top of page
Search

How to Report a Cyber Incident to the RBI Under the Cyber Security Framework in Banks

Writer: Kaustav Chowdhury
Kaustav Chowdhury
7 hours ago
5 min read

A bank that discovers an intrusion has more than one reporting obligation and they do not run to the same body, on the same form or on the same clock. To report a cyber incident to the RBI is to work to a threshold, a format and a timing of its own, all of them set out in a circular that has been in force for a decade.

Step 1: Identify the Instrument and Whether It Applies

The requirement sits in Reserve Bank of India circular RBI/2015-16/418, bearing reference DBS.CO/CSITE/BC.11/33.01.001/2015-16 and dated June 2, 2016, on the Cyber Security Framework in Banks. It is addressed to the Chairman, Managing Director or Chief Executive Officer of all Scheduled Commercial Banks, excluding Regional Rural Banks.

So the first question is simply whether the entity is within that class. An entity outside it is not reporting under this circular, whatever else may apply to it, and an adviser who reaches for this framework for a non-bank has started in the wrong place.

Step 2: Read the Threshold, Which Is Lower Than Most People Expect

Paragraph 14 requires banks to report all unusual cybersecurity incidents, and it says in terms that this covers incidents whether they were successful or were attempts which did not fructify.

That is the single most important sentence in the circular for day to day purposes. The trigger is not loss, not compromise and not materiality. An attempt that failed is reportable on the face of the paragraph, which means the reporting population is far larger than the set of incidents anyone would call a breach.

Step 3: Use the Prescribed Format

Paragraph 15 requires banks to report promptly, in the format given in Annex-3 to the circular. The format is not optional and reporting in some other form does not discharge the paragraph.

Annex-3 contains both the initial report and the fuller form. Pulling the annex into the incident runbook, rather than locating it during an incident, is the difference between a report filed on time and a report assembled while the clock runs.

Step 4: Fix the Clock From Annex-3

Annex-3 provides for an initial Security Incident Reporting to the Reserve Bank within two to six hours, with subsequent updates as they become available. The main text of the circular sets no fixed number of hours; the period comes from the annex.

Two features of that follow. The obligation is satisfied by an initial report on incomplete information, so waiting for a complete picture is not compliance. And because updates are contemplated, the first report is not expected to be final, which removes most of the reason people give for delaying it.

Step 5: Keep This Reporting Line Separate From the Others

Reporting to the Reserve Bank under this circular is one obligation. A listed bank has a separate disclosure obligation to the stock exchanges, and the information security framework administered by the national computer emergency response team carries its own reporting requirement with its own trigger and its own timing.

Treat them as three lines rather than one. Discharging one does not discharge another, the recipients are different, and a single internal note sent to one of them will not do the work of the others.

Step 6: Have the Cyber Security Policy the Circular Requires

Paragraph 4 requires the cyber security policy to be distinct and separate from the broader IT policy or information security policy, and the circular requires the policy to be approved by the Board.

The word distinct is doing work. A cyber security section inside an IT policy is not what the paragraph asks for, and a bank that has one is exposed on a point that costs nothing to fix in peacetime and cannot be fixed during an incident.

Step 7: Check the Cyber Crisis Management Plan Against Its Four Aspects

The circular requires a Cyber Crisis Management Plan as part of the overall Board approved strategy, and it identifies four aspects the plan must address: detection, response, recovery and containment. It also records that traditional business continuity and disaster recovery arrangements may not be adequate for cyber risk.

Read the existing plan against those four words and see whether each is actually covered. Detection is the one most often missing, because continuity planning tends to begin at the point where something is already known to be wrong.

Step 8: Confirm the Security Operations Centre Exists and Operates

The circular requires a Security Operations Centre and speaks of setting one up and operationalising it to monitor and manage cyber risks in real time. Annex 2 of the circular deals with that centre, and Annex 1 carries the baseline cyber security and resilience requirements, which the circular describes as indicative rather than exhaustive.

The word indicative is worth noticing. A bank that has implemented the baseline list and stopped has met an indicative standard, not a complete one, and the circular says so on its own face.

Common Pitfalls to Avoid

  • Applying the circular to the wrong entity: It is addressed to all Scheduled Commercial Banks, excluding Regional Rural Banks.

  • Reading a materiality threshold into it: Paragraph 14 covers all unusual incidents, including attempts which did not fructify.

  • Reporting in a form of the bank's own choosing: Paragraph 15 requires the format given in Annex-3.

  • Waiting for a complete picture: Annex-3 provides for an initial report within two to six hours with subsequent updates.

  • Treating one report as discharging all of them: The Reserve Bank line, the exchange disclosure and the information security reporting requirement are separate.

  • Keeping cyber security inside the IT policy: Paragraph 4 requires a distinct and separate policy, approved by the Board.

  • Leaving detection out of the crisis plan: The plan is to address detection, response, recovery and containment.

  • Treating the baseline requirements as the whole duty: The circular describes them as indicative and not exhaustive.

Key Statutory Provisions

  • Reserve Bank of India circular RBI/2015-16/418, DBS.CO/CSITE/BC.11/33.01.001/2015-16, dated June 2, 2016: Cyber Security Framework in Banks, addressed to the Chairman, Managing Director or Chief Executive Officer of all Scheduled Commercial Banks excluding Regional Rural Banks.

  • Paragraph 14 of the circular: Banks are to report all unusual cybersecurity incidents, whether successful or attempts which did not fructify.

  • Paragraph 15 and Annex-3: Prompt reporting in the prescribed format, with an initial Security Incident Reporting within two to six hours and subsequent updates.

  • Paragraph 4 of the circular: The cyber security policy is to be distinct and separate from the broader IT policy or information security policy, and approved by the Board.

  • Annex 1 and Annex 2 to the circular: The baseline cyber security and resilience requirements, described as indicative and not exhaustive, and the material on setting up and operationalising the security operations centre.

Sources and References


Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.

Comments

bottom of page