# RBI Cyber Security Framework

> India

The RBI has steadily expanded cyber-security expectations for banks, NBFCs, payment aggregators and gateways since its 2016 framework - including data localization for payment data. We assess and operationalize the controls and supporting VAPT/audit.

## Who needs to comply

Banks, NBFCs, payment aggregators, payment gateways and other RBI-regulated entities.

## Key requirements

- **Framework controls** - Governance, baseline controls, monitoring and incident response.
- **Data localization** - Guidance on RBI's payment-data localization requirements.
- **VAPT & audit** - CERT-In-style testing and audit aligned to RBI expectations.

---
Related services: https://a5cyber.com/services/cert-in-audit/, https://a5cyber.com/services/vapt/, https://a5cyber.com/services/managed-security/