RBI Master Direction on IT Governance: Open Source & Third-Party Software Supply Chain Security Manual
Operational field manual and audit checklist for Indian Commercial Banks, NBFCs, and Urban Co-operative Banks (UCBs) complying with Chapter IV & VII of the RBI Master Direction on IT Governance. Covers mandatory third-party software supply chain vetting, source code escrow audits, transitive open-source risk scoring, and Board-level reporting.
Interactive Technical Checklist (12 Verification Checkpoints)
-
[Governance] Establish a formal Open-Source Software (OSS) Policy approved by the Board IT Strategy Committee.Mandate: Chapter IV Governance
-
[Vendor Due Diligence] Execute technical pre-procurement security evaluations for all third-party software, including software bill of materials (SBOM) review.Mandate: Vendor Risk Management
-
[Audit Rights] Incorporate unambiguous 'Right to Audit' clauses empowering bank auditors and RBI inspectors to inspect vendor facilities and source code.Mandate: Statutory Audit Clause
-
[Source Code Escrow] Mandate legally enforceable source code escrow agreements for proprietary core banking, trade finance, and treasury software.Mandate: Business Continuity
-
[VAPT Attestation] Require all vendor software releases to include an independent VAPT clearance certificate issued by a CERT-In empanelled auditor.Mandate: CERT-In Audit Rule
-
[Dependency Scanning] Deploy automated Software Composition Analysis (SCA) to detect known CVEs in third-party and open-source libraries.Mandate: Vulnerability Management
-
[Transitive Risk] Continuously monitor and enforce a maximum 14-day patching SLA for Critical/High CVEs in production dependency trees.Mandate: Patching Timelines
-
[Data Localization] Verify third-party vendor cloud hosting architecture adheres strictly to RBI April 2018 Data Storage directives.Mandate: Sovereign Data Storage
-
[Incident Notification] Contractually mandate vendors to notify the bank within 2 hours of any security breach affecting bank data or systems.Mandate: Breach Reporting SLA
-
[Compensating Controls] Where vendors cannot immediately patch zero-day flaws, deploy documented compensating controls (WAF virtual patching, microsegmentation).Mandate: Compensating Controls
-
[Exit Strategy] Formulate and test annual vendor exit strategies ensuring seamless migration without data loss or service disruption.Mandate: Vendor Lock-in Defense
-
[Board Dossier] Submit quarterly Software Supply Chain Risk Assessment reports to the Board Risk Management Committee.Mandate: CISO Board Assurance
1. Key Directives of Chapter IV & VII
Indian banking institutions can no longer disclaim responsibility when a third-party payment gateway or software vendor suffers a breach. The Master Direction enforces strict governance mandates:
Mandates that Regulated Entities establish robust policies governing the adoption of open-source software. Banks must track community support health, monitor newly disclosed CVEs, and prohibit the use of unmaintained libraries in customer-facing and financial processing systems.
Requires banks to perform technical risk assessments before entering contracts. Contracts must grant unhindered audit rights to both bank internal auditors and RBI inspection officers, enforce strict 2-hour breach reporting SLAs, and validate source code escrow.
2. The 4-Stage Software Supply Chain Defense Lifecycle
Never purchase or license software based solely on marketing brochures. Require the vendor to submit a machine-readable CycloneDX/SPDX SBOM and an independent VAPT report conducted by a CERT-In empanelled auditing firm within the prior 90 days.
Software is dynamic. Integrate automated Software Composition Analysis (SCA) into all banking software repositories. Any newly discovered CVE with CVSS ≥ 7.0 must be remediated or mitigated with approved compensating controls within 14 calendar days.
Ensure that source code escrow accounts are actively maintained and tested annually. Confirm through forensic network traces that third-party vendor telemetries do not route transaction data or customer PII outside sovereign Indian data centers.
Compile quarterly supply chain dossiers for the Board IT Strategy Committee. Prepare pre-formatted Annexure reports for seamless delivery during annual RBI Financial Inspections (AFI).
Need Accredited Auditors to Execute This Audit or Gap Assessment?
BlueCiphr's certified lead auditors (CEH Master, PenTest+, ISO 27001 Lead Auditors) conduct deep technical verification and produce board-ready evidence binders complying with RBI, SEBI CSCRF, CERT-In, and the DPDP Act 2023.