Cooperative banks — RBI cybersecurity framework

Applicable regulations

• RBI Cyber Security Framework for UCBs (graded Levels I to IV)
• RBI IT and IS audit expectations
• PCI DSS where card systems exist
• DPDP Act 2023

Common cybersecurity risks

• Thin security staffing against a graded control mandate
• Legacy CBS with weak patch and change management
• Phishing and payment-fraud exposure
• Under-tested backups and incident response

Audit findings we typically see

• Level-appropriate controls not fully implemented
• No continuous log monitoring or SOC coverage
• Oversight gaps across CBS and managed-service vendors
• Cyber-incident reporting process undocumented

Services required

• RBI cooperative-bank cybersecurity audit
• ITGC audit
• VAPT
• Network vulnerability assessment

Our engagement approach

• Level mapping. Confirm the bank's RBI level and the exact controls required at that grade.
• Gap assessment. Assess against the graded framework and prioritise by risk and feasibility.
• Remediation support. Practical, right-sized control design for lean teams, with evidence templates.
• Reporting. An IS-audit-ready report and an RBI-aligned closure tracker.

Expected evidence

• Level determination and control mapping
• Gap-assessment results
• VAPT reports with closure
• Incident-reporting procedure

Deliverables

• RBI-level control map
• Graded gap assessment
• VAPT reports
• IS-audit reporting pack