Lok Sabha Question No. 3969 (UNSTARRED), answered on 2025-08-18
Subject: Cybersecurity Measures for Indian Banking Infrastructure
Ministry: FINANCE
Asked by: Shri Putta Mahesh Kumar

## GOVERNMENT OF INDIA MINISTRY OF FINANCE DEPARTMENT OF FINANCIAL SERVICES

## LOK SABHA UNSTARRED QUESTION NO:3969

ANSWERED ON THE MONDAY, 18 AUGUST, 2025/ SRAVANA 27, 1947 (SAKA)

## CYBERSECURITY MEASURES FOR INDIAN BANKING INFRASTRUCTURE

## 3969. SHRI PUTTA MAHESH KUMAR:

Will the Minister of FINANCE be pleased to state:

- (a) whether the Government has undertaken any survey/audit regarding cyber fraud measures and policies of Indian banking infrastructure during the last five years;
- (b) if so, the details thereof and the total number of cyberfraud incidents reported/investigated and losses suffered by banks during the last five years, State-wise especially in Andhra Pradesh;
- (c) the list of banks found to be non-compliant of the cybersecurity requirements during the last  five  years  and  the  action  taken  against  such  banks,  State-wise  especially  from  Andhra Pradesh; and
- (d)  whether  the  Government  has  set  any  timeline  for  all  banks  to  be  compliant  with  the cybersecurity norms as prescribed by the Reserve Bank of India

## ANSWER

## THE MINISTER OF STATE IN THE MINISTRY OF FINANCE

## (SHRI PANKAJ CHAUDHARY)

(a) and (b):  The Indian Computer Emergency Response Team (CERT-In) has created a panel of 'Information Security Auditing Organisations' for auditing, including vulnerability assessment  and  penetration  testing  of  computer  systems,  networks,  websites,  cloud  & applications  of  various  organizations  in  Indian  banking  sector.  Currently,  there  are  200 organisations empanelled by CERT-In to provide auditing services which are being consulted frequently by the entities in Government and vital sectors, including banking for their auditing requirements. During January 2021 to June 2025,  29,751 audits were conducted by CERT-In empanelled auditing organizations for the banking sector.

Further, Cyber Security & IT Risk Group (CSITE) of Reserve Bank of India (RBI) undertakes comprehensive onsite and offsite supervisory measures on an ongoing basis with regard to cyber security risk of its Supervised Entities. RBI has informed that it does not maintain State- wise data of Cyber-incidents. However, the number of cyber incidents and its financial impact reported by scheduled commercial banks to RBI, in the last five calendar years are as follows:

|   Calendar Year |   Number of cyber incidents reported | Financial Impact in Rs*   |
|-----------------|--------------------------------------|---------------------------|
|            2020 |                                   36 | ₹1.5 crore                |
|            2021 |                                   59 | ₹6.7 crore                |
|            2022 |                                   98 | ₹5.8 crore                |
|            2023 |                                   66 | ₹4.2 crore                |
|            2024 |                                   82 | ₹114.77 crore             |

(c) and (d) RBI from time to time, issues various circulars/ guidelines to the banks to strengthen their cyber security framework, which inter-alia includes, Master Direction on Digital Payment Security Controls dated February 18, 2021, Master Direction on Outsourcing of Information Technology  Services  dated  April  10,  2023,  Master  Direction  on  Information  Technology Governance,  Risk,  Controls  and  Assurance  Practices  dated  November  7,  2023,  etc.  These circulars/ guidelines are required to be implemented by the banks in a time bound manner. The implementation of cyber security related guidelines is assessed periodically through onsite and offsite inspections by the CSITE team of RBI and vulnerabilities found, if any, are taken up with concerned banks for remediation and necessary compliance.

******