Azure Compliance FrameworksSpecialized Frameworks
RBI Cyber Security Framework for UCBs
The Reserve Bank of India (RBI) Cyber Security Framework for Urban Cooperative Banks (UCBs) provides baseline cybersecurity standards for urban cooperative banking institutions in India. This framework mandates implementation of security controls covering governance, risk management, IT operations, and incident response specific to the cooperative banking sector. It applies to all Urban Cooperative Banks regulated by the Reserve Bank of India.
| Mandatory? | Mandatory for Urban Cooperative Banks regulated by RBI |
| Who validates? | RBI supervisory examination · No self-assessment |
| Renewal | Annual compliance reporting |
| Scope | Urban Cooperative Banks; IT systems and cybersecurity controls |
🏛 Reserve Bank of India (RBI), Department of Supervision · RBI Cyber Security Framework for UCBs (2018) Official source →
Controls by Category
Annex I (1.1) - UCBs should maintain an up-to-date business IT Asset Inventory Register containing the following fields, as a minimum: a) Details of the IT Asset (viz., hardware/software/network devices, key personnel, services, etc.), b. Details of systems where customer data are stored, c.... (8 controls)
Azure subscriptions should have at least one Application Insights resource configuredVirtual machines should use an approved custom imageVirtual machines should use managed disks for OS and data disksVirtual machines should have Trusted Launch enabledVirtual machines should use managed disksContainer registries should have the admin user disabledKubernetes cluster nodes should prohibit public accessKubernetes clusters should use Role-Based Access Control (RBAC)
Annex I (1.3) - Appropriately manage and provide protection within and outside UCB/network, keeping in mind how the data/information is stored, transmitted, processed, accessed and put to use within/outside the UCB's network, and level of risk they are exposed to depending on the sensitivity of... (33 controls)
App Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessApp Service function apps should have public access restrictions configuredApp Service web apps should use the latest TLS versionApp Service web apps should require HTTPS for all accessContainer registries should have public network access disabledContainer registries should use private linkCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesKey vault keys should have automatic rotation enabledKey vaults should have Role-Based Access Control (RBAC) enabledAzure Key Vaults should use private linkKey vaults should have public network access disabledKubernetes clusters should have public access restrictions configuredStorage accounts containing operational log containers should use customer-managed keys for encryptionMySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higherMySQL flexible servers should have 'require_secure_transport' set to 'ON'Network security groups should have SSH access from the internet restrictedPostgreSQL flexible servers should have 'require_secure_transport' set to 'ON'Azure Cognitive Search services should have public network access disabledSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)SQL databases should have transparent data encryption enabledSQL servers should use customer-managed keys to encrypt data at restSQL databases should have Transparent Data Encryption enabledStorage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use customer-managed key for encryptionStorage accounts should have 'Minimum TLS version' set to 'Version 1.2'Storage accounts should use virtual network rules to restrict network accessStorage accounts should have secure transfer enabledStorage accounts should use private link
Annex I (12) - Take periodic back up of the important data and store this data 'off line' (i.e., transferring important files to a storage device that can be detached from a computer/system after copying all the files). (10 controls)
Virtual machines should be protected by Azure BackupVirtual machine backup policies should have daily retention set to the configured minimum or moreKey vaults should have deletion protection enabledKey vaults should have soft delete enabledSQL servers should have vulnerability assessment enabledSQL servers should have VA 'Periodic Recurring Scans' enabledStorage accounts should have blob versioning enabledAzure Blob Storage accounts should have soft delete enabled for containersAzure file shares should have soft delete enabledStorage accounts should have geo-redundant storage enabled
Annex I (5.1) - The firewall configurations should be set to the highest security level and evaluation of critical device (such as firewall, network switches, security devices, etc.) configurations should be done periodically. (11 controls)
Network security groups should prohibit inbound HTTP (port 80) access from the internetKubernetes clusters should have network policy enabledAzure subscriptions should have at least one Azure Bastion hostNetwork security groups should have RDP access restrictions configuredNetwork security groups should have SSH access from the internet restrictedNetwork security groups should have UDP services restricted from the internetAzure subscriptions should have Network Watcher enabledFlow log resources should have flow logging enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network access
Annex I (6) - Put in place systems and processes to identify, track, manage and monitor the status of patches to servers, operating system and application software running at the systems used by the UCB officials (end-users). Implement and update antivirus protection for all servers and... (21 controls)
App Service web apps should use the latest 'Java version' when Java is part of the appApp Service web apps should use the latest 'PHP version' when PHP is part of the appApp Service web apps should use the latest 'Python version' when Python is part of the appVirtual machines should have endpoint protection installedRunning container images should have no unresolved vulnerabilitiesVirtual machines should be protected by Azure BackupVirtual machines should have system updates installedVirtual machines should have a vulnerability assessment solution enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Azure Cosmos DB enabledAzure subscriptions should have Microsoft Defender for Databases enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Microsoft Defender for open-source relational databases enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledAzure subscriptions should have Microsoft Defender for Cloud container image scanning enabled
Annex I (7.1) - Disallow administrative rights on end-user workstations/PCs/laptops and provide access rights on a 'need to know' and 'need to do' basis. (11 controls)
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'Function app managed identities should not have Owner, Contributor, User Access Administrator, or RBAC Administrator rolesMicrosoft Entra ID tenants should limit Global Administrators to fewer than 5Azure subscriptions should have a custom role for administering resource locksAzure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsAzure subscriptions should restrict use of the 'User Access Administrator' roleMicrosoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'
Annex I (7.2) - Passwords should be set as complex and lengthy and users should not use same passwords for all the applications/systems/devices. (12 controls)
Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'Azure Service Management API should require multifactor authenticationMicrosoft Entra ID tenants should have 'security defaults' enabledNon-privileged Microsoft Entra ID users should have multifactor authentication enabledPrivileged Microsoft Entra ID users should have multifactor authentication enabledMicrosoft Entra ID users with VM access should have multifactor authentication enabledPostgreSQL flexible servers should have Microsoft Entra ID authentication enabledCosmos DB accounts should have 'Access Control' configured to use Azure Active Directory (AAD) and Role-Based Access Control (RBAC)Microsoft Entra ID conditional access policies should have trusted locations configuredSQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
Annex I (7.3) - Remote Desktop Protocol (RDP) which allows others to access the computer remotely over a network or over the internet should be always disabled and should be enabled only with the approval of the authorised officer of the UCB. Logs for such remote access shall be enabled and... (4 controls)
Annex I (7.4) - Implement appropriate (e.g. centralised) systems and controls to allow, manage, log and monitor privileged/super user/administrative access to critical systems (servers/databases, applications, network devices etc.) (18 controls)
App Service apps should have 'HTTP logs' enabledFunction apps should have Application Insights enabledAzure subscriptions should have an Activity Log alert for Service Health incidentsKey vaults should have resource logs enabledAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy AssignmentMicrosoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact emailMicrosoft Defender for Cloud should have Microsoft Defender for Cloud Apps (MCAS) integration selectedAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledSecurity Center should have Windows Defender ATP (WDATP) integration selectedSQL servers should have auditing enabledSQL servers should have 'Auditing' retention set to greater than 90 daysSQL servers auditing to storage accounts should have retention set to 90 days or more
Related Frameworks
NIS2 Directive (EU 2022/2555) — 🟢 High overlap (83%)
BSI C5:2025 — 🟢 High overlap (81%)
CIS Azure Benchmark v2.1.0 — 🟢 High overlap (77%)