{"what_this_is":"The machine-readable twin of the BankPulse page for one RBI rulebook. Same points, same dates, same paragraph references as the page a person reads. RBI's own wording is not reproduced here: each point names the RBI paragraph, the character offset into the text BankPulse read and the sha256 of that text, so the claim can be checked against RBI's own document.","schema_version":1,"release_id":"d653cdb0a5","generated_at":"2026-09-15T00:33:59.117975+00:00","id":"md13616","title":"Reserve Bank of India (Urban Co-operative Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026","document_kind":"Directions","page":"https://bankpulse.ai/rule/md13616","status":"In force","importance":{"code":"MR","label":"MUST READ","weight":"Must read","why":"Binding RBI Directions naming this institution class in the title","layer":"bankpulse_inference"},"applies_to":{"shown":"Urban co-operative banks","class_code":"UCB","from":"the document's own title","layer":"bankpulse_inference"},"dates":{"prid":"md13616","mode":"four_dates_v1","published":{"label":"Published","value":"Jul 31, 2026","stated":true,"why":"The day RBI put this document out."},"effective":{"label":"Starts to apply","value":"","stated":false,"why":"Not stated separately in this document. Read the rule itself before you assume a start date."},"transition":{"label":"Time to get ready","value":"","stated":false,"why":"Cannot be worked out until the day it starts to apply is known."},"deadline":{"label":"Last date to act","value":"","stated":false,"why":"No date to act by was found in this document. Other dates may sit inside single paragraphs."},"sources":{"published":"doc_date in data/highlights/md13616.json","effective":"none held","transition":"none held","deadline":"none held"}},"rbi_source":{"url":"https://rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=13616","document_date":"Jul 31, 2026","read_by_bankpulse":"2026-08-21 16:25:30 UTC","text_sha256":"0bf82667dcae27088a5a6725718758a28996eea588b45aa9848893a2934f2acf","word_count":11704,"standing_last_checked":"Standing checked on RBI’s Master Directions index, 15 September 2026, 5:58 am IST."},"counts":{"points_shown":80,"points_naming_an_rbi_paragraph":80,"points_stored":80,"actions":0,"amendments":0},"points":[{"n":1,"claim":"md13616-1966e9d0","page_group":"Chapter I. Preliminary","stored_section":"THE CORE IDEA","heading":"Cyber rules for UCBs","plain_english":"This paper sets the cyber and technology risk rules for urban co-operative banks.","rbi_paragraph":"Para 1","rbi_char_offset":4989,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p1","layer":"bankpulse"},{"n":2,"claim":"md13616-1840df20","page_group":"Chapter I. Preliminary","stored_section":"KEY DATES","heading":"Start date","plain_english":"These Directions took effect at once.","rbi_paragraph":"Para 2","rbi_char_offset":5177,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p2","layer":"bankpulse"},{"n":3,"claim":"md13616-24876135","page_group":"Chapter I. Preliminary","stored_section":"WHO IT APPLIES TO","heading":"Who is covered","plain_english":"These Directions apply to every urban co-operative bank.","rbi_paragraph":"Para 3","rbi_char_offset":5242,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p3","layer":"bankpulse"},{"n":4,"claim":"md13616-be65d31d","page_group":"Chapter I. Preliminary","stored_section":"THE CORE IDEA","heading":"Four levels of UCB","plain_english":"A UCB is placed in one of four levels by its digital depth and payment links.","rbi_paragraph":"Para 4","rbi_char_offset":5611,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p4","layer":"bankpulse"},{"n":5,"claim":"md13616-a9e3c0f4","page_group":"Chapter I. Preliminary","stored_section":"WHO IT APPLIES TO","heading":"Level one covers all","plain_english":"Level one controls apply to every urban co-operative bank, whatever it offers.","rbi_paragraph":"Para 4","rbi_char_offset":5897,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p5","layer":"bankpulse"},{"n":6,"claim":"md13616-e6836b42","page_group":"Chapter I. Preliminary","stored_section":"WHO IT APPLIES TO","heading":"Level two is net banking","plain_english":"Level two covers a sub member of central payment systems that offers net or mobile banking.","rbi_paragraph":"Para 4","rbi_char_offset":6014,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":["digital-payment"],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p6","layer":"bankpulse"},{"n":7,"claim":"md13616-35be2937","page_group":"Chapter I. Preliminary","stored_section":"WHO IT APPLIES TO","heading":"Level three is direct","plain_english":"Level three covers a direct member of central payment systems or one with its own ATM switch.","rbi_paragraph":"Para 4(1)","rbi_char_offset":6802,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p7","layer":"bankpulse"},{"n":8,"claim":"md13616-b8f4e159","page_group":"Chapter I. Preliminary","stored_section":"WHO IT APPLIES TO","heading":"Level four is the largest","plain_english":"Level four covers a bank with its own switch and SWIFT, or one hosting data for others.","rbi_paragraph":"Para 4(1)","rbi_char_offset":7139,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p8","layer":"bankpulse"},{"n":1,"claim":"md13616-939c69e6","page_group":"Chapter II. Role of the Board","stored_section":"WHO SHOULD ACT","heading":"Board approves the policies","plain_english":"The Board must approve the plans and policies for technology and cyber security.","rbi_paragraph":"Para 7","rbi_char_offset":13720,"weight":"DO IT","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p9","layer":"bankpulse"},{"n":2,"claim":"md13616-be0f1727","page_group":"Chapter II. Role of the Board","stored_section":"WHAT CHANGES","heading":"Two directors on the committee","plain_english":"A level four bank may set up an IT Strategy Committee of at least two directors.","rbi_paragraph":"Para 8","rbi_char_offset":13954,"weight":"BACKGROUND","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p10","layer":"bankpulse"},{"n":1,"claim":"md13616-ea91c8d4","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"No admin rights","plain_english":"Staff must not hold admin rights on their own desktop or laptop.","rbi_paragraph":"Para 43","rbi_char_offset":24574,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p11","layer":"bankpulse"},{"n":2,"claim":"md13616-ff27bedb","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"No trivial passwords","plain_english":"The bank must have a password policy and must not use easy or guessable passwords.","rbi_paragraph":"Para 44","rbi_char_offset":24734,"weight":"MUST KNOW","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p12","layer":"bankpulse"},{"n":3,"claim":"md13616-908b539a","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Split the duties","plain_english":"The person who writes a program must not be the person who runs it.","rbi_paragraph":"Para 51","rbi_char_offset":26684,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p13","layer":"bankpulse"},{"n":4,"claim":"md13616-625dac9d","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Removable media is barred","plain_english":"As a rule, pen drives and like media are barred unless allowed for a set use.","rbi_paragraph":"Para 55","rbi_char_offset":27671,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p14","layer":"bankpulse"},{"n":5,"claim":"md13616-29b179de","page_group":"Chapter III. Level","stored_section":"WHO SHOULD ACT","heading":"Never open unknown mail","plain_english":"Staff must be taught never to open a file sent from a source they do not know.","rbi_paragraph":"Para 64","rbi_char_offset":29701,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p15","layer":"bankpulse"},{"n":6,"claim":"md13616-334fa923","page_group":"Chapter III. Level","stored_section":"WHO SHOULD ACT","heading":"Warn customers on passwords","plain_english":"The bank must teach customers never to share a password, a one time code or a PIN.","rbi_paragraph":"Para 67","rbi_char_offset":30123,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p16","layer":"bankpulse"},{"n":7,"claim":"md13616-ad0cad46","page_group":"Chapter III. Level","stored_section":"KEY DATES","heading":"Six hours to report","plain_english":"A cyber incident must be reported on the DAKSH platform within six hours of detection.","rbi_paragraph":"Para 88","rbi_char_offset":48495,"weight":"MUST KNOW","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p17","layer":"bankpulse"},{"n":8,"claim":"md13616-4399dfdf","page_group":"Chapter III. Level","stored_section":"WHO SHOULD ACT","heading":"Grade yourself first","plain_english":"The bank must work out for itself which level it falls in and follow those controls.","rbi_paragraph":"Para 10","rbi_char_offset":14611,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p18","layer":"bankpulse"},{"n":9,"claim":"md13616-7c066a7e","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"A separate cyber policy","plain_english":"The cyber security policy must be kept apart from the wider IT policy.","rbi_paragraph":"Para 11","rbi_char_offset":15239,"weight":"DO IT","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p19","layer":"bankpulse"},{"n":10,"claim":"md13616-1fa93391","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Rate each risk","plain_english":"The bank must rate every risk it finds as low, medium, high or very high.","rbi_paragraph":"Para 12","rbi_char_offset":16512,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p20","layer":"bankpulse"},{"n":11,"claim":"md13616-7d07e9c5","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Keep an asset register","plain_english":"The asset register must show the kit, where customer data sits, and how critical it is.","rbi_paragraph":"Para 21","rbi_char_offset":19697,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p21","layer":"bankpulse"},{"n":12,"claim":"md13616-fe011f8c","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Store the keys safely","plain_english":"The bank must store encryption keys safely and control who may reach them.","rbi_paragraph":"Para 24","rbi_char_offset":20935,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p22","layer":"bankpulse"},{"n":13,"claim":"md13616-71f73d51","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Control what gets installed","plain_english":"The bank must control what software can be put on its systems and devices.","rbi_paragraph":"Para 26","rbi_char_offset":21335,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p23","layer":"bankpulse"},{"n":14,"claim":"md13616-9135aab0","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"List the allowed software","plain_english":"The bank must keep one central list of software that is allowed and not allowed.","rbi_paragraph":"Para 27","rbi_char_offset":21766,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p24","layer":"bankpulse"},{"n":15,"claim":"md13616-2bec215c","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Turn off risky scripts","plain_english":"Browsers must auto update and scripts such as Java and ActiveX must be off when unused.","rbi_paragraph":"Para 28","rbi_char_offset":21902,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p25","layer":"bankpulse"},{"n":16,"claim":"md13616-e7c40c97","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Keep internet apart","plain_english":"Internet use must sit on separate machines, away from the day to day banking systems.","rbi_paragraph":"Para 29","rbi_char_offset":22054,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p26","layer":"bankpulse"},{"n":17,"claim":"md13616-a8896688","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Watch heat and water","plain_english":"The bank must watch for breaks in heat, water, smoke, power and access alarms.","rbi_paragraph":"Para 31","rbi_char_offset":22460,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p27","layer":"bankpulse"},{"n":18,"claim":"md13616-01063929","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Change default passwords","plain_english":"Default passwords on network devices and systems must be changed after they go in.","rbi_paragraph":"Para 34","rbi_char_offset":22998,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p28","layer":"bankpulse"},{"n":19,"claim":"md13616-1c409baa","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Secure the wireless","plain_english":"The bank must secure wireless networks, access points and client systems.","rbi_paragraph":"Para 35","rbi_char_offset":23097,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p29","layer":"bankpulse"},{"n":20,"claim":"md13616-a1045bf7","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Turn remote desktop off","plain_english":"Remote desktop must stay off and open only with an approval, with logs watched.","rbi_paragraph":"Para 37","rbi_char_offset":23338,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p30","layer":"bankpulse"},{"n":21,"claim":"md13616-e3c69ba7","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Firewalls at highest setting","plain_english":"Firewalls must be set to the highest security level and checked from time to time.","rbi_paragraph":"Para 38","rbi_char_offset":23603,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p31","layer":"bankpulse"},{"n":22,"claim":"md13616-864d4c08","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Maker and checker","plain_english":"Sensitive or high value transactions must pass a maker and checker control.","rbi_paragraph":"Para 48","rbi_char_offset":26134,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p32","layer":"bankpulse"},{"n":23,"claim":"md13616-5aeaf8a5","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Secure the mail system","plain_english":"The bank must guard its mail against spoofing, look alike names and bad files.","rbi_paragraph":"Para 52","rbi_char_offset":27051,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p33","layer":"bankpulse"},{"n":24,"claim":"md13616-424a6f40","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Bank name in the domain","plain_english":"The bank must use its own name in its email domain, with anti phishing controls.","rbi_paragraph":"Para 54","rbi_char_offset":27364,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p34","layer":"bankpulse"},{"n":25,"claim":"md13616-97917c4a","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Use DMARC on email","plain_english":"The bank must put DMARC in place on its email names to stop spoofing.","rbi_paragraph":"Para 54","rbi_char_offset":27507,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p35","layer":"bankpulse"},{"n":26,"claim":"md13616-45c38255","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Scan media first","plain_english":"Removable media must be scanned for malware before read or write access is given.","rbi_paragraph":"Para 57","rbi_char_offset":28053,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p36","layer":"bankpulse"},{"n":27,"claim":"md13616-aa69d0f5","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Destroy media before disposal","plain_english":"Media holding sensitive data must be fully erased or destroyed before it is thrown out.","rbi_paragraph":"Para 58","rbi_char_offset":28168,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p37","layer":"bankpulse"},{"n":28,"claim":"md13616-177a5c7e","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Keep backups offline","plain_english":"The bank must back up important data and keep a copy offline, off the machine.","rbi_paragraph":"Para 69","rbi_char_offset":30444,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p38","layer":"bankpulse"},{"n":29,"claim":"md13616-0c52a69c","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Check the vendor first","plain_english":"Before hiring or renewing a vendor, the bank must test whether it can meet the contract.","rbi_paragraph":"Para 72","rbi_char_offset":31416,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p39","layer":"bankpulse"},{"n":30,"claim":"md13616-e343b354","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Assess vendor risk","plain_english":"The bank must assess vendor risk and hold controls that match that risk.","rbi_paragraph":"Para 72(3)","rbi_char_offset":32528,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p40","layer":"bankpulse"},{"n":31,"claim":"md13616-1daf3edf","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Exit terms are needed","plain_english":"The agreement must carry exit terms so the bank is not locked in to one vendor.","rbi_paragraph":"Para 72(3)","rbi_char_offset":32644,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p41","layer":"bankpulse"},{"n":32,"claim":"md13616-88ab18bc","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Right to audit the vendor","plain_english":"The vendor agreement must give the bank a right to audit and RBI a right to inspect.","rbi_paragraph":"Para 73","rbi_char_offset":34136,"weight":"DO IT","role":"Audit","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p42","layer":"bankpulse"},{"n":33,"claim":"md13616-9d21af31","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Who pays if it fails","plain_english":"The service agreement must state who answers for a failure of service.","rbi_paragraph":"Para 75","rbi_char_offset":34954,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p43","layer":"bankpulse"},{"n":34,"claim":"md13616-c58c565a","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Map the data flow","plain_english":"The bank must map how data moves between itself, its vendors and its customers.","rbi_paragraph":"Para 79","rbi_char_offset":35864,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p44","layer":"bankpulse"},{"n":35,"claim":"md13616-5ec1480a","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Switch provider must comply","plain_english":"The ATM switch provider must meet the cyber controls the bank writes into the contract.","rbi_paragraph":"Para 83","rbi_char_offset":36993,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p45","layer":"bankpulse"},{"n":36,"claim":"md13616-f4d21fb1","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Watch for new patches","plain_english":"The bank must watch patch notices from makers and CERT-In and apply them fast.","rbi_paragraph":"Para 85(1)","rbi_char_offset":38804,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p46","layer":"bankpulse"},{"n":37,"claim":"md13616-d0a39855","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Keep a network map","plain_english":"The bank must keep an up to date map of its wired and wireless networks.","rbi_paragraph":"Para 85(3)","rbi_char_offset":39772,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p47","layer":"bankpulse"},{"n":38,"claim":"md13616-6b198563","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Block strange devices","plain_english":"The bank must spot devices that are not allowed on the network and block them.","rbi_paragraph":"Para 85(6)","rbi_char_offset":40297,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p48","layer":"bankpulse"},{"n":39,"claim":"md13616-811125c9","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Write secure code","plain_english":"The bank must use secure coding when it builds software on its own or with others.","rbi_paragraph":"Para 85(11)","rbi_char_offset":40933,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p49","layer":"bankpulse"},{"n":40,"claim":"md13616-8bb7ef82","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Close dormant accounts","plain_english":"The bank must limit failed sign in tries and switch off accounts nobody uses.","rbi_paragraph":"Para 85(23)","rbi_char_offset":44053,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p50","layer":"bankpulse"},{"n":41,"claim":"md13616-a5b37c28","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Stop data leaks","plain_english":"The bank must have a full plan to stop the loss or leak of sensitive data.","rbi_paragraph":"Para 85(28)","rbi_char_offset":44718,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p51","layer":"bankpulse"},{"n":42,"claim":"md13616-255d255a","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Card standards apply","plain_english":"The switch provider must meet the payment card industry data security standard.","rbi_paragraph":"Para 85(37)","rbi_char_offset":47786,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p52","layer":"bankpulse"},{"n":43,"claim":"md13616-648a1fc0","page_group":"Chapter III. Level","stored_section":"WHO SHOULD ACT","heading":"Tell CERT-In as well","plain_english":"The bank must also tell CERT-In about a cyber incident without being asked.","rbi_paragraph":"Para 87","rbi_char_offset":48429,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p53","layer":"bankpulse"},{"n":44,"claim":"md13616-77f58b86","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Encrypt data on the wire","plain_english":"Standard encryption and integrity checks are needed where sensitive data crosses a network.","rbi_paragraph":"Para 23","rbi_char_offset":20784,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p54","layer":"bankpulse"},{"n":45,"claim":"md13616-a6219794","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Two factor for core banking","plain_english":"Signing in to core banking needs a second factor that changes each time.","rbi_paragraph":"Para 47","rbi_char_offset":25772,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p55","layer":"bankpulse"},{"n":46,"claim":"md13616-ba5e1a7d","page_group":"Chapter III. Level","stored_section":"KEY DATES","heading":"Board briefed once a year","plain_english":"The bank may brief its Board members on IT and cyber risk at least once a year.","rbi_paragraph":"Para 59","rbi_char_offset":28511,"weight":"BACKGROUND","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p56","layer":"bankpulse"},{"n":47,"claim":"md13616-75397eba","page_group":"Chapter III. Level","stored_section":"THE CORE IDEA","heading":"The bank stays answerable","plain_english":"The bank stays answerable for security risk in work it has given out.","rbi_paragraph":"Para 71","rbi_char_offset":30919,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p57","layer":"bankpulse"},{"n":48,"claim":"md13616-3167a119","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Check vendor staff","plain_english":"Background checks and secrecy agreements are needed for all vendor staff.","rbi_paragraph":"Para 74","rbi_char_offset":34719,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p58","layer":"bankpulse"},{"n":49,"claim":"md13616-35301b89","page_group":"Chapter III. Level","stored_section":"WHAT CHANGES","heading":"Anti malware everywhere","plain_english":"Anti malware cover is needed on desktops, servers, gateways and message systems.","rbi_paragraph":"Para 85(33)","rbi_char_offset":46467,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p59","layer":"bankpulse"},{"n":1,"claim":"md13616-f46bb3aa","page_group":"Chapter IV. Level II Baseline Cybersecurity and Resilience Requirements","stored_section":"KEY DATES","heading":"Scan twice, test yearly","plain_english":"Critical and public facing applications need a scan every six months.","rbi_paragraph":"Para 116","rbi_char_offset":55315,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p60","layer":"bankpulse"},{"n":2,"claim":"md13616-0b9a30b8","page_group":"Chapter IV. Level II Baseline Cybersecurity and Resilience Requirements","stored_section":"WHAT CHANGES","heading":"List every allowed device","plain_english":"The bank must keep one central list of the devices allowed on its network.","rbi_paragraph":"Para 105","rbi_char_offset":52556,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p61","layer":"bankpulse"},{"n":3,"claim":"md13616-abc8490a","page_group":"Chapter IV. Level II Baseline Cybersecurity and Resilience Requirements","stored_section":"WHAT CHANGES","heading":"Layer the boundary","plain_english":"Boundary defence must be layered, with firewalls, proxies and intrusion systems.","rbi_paragraph":"Para 106","rbi_char_offset":52748,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p62","layer":"bankpulse"},{"n":4,"claim":"md13616-c927983f","page_group":"Chapter IV. Level II Baseline Cybersecurity and Resilience Requirements","stored_section":"WHAT CHANGES","heading":"Support IPv6 traffic","plain_english":"Public facing systems of the bank must be able to carry IPv6 traffic.","rbi_paragraph":"Para 108","rbi_char_offset":53218,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p63","layer":"bankpulse"},{"n":5,"claim":"md13616-7bcde2dc","page_group":"Chapter IV. Level II Baseline Cybersecurity and Resilience Requirements","stored_section":"WHAT CHANGES","heading":"Set a security baseline","plain_english":"The bank must set and apply a base security setting for every kind of device.","rbi_paragraph":"Para 109","rbi_char_offset":53309,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p64","layer":"bankpulse"},{"n":6,"claim":"md13616-9c486186","page_group":"Chapter IV. Level II Baseline Cybersecurity and Resilience Requirements","stored_section":"KEY DATES","heading":"Attack test once a year","plain_english":"An attack test must be run at least once a year.","rbi_paragraph":"Para 116","rbi_char_offset":55414,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p65","layer":"bankpulse"},{"n":7,"claim":"md13616-35217a27","page_group":"Chapter IV. Level II Baseline Cybersecurity and Resilience Requirements","stored_section":"WHAT CHANGES","heading":"Buy anti phishing help","plain_english":"The bank must buy a service that takes down fake sites and rogue apps.","rbi_paragraph":"Para 123","rbi_char_offset":57024,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p66","layer":"bankpulse"},{"n":1,"claim":"md13616-a78b4662","page_group":"Chapter V. Level III Baseline Cybersecurity and Resilience Requirements","stored_section":"WHAT CHANGES","heading":"Whitelist internet sites","plain_english":"The bank must whitelist the internet sites and systems that staff may reach.","rbi_paragraph":"Para 148","rbi_char_offset":62339,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p67","layer":"bankpulse"},{"n":2,"claim":"md13616-5ad2330b","page_group":"Chapter V. Level III Baseline Cybersecurity and Resilience Requirements","stored_section":"KEY DATES","heading":"Yearly quiz for managers","plain_english":"New recruits must be trained and every manager must take a yearly test.","rbi_paragraph":"Para 156","rbi_char_offset":64284,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p68","layer":"bankpulse"},{"n":3,"claim":"md13616-61a9e358","page_group":"Chapter V. Level III Baseline Cybersecurity and Resilience Requirements","stored_section":"WHAT CHANGES","heading":"Watch risky transactions","plain_english":"The bank must watch transactions on a risk basis across every channel it runs.","rbi_paragraph":"Para 158","rbi_char_offset":64883,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p69","layer":"bankpulse"},{"n":1,"claim":"md13616-6feddae7","page_group":"Chapter VI. Level IV Baseline Cybersecurity and Resilience Requirements","stored_section":"KEY DATES","heading":"Quarterly review to the Board","plain_english":"The security officer must put a cyber readiness review to the Board every three months.","rbi_paragraph":"Para 175(4)","rbi_char_offset":74604,"weight":"MUST KNOW","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p70","layer":"bankpulse"},{"n":2,"claim":"md13616-14ceaf6b","page_group":"Chapter VI. Level IV Baseline Cybersecurity and Resilience Requirements","stored_section":"WHAT CHANGES","heading":"Keep the two apart","plain_english":"The security officer must not report to the head of IT and gets no business target.","rbi_paragraph":"Para 175(8)","rbi_char_offset":75303,"weight":"MUST KNOW","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p71","layer":"bankpulse"},{"n":3,"claim":"md13616-a6fce572","page_group":"Chapter VI. Level IV Baseline Cybersecurity and Resilience Requirements","stored_section":"KEY DATES","heading":"Security committee each quarter","plain_english":"The information security committee must meet at least once every three months.","rbi_paragraph":"Para 177","rbi_char_offset":76532,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p72","layer":"bankpulse"},{"n":4,"claim":"md13616-0bdbdd06","page_group":"Chapter VI. Level IV Baseline Cybersecurity and Resilience Requirements","stored_section":"WHO SHOULD ACT","heading":"What the centre must do","plain_english":"The centre must watch, study and escalate incidents and work with outside agencies.","rbi_paragraph":"Para 161","rbi_char_offset":66330,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p73","layer":"bankpulse"},{"n":5,"claim":"md13616-b5bcf87f","page_group":"Chapter VI. Level IV Baseline Cybersecurity and Resilience Requirements","stored_section":"WHAT CHANGES","heading":"Measure with real numbers","plain_english":"The bank must build measures such as patch delay, malware cover and training reach.","rbi_paragraph":"Para 169","rbi_char_offset":68774,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p74","layer":"bankpulse"},{"n":6,"claim":"md13616-6e70e47e","page_group":"Chapter VI. Level IV Baseline Cybersecurity and Resilience Requirements","stored_section":"WHAT CHANGES","heading":"Keep forensics on standby","plain_english":"The bank must keep network forensic and denial of service help on standby.","rbi_paragraph":"Para 170","rbi_char_offset":69209,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p75","layer":"bankpulse"},{"n":7,"claim":"md13616-9baa74f9","page_group":"Chapter VI. Level IV Baseline Cybersecurity and Resilience Requirements","stored_section":"WHAT CHANGES","heading":"Two must know technology","plain_english":"At least two members must be technically able and one must have real IT skill.","rbi_paragraph":"Para 173","rbi_char_offset":71121,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p76","layer":"bankpulse"},{"n":8,"claim":"md13616-53d79aa2","page_group":"Chapter VI. Level IV Baseline Cybersecurity and Resilience Requirements","stored_section":"WHO SHOULD ACT","heading":"Security officer reports up","plain_english":"The security officer reports to the top risk executive or to the chief executive.","rbi_paragraph":"Para 175(1)","rbi_char_offset":74296,"weight":"BACKGROUND","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p77","layer":"bankpulse"},{"n":1,"claim":"md13616-e445d507","page_group":"Chapter VII. Repeal and Other Provisions","stored_section":"WHAT IT REPLACES","heading":"Old cyber rules go","plain_english":"These Directions repeal the earlier cyber framework and IT governance instructions.","rbi_paragraph":"Para 180","rbi_char_offset":78272,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13616#p78","layer":"bankpulse"},{"n":2,"claim":"md13616-ed77acc3","page_group":"Chapter VII. Repeal and Other Provisions","stored_section":"WHAT IT REPLACES","heading":"Other laws still apply","plain_english":"These Directions add to other laws and rules and do not replace them.","rbi_paragraph":"Para 182","rbi_char_offset":79714,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":"A bank follows these Directions and thinks the matter is closed. It is not. Any other laws, rules, regulations or directions in force still apply on top. Where another one asks for more, the bank does the more.","anchor":"https://bankpulse.ai/rule/md13616#p79","layer":"bankpulse"},{"n":3,"claim":"md13616-a449e126","page_group":"Chapter VII. Repeal and Other Provisions","stored_section":"THE CORE IDEA","heading":"RBI has the last word","plain_english":"RBI may issue clarifications, and its reading of these Directions is final.","rbi_paragraph":"Para 183","rbi_char_offset":80162,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":"Two banks read the same clause differently. Neither reading settles it. RBI may issue clarifications, and its interpretation of any provision is final and binding on all concerned entities.","anchor":"https://bankpulse.ai/rule/md13616#p80","layer":"bankpulse"}],"actions":[],"amendments":[],"layers":{"rbi_source":"Facts taken from RBI's own document.","bankpulse":"BankPulse's plain-English summary of RBI's document.","bankpulse_inference":"BankPulse's own inference, not stated by RBI."},"rbi_wording_not_included":"By design. BankPulse never republishes RBI's exact sentences. Use rbi_paragraph with rbi_source.url to read RBI's own words.","terms":"BankPulse's plain-English summaries are BankPulse's own work. The underlying regulation is the Reserve Bank of India's. Always check the RBI document named in rbi_source before acting."}