RBI Cyber Security Framework for UCBs

ActiveSpecialized framework

The Reserve Bank of India (RBI) Cyber Security Framework for Urban Cooperative Banks (UCBs) provides baseline cybersecurity standards for urban cooperative banking institutions in India. This framework mandates implementation of security controls covering governance, risk management, IT operations, and incident response specific to the cooperative banking sector. It applies to all Urban Cooperative Banks regulated by the Reserve Bank of India.

Mandatory?	Mandatory for Urban Cooperative Banks regulated by RBI
Who validates?	RBI supervisory examination. No self-assessment.
Renewal	Annual compliance reporting
Scope	Urban Cooperative Banks; IT systems and cybersecurity controls
Governing body	Reserve Bank of India (RBI), RBI Cyber Security Framework for UCBs (2018). Official source

Controls by category

121 controls are Mapped to RBI Cyber Security Framework for UCBs.

Annex I (1.1) - UCBs should maintain an up-to-date business IT Asset Inventory Register containing the following fields, as a minimum: a) Details of the IT Asset (viz., hardware/software/network devices, key personnel, services, etc.), b. Details of systems where customer data are stored, c....

Control	Status
Azure subscriptions should have at least one Application Insights resource configured	Mapped
Virtual machines should use an approved custom image	Mapped
Virtual machines should use managed disks for OS and data disks	Mapped
Virtual machines should have Trusted Launch enabled	Mapped
Virtual machines should use managed disks	Mapped
Container registries should have the admin user disabled	Mapped
Kubernetes cluster nodes should prohibit public access	Mapped
Kubernetes clusters should use Role-Based Access Control (RBAC)	Mapped

Annex I (1.3) - Appropriately manage and provide protection within and outside UCB/network, keeping in mind how the data/information is stored, transmitted, processed, accessed and put to use within/outside the UCB's network, and level of risk they are exposed to depending on the sensitivity of...

Control	Status
App Service apps should use the latest TLS version	Mapped
App Service API apps should require HTTPS for all access	Mapped
App Service function apps should have public access restrictions configured	Mapped
App Service web apps should use the latest TLS version	Mapped
App Service web apps should require HTTPS for all access	Mapped
Container registries should have public network access disabled	Mapped
Container registries should use private link	Mapped
Cosmos DB accounts should use private link	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Key vault keys should have automatic rotation enabled	Mapped
Key vaults should have Role-Based Access Control (RBAC) enabled	Mapped
Azure Key Vaults should use private link	Mapped
Key vaults should have public network access disabled	Mapped
Kubernetes clusters should have public access restrictions configured	Mapped
Storage accounts containing operational log containers should use customer-managed keys for encryption	Mapped
MySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higher	Mapped
MySQL flexible servers should have 'require_secure_transport' set to 'ON'	Mapped
Network security groups should have SSH access from the internet restricted	Mapped
PostgreSQL flexible servers should have 'require_secure_transport' set to 'ON'	Mapped
Azure Cognitive Search services should have public network access disabled	Mapped
SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)	Mapped
SQL databases should have transparent data encryption enabled	Mapped
SQL servers should use customer-managed keys to encrypt data at rest	Mapped
SQL databases should have Transparent Data Encryption enabled	Mapped
Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'	Mapped
Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption	Mapped
Storage accounts should have the default network access rule set to deny	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use customer-managed key for encryption	Mapped
Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped
Storage accounts should have secure transfer enabled	Mapped
Storage accounts should use private link	Mapped

Annex I (12) - Take periodic back up of the important data and store this data 'off line' (i.e., transferring important files to a storage device that can be detached from a computer/system after copying all the files).

Control	Status
Virtual machines should be protected by Azure Backup	Mapped
Virtual machine backup policies should have daily retention set to the configured minimum or more	Mapped
Key vaults should have deletion protection enabled	Mapped
Key vaults should have soft delete enabled	Mapped
SQL servers should have vulnerability assessment enabled	Mapped
SQL servers should have VA 'Periodic Recurring Scans' enabled	Mapped
Storage accounts should have blob versioning enabled	Mapped
Azure Blob Storage accounts should have soft delete enabled for containers	Mapped
Azure file shares should have soft delete enabled	Mapped
Storage accounts should have geo-redundant storage enabled	Mapped

Annex I (5.1) - The firewall configurations should be set to the highest security level and evaluation of critical device (such as firewall, network switches, security devices, etc.) configurations should be done periodically.

Control	Status
Network security groups should prohibit inbound HTTP (port 80) access from the internet	Mapped
Kubernetes clusters should have network policy enabled	Mapped
Azure subscriptions should have at least one Azure Bastion host	Mapped
Network security groups should have RDP access restrictions configured	Mapped
Network security groups should have SSH access from the internet restricted	Mapped
Network security groups should have UDP services restricted from the internet	Mapped
Azure subscriptions should have Network Watcher enabled	Mapped
Flow log resources should have flow logging enabled	Mapped
Storage accounts should have the default network access rule set to deny	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped

Annex I (6) - Put in place systems and processes to identify, track, manage and monitor the status of patches to servers, operating system and application software running at the systems used by the UCB officials (end-users). Implement and update antivirus protection for all servers and...

Control	Status
App Service web apps should use the latest 'Java version' when Java is part of the app	Mapped
App Service web apps should use the latest 'PHP version' when PHP is part of the app	Mapped
App Service web apps should use the latest 'Python version' when Python is part of the app	Mapped
Virtual machines should have endpoint protection installed	Mapped
Running container images should have no unresolved vulnerabilities	Mapped
Virtual machines should be protected by Azure Backup	Mapped
Virtual machines should have system updates installed	Mapped
Virtual machines should have a vulnerability assessment solution enabled	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure Cosmos DB enabled	Mapped
Azure subscriptions should have Microsoft Defender for Databases enabled	Mapped
Azure subscriptions should have Azure Defender for DNS enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Microsoft Defender for open-source relational databases enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Azure subscriptions should have Microsoft Defender for Cloud container image scanning enabled	Mapped

Annex I (7.1) - Disallow administrative rights on end-user workstations/PCs/laptops and provide access rights on a 'need to know' and 'need to do' basis.

Control	Status
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'	Mapped
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'	Mapped
Function app managed identities should not have Owner, Contributor, User Access Administrator, or RBAC Administrator roles	Mapped
Microsoft Entra ID tenants should limit Global Administrators to fewer than 5	Mapped
Azure subscriptions should have a custom role for administering resource locks	Mapped
Azure subscriptions should prohibit Custom Subscription Administrator roles	Mapped
Custom roles should not grant overly permissive subscription permissions	Mapped
Azure subscriptions should restrict use of the 'User Access Administrator' role	Mapped
Microsoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'	Mapped
Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'	Mapped
Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'	Mapped

Annex I (7.2) - Passwords should be set as complex and lengthy and users should not use same passwords for all the applications/systems/devices.

Control	Status
Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'	Mapped
Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'	Mapped
Azure Service Management API should require multifactor authentication	Mapped
Microsoft Entra ID tenants should have 'security defaults' enabled	Mapped
Non-privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Microsoft Entra ID users with VM access should have multifactor authentication enabled	Mapped
PostgreSQL flexible servers should have Microsoft Entra ID authentication enabled	Mapped
Cosmos DB accounts should have 'Access Control' configured to use Azure Active Directory (AAD) and Role-Based Access Control (RBAC)	Mapped
Microsoft Entra ID conditional access policies should have trusted locations configured	Mapped
SQL servers should have a Microsoft Entra ID admin configured	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

Annex I (7.3) - Remote Desktop Protocol (RDP) which allows others to access the computer remotely over a network or over the internet should be always disabled and should be enabled only with the approval of the authorised officer of the UCB. Logs for such remote access shall be enabled and...

Control	Status
Virtual machines should use just-in-time network access control for management ports	Mapped
Linux machines should require SSH keys for authentication	Mapped
Azure subscriptions should have at least one Azure Bastion host	Mapped
Network security groups should have RDP access restrictions configured	Mapped

Annex I (7.4) - Implement appropriate (e.g. centralised) systems and controls to allow, manage, log and monitor privileged/super user/administrative access to critical systems (servers/databases, applications, network devices etc.)

Control	Status
App Service apps should have 'HTTP logs' enabled	Mapped
Function apps should have Application Insights enabled	Mapped
Azure subscriptions should have an Activity Log alert for Service Health incidents	Mapped
Key vaults should have resource logs enabled	Mapped
Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs	Mapped
Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group	Mapped
Azure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address rule	Mapped
Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution	Mapped
Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group	Mapped
Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment	Mapped
Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email	Mapped
Microsoft Defender for Cloud should have Microsoft Defender for Cloud Apps (MCAS) integration selected	Mapped
Azure subscriptions should have email notifications for high severity alerts enabled	Mapped
Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled	Mapped
Security Center should have Windows Defender ATP (WDATP) integration selected	Mapped
SQL servers should have auditing enabled	Mapped
SQL servers should have 'Auditing' retention set to greater than 90 days	Mapped
SQL servers auditing to storage accounts should have retention set to 90 days or more	Mapped

Framework	Control overlap	Note
NIS2 Directive (EU 2022/2555)	High 83%
BSI C5:2025	High 81%
CIS Azure Benchmark v2.1.0	High 77%