RBI Cybersecurity Directions 2026 on AWS: a clause-by-clause control map for commercial banks

The Directions carry the references RBI/DoS/2026-27/410 and DoS.CO.CSITEG.4/31.01.015/2026-27 and are dated 31 July 2026. The RBI page shows the text as “Updated as on October 01, 2026”. They are organised in eight chapters: the Board’s role, IT governance, IT and information-security risk management, baseline cybersecurity and resilience requirements, the Cyber Security Operations Centre (CSOC), IS audit, and repeal.

Banks are covered by both sets of rules. Keep them apart.

Each row names the RBI paragraph, summarises what it asks, and lists the AWS service or setting that produces evidence for it. AWS services support the control; the policy, review and sign-off remain the bank’s.

Paras 93–96 ask for audit logging on every application or system that can access or affect critical or sensitive information. Logs must carry enough detail, such as date, timestamp, source and destination, to identify each event; audit trails must support audits, forensic evidence and dispute resolution; and logs must be monitored regularly.

Paras 143 and 212–223 ask for a CSOC for continuous surveillance. Its systems must collect logs, correlate them through SIEM tools, monitor dashboards and raise alerts (para 215); it must support root-cause analysis, collection of indicators of compromise and forensics (216, 219); and it needs round-the-clock Level 1 monitoring, with Level 2 and Level 3 expertise (221). Para 223 allows in-house staffing or managed-service arrangements.

On AWS, an organisation CloudTrail trail, CloudWatch Logs, VPC Flow Logs and service logs feed the bank’s SIEM, and GuardDuty and Security Hub CSPM findings go through EventBridge to the SIEM and to on-call. Where the 2025 Outsourcing Directions apply (material cloud outsourcing), they add that logs and events from the cloud provider should be integrated into the bank’s SOC, and that relevant logs should be kept in the cloud for incident handling (para 92(xi)).

Paras 104–113 ask for access only on a valid business need; privileged users closely supervised and logged; centralised authentication with least privilege and separation of duties; MFA based on risk, and mandatory MFA for privileged users of critical systems and activities (para 110); dormant accounts deactivated; and abnormal logon patterns monitored. Para 106 asks banks to protect data at rest and in transit, and para 140 asks for strong, non-deprecated algorithms, key lengths and protocols.

On AWS, that points to IAM Identity Center with MFA, AWS Organizations service control policies, IAM Access Analyzer, CloudTrail for privileged activity and AWS KMS customer managed keys, with AWS CloudHSM where keys must sit in single-tenant HSMs under the bank’s control. Where the Outsourcing Directions apply, they ask for encryption keys and HSMs to be under the bank’s control in container-based data management (para 92(vii)(b)).

Paras 66–67 ask for documented security baselines for every device category, with periodic reviews. Paras 98–103 cover patch and change management: impact assessment, approvals, rollback, and root-cause fixes after incidents.

Paras 149–161 ask for VA and PT on all critical and internet-facing systems: VA at least every six months and PT at least every 12 months for critical systems and DMZ systems with a customer interface (para 151); a documented VA/PT approach that also covers systems hosted in the cloud (para 154); independent, trained testers (para 155); and closure status reported to the IT Strategy Committee and Information Security Committee at least quarterly (para 161).

On AWS, AWS Config rules and conformance packs track baselines, Systems Manager Patch Manager reports patch status, and Amazon Inspector scans EC2 instances, container images in Amazon ECR and Lambda functions for vulnerabilities continuously. AWS lets customers run penetration tests on listed services, such as EC2, RDS, Lambda and API Gateway, without prior approval; DoS testing is prohibited and some simulated events need a request form.

Paras 163–174 ask for a BCP and DR policy aligned to good practice such as ISO 22301; DR drills at least half-yearly for critical systems (para 165), run from the DR site for at least a full working day (para 167); data backed up and periodically restored to check it can be used (para 169); near-zero RPO for critical systems (para 171); and identical configuration and patch levels at the primary and DR sites (para 173).

On AWS, that means AWS Backup with cross-Region copy between Mumbai (ap-south-1) and Hyderabad (ap-south-2), AWS Backup restore testing for scheduled restore checks, AWS Elastic Disaster Recovery where servers need continuous replication to the DR Region, and infrastructure as code to keep the two sites identical. Hyderabad is an opt-in Region, so it has to be enabled in each account before use. For the Mumbai–Hyderabad design itself, see our AWS Backup and DR guide.

Paras 175–186 ask for a cyber incident response and recovery policy covering classification, roles (including outsourced staff), reporting channels, communication, containment, threat-information sharing, post-incident review and testing, with forensic analysis where needed (para 181). Para 182 asks banks to report cyber incidents within six hours of detection on DAKSH and to proactively notify CERT-In.

Paras 192–193 ask for a Board-approved Cyber Crisis Management Plan covering detection, containment, response and recovery, and para 211 asks for network forensics and DDoS mitigation support on standby. On AWS, Shield Standard protection is automatic; Shield Advanced adds access to the AWS Shield Response Team for DDoS events, which needs a Business or Enterprise Support plan. Forensics support is still the bank’s own arrangement.

A checklist for the six-hour clock:

Paras 126–135 cover IT and cybersecurity third-party arrangements that fall outside the Managing Risks in Outsourcing Directions, 2025: vendor risk assessment, the bank’s accountability, a right to audit and an RBI right of inspection in contracts (para 132), RBI access to information even if infrastructure is off-premises (para 133), and compliance with rules on infrastructure location and cross-border data movement (para 134).

The Managing Risks in Outsourcing Directions, 2025 (RBI/DOR/2025-26/171, 28 November 2025) apply their IT chapter to a bank’s material outsourcing of IT services, and list cloud computing services and managed security services as IT outsourcing (para 5(1)(v)–(vi)). IT outsourcing is material if a disruption or compromise could significantly affect the bank’s business operations, or if unauthorised access to, loss or theft of customer information could have a material impact on customers (para 53(2)). Existing IT outsourcing agreements had to comply on renewal or by 10 April 2026, whichever came first (para 2).

For banks using cloud, para 92 adds cloud-specific duties: a cloud adoption policy, risk assessment of the cloud provider, controls under the shared-responsibility model, identity and access management with MFA (92(viii)), encryption keys and HSMs under the bank’s control (92(vii)(b)), cloud provider logs integrated into the bank’s SOC (92(xi)), cloud provider resilience and DR drills (92(xv)), and a documented exit strategy (92(xvi)).

Put simply: if a bank’s AWS use is material, the Outsourcing Directions govern it, and the Cybersecurity Directions’ third-party paragraphs (126–135) cover IT and cyber arrangements outside them. The materiality call is the bank’s. AWS publishes compliance reports, such as ISO and SOC reports, through AWS Artifact, and has an India page for financial institutions on its Compliance Center. These help due diligence; they do not make a bank compliant.

The method in this guide — take each clause, name the control that meets it, and decide what evidence proves it — works for any regulator’s rules on AWS. The clause numbers and deadlines here are specific to the RBI.

Upvantix is an AWS Select Tier Services Partner. We can help a bank’s technology team review its AWS accounts against the clauses in this map: logging and SIEM feeds, privileged access and MFA, configuration baselines, vulnerability scanning, backup and restore testing, and the evidence for each. We are not RBI, are not a CERT-In empanelled auditor, do not act as the bank’s independent VA/PT auditor or IS auditor, and do not give legal or regulatory opinions.

This guide summarises the public text of the RBI Commercial Banks Cybersecurity Directions, 2026 (as shown updated on 1 October 2026), the RBI Commercial Banks Outsourcing Directions, 2025 and AWS documentation, as read on 10 October 2026. It is general information, not legal or regulatory advice. Directions and AWS features change; confirm your obligations with your compliance and legal teams and the current RBI website.