RBI IT Framework for NBFCs
Best for: All deposit-taking NBFCs and systemically important non-deposit taking NBFCs (NBFC-ND-SI) with asset size of 500 crore INR and above, as regulated by the Reserve Bank of India. If your organization holds an NBFC license from RBI and meets the asset threshold, this framework applies. Core investment companies, infrastructure finance companies, and microfinance institutions registered as NBFCs also fall within scope.
| Mandatory? | Mandatory for deposit-taking and systemically important NBFCs regulated by RBI |
| Who validates? | RBI supervisory examination · No self-assessment |
| Renewal | Annual compliance reporting |
| Scope | Non-Banking Financial Companies; IT governance and security |
🏛 Reserve Bank of India (RBI), Department of Non-Banking Regulation · RBI IT Framework for NBFCs (2017) Official source →
Get Started
module "..." {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}What Compliance.tf Covers vs. What You Handle
What Compliance.tf automates
- Audit Trail and Log Retention: Verifies CloudTrail coverage across regions, integration with CloudWatch Logs, S3 data event capture, and a 365-day minimum retention policy on log groups. CodeBuild and API Gateway stage logging are also checked. Seven controls total.
- Backup and Recovery: Six controls covering EBS and DynamoDB backup plan enrollment, 35-day minimum retention, point-in-time recovery enablement, and protection against manual recovery point deletion.
- Network Exposure Prevention: Three controls: launch configurations must not assign public IPs, DMS replication instances must not be publicly accessible, and EBS snapshots must not be publicly restorable.
- Encryption in Transit: Checks ACM certificate expiry (flags certs expiring within 30 days) and SSL certificate enforcement on API Gateway stages. Two controls.
- Infrastructure Availability: Confirms health check configuration on Auto Scaling groups behind load balancers and DynamoDB auto-scaling status. Two controls.
What you handle
- Audit Trail and Log Retention: Log review procedures and SIEM alerting rules are yours to define. So is the incident escalation workflow and the audit trail report presented to the Board or IT Strategy Committee.
- Backup and Recovery: Periodic DR drills, Board-approved RTO and RPO documentation, restore procedure testing, and the written BCP/DR plan the framework requires.
- Network Exposure Prevention: Network architecture documentation, VPC flow logs, firewall rules, and periodic penetration testing all sit outside the automated checks. The framework also requires documented segmentation between production and non-production environments.
- Encryption in Transit: Certificate lifecycle management process, encryption at rest for databases and storage, and the overall encryption policy document required by the information security framework.
- Infrastructure Availability: Service SLAs, capacity planning documentation, and availability metric reporting to the IT Strategy Committee.
Controls by Category
Audit Logging and Monitoring (5 controls)
Missing CloudTrail coverage in secondary regions and log groups with sub-365-day retention are the most common findings in this category. Assessors examine whether audit trails are tamper-resistant, span all environments, and are retained long enough to support forensic investigation. The framework's IT audit section treats log availability as a first-order control objective.
compliance.tf moduleCodeBuild projects should have logging enabledBusiness Continuity and Disaster Recovery (2 controls)
A Board-approved BCP and DR plan is the baseline requirement. Assessors then verify that backup policies cover all critical data stores, that recovery points are protected against manual deletion (an insider risk control), and that point-in-time recovery is enabled on transactional databases. Failing to include secondary data stores in backup plans is the most common gap.
Encryption and Certificate Management (1 control)
Expired certificates on API endpoints are a recurring finding and easy to miss without active monitoring. Verify ACM expiry alerting is in place and that all API Gateway stages enforce SSL before an assessor surfaces this gap. The framework expects encryption across all sensitive data in transit, with particular weight on customer-facing channels.
Network Security and Access Restriction (1 control)
The review is straightforward: are any resources publicly accessible that should not be? DMS replication instances and public EBS snapshots are specific data leakage vectors the framework's information security section addresses through network segmentation and access restriction requirements.
Additional Controls (51)
AWS Lambda (3)
Amazon EC2 (5)
compliance.tf moduleEC2 instances should have EBS optimization enabledcompliance.tf moduleEC2 instances should have IAM profile attachedcompliance.tf moduleEC2 instances should be in a VPCcompliance.tf moduleEC2 instances should not have a public IP addresscompliance.tf moduleAmazon EFS (2)
Amazon ElastiCache (1)
Amazon OpenSearch Service (3)
Amazon RDS (7)
compliance.tf moduleRDS DB instance automatic minor version upgrade should be enabledcompliance.tf moduleRDS DB instance backup should be enabledcompliance.tf moduleRDS DB instances should have deletion protection enabledcompliance.tf moduleRDS DB instances should have logging enabledcompliance.tf moduleRDS DB instances should have multiple AZ enabledcompliance.tf moduleRDS DB instances should prohibit public accesscompliance.tf moduleAmazon Redshift (6)
compliance.tf moduleRedshift clusters should have automatic snapshots enabledcompliance.tf moduleRedshift cluster encryption in transit should be enabledcompliance.tf moduleRedshift clusters should have audit logging and encryption enabledcompliance.tf moduleRedshift clusters should have required maintenance settingscompliance.tf moduleRedshift clusters should prohibit public accesscompliance.tf moduleAmazon S3 (9)
compliance.tf moduleS3 buckets should have cross-region replication enabledcompliance.tf moduleS3 buckets should have logging enabledcompliance.tf moduleS3 buckets should have object lock enabledcompliance.tf moduleS3 buckets should have policies that prohibit public accesscompliance.tf moduleS3 buckets should prohibit public read accesscompliance.tf moduleS3 buckets should prohibit public write accesscompliance.tf moduleS3 buckets should have versioning enabledcompliance.tf moduleS3 public access should be blocked at bucket levelcompliance.tf moduleAmazon SageMaker (1)
Elastic Load Balancing (7)
compliance.tf moduleELB application load balancer deletion protection should be enabledcompliance.tf moduleELB application load balancers should be configured to drop HTTP headerscompliance.tf moduleELB application load balancers should drop invalid HTTP headerscompliance.tf moduleELB application and network load balancers should only use SSL or HTTPS listenerscompliance.tf moduleELB classic load balancers should have cross-zone load balancing enabledcompliance.tf moduleELB classic load balancers should span multiple availability zonescompliance.tf moduleRelated Frameworks
RBI Cyber Security Framework — 🟡 Medium overlap (55%)
The RBI Cyber Security Framework (2016) targets scheduled commercial banks rather than NBFCs but partially overlaps with this framework in areas like incident response, SOC operations, and security monitoring. NBFCs that also hold banking licenses may need to comply with both. The NBFC IT Framework draws heavily from that circular's security expectations.
NIST 800-53 Rev 5 — 🟡 Medium overlap (35%)
NIST 800-53 provides a more granular control catalog. The RBI NBFC framework's IT governance, access control, and audit logging requirements map loosely to NIST control families AU (Audit and Accountability), SC (System and Communications Protection), and CP (Contingency Planning). NIST is far more prescriptive on individual control specifications.
ISO/IEC 27001:2022 — 🟡 Medium overlap (40%)
The RBI framework explicitly references ISO 27001 as a benchmark for information security management. NBFCs with ISO 27001 certification will find roughly 40% overlap in areas like risk assessment, access control, and incident management, though the RBI framework adds India-specific governance and reporting requirements that ISO 27001 does not address.