Free download · RBI audit evidence checklist
RBI cybersecurity audit evidence checklist
The controls and evidence an RBI IT and cyber-security audit expects from a bank or NBFC — governance, controls, VAPT, outsourcing/digital-lending and resilience — organised so your inspection file is complete before the auditor arrives.
Control areas
10
Evidence items
120+
Format
Excel + PDF
Basis
RBI directions
Get the rbi audit evidence checklist
Enter your work email and we’ll send it straight to your inbox.
What’s included
Evidence by control area
IT governance, access control, patch/vulnerability, logging, VAPT, BCP/DR, outsourcing and incident response — each with the artefact that evidences it.
Direction mapping
Mapped to the RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices and related directions.
Outsourcing & digital-lending
The vendor and LSP evidence RBI increasingly scrutinises, called out separately.
Board-reporting pack
What to put in front of the Board so governance is evidenced, not asserted.
Who it’s for
- Banks, cooperative banks and NBFCs facing an RBI IT/cyber audit
- CISOs and IT-audit owners preparing the inspection file
- Entities with outsourcing and digital-lending arrangements
Inside the rbi audit evidence checklist
- Evidence list across 10 control areas
- RBI direction mapping
- Outsourcing / digital-lending (LSP) evidence
- VAPT and closure evidence
- BCP/DR test evidence
- Board-reporting pack
Prepared by CyberSigma BFSI audit practice · Reviewed by a BFSI audit leader · Last updated July 2026
Want an independent RBI audit?
Our CERT-In empanelled BFSI practice runs the audit and VAPT and delivers a Board-ready report mapped to your applicable RBI direction.