Cooperative banks — RBI cyber-security framework

Applicable regulations

• RBI Cyber Security Framework for UCBs (graded Levels I–IV)
• RBI IT/IS audit expectations
• PCI DSS where card systems exist
• DPDP Act 2023

Common cyber risks

• Thin security staffing against a graded control mandate
• Legacy CBS and weak patch/change management
• Phishing and payment-fraud exposure
• Under-tested backups and incident response

Audit findings we typically see

• Level-appropriate controls not fully implemented
• No continuous log monitoring / SOC coverage
• Vendor (CBS/managed-service) oversight gaps
• Cyber-incident reporting process undocumented

Services required

• RBI cooperative-bank cyber audit
• ITGC audit
• VAPT
• Network vulnerability assessment

Our engagement approach

• Level mapping. Confirm the bank's RBI level and the exact controls required at that grade.
• Gap assessment. Assess against the graded framework; prioritise by risk and feasibility.
• Remediation support. Practical, right-sized control design for lean teams, with evidence templates.
• Reporting. IS-audit-ready report and RBI-aligned closure tracker.

Expected evidence

• Level determination & control mapping
• Gap assessment results
• VAPT reports with closure
• Incident-reporting procedure

Deliverables

• RBI-level control map
• Graded gap assessment
• VAPT reports
• IS-audit reporting pack