope systems. The tool generates a prioritised compliance checklist with quick-win and high-risk items called out.
| Circular / Framework | Requirement | Deadline / Status | Penalty for Non-Compliance |
|---|---|---|---|
| RBI IT Framework 2016 | IS policy, vendor mgmt, IT governance, DR/BCP for all RE | In force since 2016 | RBI supervisory action, monetary penalty |
| DPSS Circular Apr 2018 | All payment data to be stored only in India | Oct 2018 (met by major PSOs) | Licence suspension, RBI inspection |
| RBI Cyber Security Framework 2016 | Incident reporting, SOC, SIEM, threat intelligence | In force since 2016 | Regulatory censure, financial penalty |
| DCRSS 2019 | DR standards — RPO/RTO, annual drills, Tier classification | In force since 2019 | RBI audit finding, capital requirements |
| RBI Master Direction on IT 2023 | Updated IT governance, cloud adoption guidance | In force 2023 | Supervisory review, operational risk capital |
| CERT-In Directions 2022 | 6h incident reporting, 180d log retention, India ICT infra | In force Jun 2022 | Up to ₹1 Lakh/day + imprisonment |