RBI Co-Operative Bank IS Audit

RBI Co-Operative Bank IS Audit

RBI enhanced the Cyber Security Framework for Urban Cooperative Banks (UCBs), revising its initial release of October 19, 2018. Being a CERT-In Empaneled Security Auditor, QRC helps our clients to understand, manage and comply with periodic releasing RBI Guidelines. The Periodic reviews of the security of the bank’s infrastructure and assets are a must to find out vulnerabilities and security loopholes. Hence, we need to take the appropriate actions to be taken by the Co-Operative Banks to fill the security loopholes and get rid of vulnerabilities.

The following is a quick summary of some of the key points and requirements from the new Cyber Security Framework for Urban Cooperative Banks (UCBs).

Basic Cyber Security Framework for Primary (Urban) Cooperative Banks (UCBs)

  • Board approved Cyber Security Policy
  • Cyber Security Policy to be distinct from the IT policy/IS Policy of the UCB
  • IT Architecture/Framework should be security compliant
  • Cyber Crisis Management Plan
  • Organizational Arrangements
  • Cyber Security awareness among Top Management/Board/other concerned parties
  • Ensuring protection of customer information
  • Supervisory reporting framework

Comprehensive Cyber Security Framework for Primary (Urban) Cooperative Banks (UCBs)

Level I Requirements

  • Baseline Cyber Security and Resilience Requirement
  • Vendor/Outsourcing Risk Management

Level II Requirements

  • Network Management and Security
  • Secure Configuration
  • Application Security Life Cycle (ASLC)
  • Change Management
  • Periodic Testing
  • User Access Control / Management
  • Authentication Framework for Customers
  • Anti-Phishing
  • Data Leak Prevention Strategy
  • Audit Logs
  • Incident Response and Management

Level III Requirements

  • Network Management and Security
  • Secure Configuration
  • Application Security Life Cycle (ASLC)
  • User Access Control
  • Advanced Real-time Threat Defense and Management
  • Maintenance, Monitoring, and Analysis of Audit Logs
  • Incident Response and Management
  • User / Employee/ Management Awareness
  • Risk based transaction monitoring

Level IV Requirements

  • Arrangement for continuous surveillance – Setting up of Cyber Security Operation Centre (C-SOC)
  • Participation in Cyber Drills
  • Incident Response and Management
  • Forensics and Metrics
  • IT Strategy and Policy
  • IT and IS Governance Framework
  • IT Strategy Committee
  • IT Steering Committee
  • Chief Information Security Officer (CISO)
  • Information Security Committee
  • Audit Committee of Board (ACB)

We help our clients to get an in-depth analysis of the RBI Cyber Security Framework for Cooperative Banks and meet the RBI Cyber Security Guidelines.

Our approach for assessment is as follows:

Information Gathering & Documentation Review

We provide a detailed questionnaire, shared with your teams along with other documentation, and evidence is collected on the architecture, implementation and controls to understand data flow.

Audit Process

Post scope definition as per the Cyber Security Framework Urban Cooperative directive and initial engagement, we will conduct an initial audit for understanding the infra of the organization and help our clients in identifying all the storage locations which comprise of any payment related data.


As per the assessment, and the identification of the payment data, QRC will provide remediation support for complying with the RBI mandate.

Report & Confirmation Letter

Post assessment and remediation, we will review your evidence on the closure of the Action phase as identified during the audit. On successful closure, we will share the confirmation letter that all payment related data is residing inside India.

The risk-based internal audit guidelines for urban cooperative banks were put forth by the RBI to strengthen the security control.

  • New framework that focuses on evaluation of the risk management systems and control procedures in various areas of operations, in addition to transaction testing, helps in anticipating areas of potential risks and mitigating such risks.
  • The risk-based audit deeply considers the inherent business risks emanating from an activity/location and the effectiveness of the control systems for monitoring such inherent risks.
  • Urban Cooperative banks were considered as the weak link in the financial system, the new guideline helps to strengthen the security controls of the cooperative banks.
  • Audits conducted by a CERT-IN empaneled auditor, allows our clients to be proactive in identifying vulnerabilities in their IT infrastructure, and validating the effectiveness of their current security safeguards.

Get Free Consultation