Azure Compliance FrameworksSpecialized Frameworks
RBI IT Framework for NBFCs
The Reserve Bank of India (RBI) Information Technology Framework for Non-Banking Financial Companies (NBFCs) establishes IT governance, security, and risk management requirements for non-banking financial institutions in India. This framework covers areas including IT strategy, cybersecurity, business continuity, and outsourcing arrangements for NBFCs. It applies to all deposit-taking and systemically important non-deposit taking NBFCs regulated by the Reserve Bank of India.
| Mandatory? | Mandatory for deposit-taking and systemically important NBFCs regulated by RBI |
| Who validates? | RBI supervisory examination · No self-assessment |
| Renewal | Annual compliance reporting |
| Scope | Non-Banking Financial Companies; IT governance and security |
Controls by Category
1 IT Governance (9 controls)
Virtual machines should have system updates installedVirtual machines should have a vulnerability assessment solution enabledKubernetes clusters should use a non-vulnerable Kubernetes versionSQL managed instances should have vulnerability assessment enabledSubscriptions should have a contact email address for security issuesAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledSQL databases should have vulnerability findings resolvedSQL servers should have vulnerability assessment enabled
1.1 IT Governance (3 controls)
3 Information Security (1 control)
3.1.a Identification and Classification of Information Assets (6 controls)
Azure subscriptions should not have blocked accounts with read and write permissionsAzure subscriptions should not have blocked accounts with owner permissionsAzure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsCustom RBAC roles should not be used
3.1.b Segregation of Functions (4 controls)
3.1.c Role based Access Control (11 controls)
Virtual machines should use just-in-time network access control for management portsAzure subscriptions should not have blocked accounts with read and write permissionsAzure subscriptions should not have blocked accounts with owner permissionsAzure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsAzure subscriptions should limit owners to 3Azure subscriptions should have more than one ownerAzure subscriptions should have a log profile for Activity LogSubscriptions should have a contact email address for security issuesAzure subscriptions should have email notifications to subscription owners for high severity alerts enabled
3.1.f Maker-checker (19 controls)
Azure subscriptions should not have blocked accounts with read and write permissionsAzure subscriptions should not have blocked accounts with owner permissionsAzure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsCustom RBAC roles should not be usedAzure subscriptions should limit owners to 3Azure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Microsoft Defender for open-source relational databases enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledSubscriptions should have a contact email address for security issuesAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
3.1.g Trails (31 controls)
Application Insights components should prohibit log ingestion and querying from public networksApplication Insights components should have a Log Analytics workspace configured for Azure Monitor LogsVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringAzure subscriptions should limit owners to 3Log Analytics workspaces should prohibit log ingestion and querying from public networksLog Analytics workspaces should prohibit ingestion that is not based on Azure Active DirectoryAzure subscriptions should have a log profile for Activity LogAzure Monitor log profiles should have log collection enabled for 'write', 'delete', and 'action' categoriesAzure Monitor should have activity log collection enabled for all regionsMonitor log profiles should have retention set to 365 days or greaterStorage accounts containing activity log containers should use customer-managed keys for encryptionNetwork security groups should have flow logs configuredFlow log resources should have flow logging enabledNetwork Watcher flow logs should have traffic analytics enabledPostgreSQL servers should have 'log_checkpoints' set to 'ON'PostgreSQL servers should have 'log_connections' set to 'ON'PostgreSQL servers should have 'log_disconnections' set to 'ON'PostgreSQL servers should have 'log_duration' set to 'ON'Azure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for open-source relational databases enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledSQL servers auditing to storage accounts should have retention set to 90 days or moreUnprotected Azure SQL servers should have Azure Defender for SQL enabled
3.1.h Public Key Infrastructure (PKI) (24 controls)
App Configuration stores should have encryption enabledApp Service environments should have internal encryption enabledApp Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessFunction apps should use the latest TLS versionFunction apps should require HTTPS for all accessAutomation account variables should have encryption enabledKey vaults should have a firewall enabledKey vaults should have deletion protection enabledKey Vault secrets should have an expiration dateKey vaults should have soft delete enabledAzure Key Vaults should use private linkAzure Data Explorer clusters should have disk encryption enabledMySQL servers should use customer-managed keys to encrypt data at restMySQL servers should have infrastructure encryption enabledMySQL servers should have 'Enforce SSL connection' enabledPostgreSQL servers should use customer-managed keys to encrypt data at restPostgreSQL servers should have 'Enforce SSL connection' enabledPostgreSQL servers should have infrastructure encryption enabledSQL databases should have Transparent Data Encryption enabledStorage accounts should use customer-managed key for encryptionStorage account encryption scopes should use customer-managed keys to encrypt data at restStorage accounts should have infrastructure encryption enabledStorage accounts should have secure transfer enabled
3.3 Vulnerability Management (7 controls)
Virtual machines should have system updates installedVirtual machines should have a vulnerability assessment solution enabledKubernetes clusters should use a non-vulnerable Kubernetes versionSQL managed instances should have vulnerability assessment enabledSQL databases should have vulnerability findings resolvedSQL servers should have vulnerability assessment enabledSynapse workspaces should have vulnerability assessment enabled
3.8 Digital Signatures (2 controls)
4.2 IT Operations (1 control)
4.4.a IT Operations (3 controls)
4.4.b IT Operations (2 controls)
5 Policy for Information System Audit (IS Audit) (10 controls)
Application gateways should have Web Application Firewall (WAF) enabledApplication gateways should use the specified Web Application Firewall (WAF) modeVirtual machines should have all network ports restricted by their associated network security groupsInternet-facing virtual machines should use network security groups for protectionAzure Cosmos DB accounts should have firewall rulesAzure Front Door services should have Web Application Firewall (WAF) enabledVirtual machine network interfaces should have IP forwarding disabledSubnets should have a network security group configuredNetwork security groups should have flow logs configuredFlow log resources should have flow logging enabled
5.2 Policy for Information System Audit (IS Audit) (3 controls)
6 Business Continuity Planning (BCP) and Disaster Recovery (7 controls)
Virtual machines should have disaster recovery configuredMariaDB servers should have geo-redundant backup enabledMySQL servers should have geo-redundant backup enabledPostgreSQL servers should have geo-redundant backup enabledRecovery Services vaults should use private linkAzure Recovery Services vaults should use private link for backupAzure SQL databases should have long-term geo-redundant backup enabled
6.2 Recovery strategy / Contingency Plan (6 controls)
Virtual machines should have disaster recovery configuredMariaDB servers should have geo-redundant backup enabledMySQL servers should have geo-redundant backup enabledPostgreSQL servers should have geo-redundant backup enabledAzure Recovery Services vaults should use private link for backupAzure SQL databases should have long-term geo-redundant backup enabled
6.3 Recovery strategy / Contingency Plan (5 controls)
MariaDB servers should have geo-redundant backup enabledMySQL servers should have geo-redundant backup enabledPostgreSQL servers should have geo-redundant backup enabledAzure Recovery Services vaults should use private link for backupAzure SQL databases should have long-term geo-redundant backup enabled
6.4 Recovery strategy / Contingency Plan (3 controls)
Related Frameworks
FedRAMP High — 🟢 High overlap (76%)
NIST SP 800-53 Rev 5 — 🟢 High overlap (75%)
NIST SP 800-171 Rev 2 — 🟢 High overlap (74%)