🏦 Finance & Banking
Finance & Banking Compliance Landscape
All major frameworks, critical controls, and top audit failure triggers for finance & banking organisations.
🌍 Global
PCI-DSS v4.0
Payment Card Industry Data Security Standard v4.0
Any entity processing card payments
12
Requirements
Critical Controls
Privileged Access Control (Req 7+8)
Least-privilege access to cardholder data; MFA on all non-console admin access; service account vaulting required.
Continuous Vulnerability Scanning (Req 11)
Internal and external scans every 90 days. Penetration test annually and after significant change.
Audit Log Integrity (Req 10)
Automated log review daily. Tamper-evident log storage. 12-month retention, 3 months immediately accessible.
Network Segmentation (Req 1)
Cardholder Data Environment (CDE) isolated from all out-of-scope systems. Firewall rule set reviewed every 6 months.
Encryption at Rest & Transit (Req 3+4)
PAN stored only with strong cryptography (AES-256). TLS 1.2+ for all transmission of cardholder data.
⚠️ Top Audit Failure Triggers
✕
Default POS/payment system credentials not changed post-installation
✕
CDE network not segmented — flat network allows lateral movement
✕
Log review not performed daily; SIEM alerts not documented
✕
MFA missing on remote access to CDE (VPN, RDP, cloud console)
✕
Pen test not performed within last 12 months or after infrastructure change
🇮🇳 India
RBI IT Framework
RBI Master Direction on IT Governance & Cyber Security
All Scheduled Banks, NBFCs, Payment Banks
6
Domains
Critical Controls
IT Governance — Board Oversight
Board-level IT Strategy Committee and IT Steering Committee mandatory. CISO must report to Board, not CTO.
Privileged Access Management
PAM solution mandatory for all critical banking systems. Shared passwords prohibited. Quarterly access certification.
Internet Banking Security
MFA on all internet banking transactions. Transaction anomaly detection. Session timeout ≤10 mins idle.
Cyber Crisis Management Plan
CCMP must be tested annually via simulation. Response team, escalation matrix, and RBI reporting procedure required.
⚠️ Top Audit Failure Triggers
✕
No dedicated CISO — IT security responsibility merged with operations
✕
Internet banking using single-factor authentication
✕
CCMP not tested in last 12 months or not shared with RBI upon request
✕
Third-party (outsourced) access to banking systems not monitored via PAM
🇺🇸 USA / Listed
SOX ITGC
Sarbanes-Oxley Act — IT General Controls (Sec 302 & 404)
Public companies listed on US exchanges
4
Control Domains
Critical Controls
Logical Access Controls
Access provisioning, review, and revocation processes. Segregation of duties (SoD) in ERP/financial systems.
Change Management
All changes to financial systems require documented approval, testing evidence, and post-deployment verification.
Computer Operations & Backup
Job scheduling, backup completion monitoring, recovery test evidence. Documented on-call escalation procedures.
Program Development
SDLC controls for financial system changes. UAT sign-off, security review, and segregation from production during development.
⚠️ Top Audit Failure Triggers
✕
Developers have direct access to production financial systems (SoD violation)
✕
Change tickets lack business owner approval or test evidence
✕
User access reviews not performed quarterly — terminated accounts remain active
✕
No evidence of backup restoration test in last 12 months
🌍 Global Banks
SWIFT CSP
SWIFT Customer Security Programme
All SWIFT-connected financial institutions
32
Controls
Critical Controls
Secure SWIFT Environment
SWIFT-related components in dedicated, restricted zone. No internet access from SWIFT infrastructure.
Restrict Access to SWIFT
MFA on all SWIFT operator accounts. Jump servers for all access. No shared credentials.
Detect Anomalies in SWIFT Records
Automated monitoring for unusual transaction patterns. Real-time alerts on payment anomalies.
⚠️ Top Audit Failure Triggers
✕
SWIFT Alliance environment on shared server with other banking applications
✕
Operator accounts without MFA — password-only authentication
✕
No automated monitoring of SWIFT payment messages for anomalies
🇪🇺 EU / Global
GDPR
General Data Protection Regulation
Any org processing EU residents' data
99
Articles
Critical Controls
Lawful Basis Documentation
Every processing activity must have documented lawful basis (consent, contract, legal obligation, legitimate interest).
Right to Erasure (Article 17)
Data deletion mechanism operational within 30 days. Propagated to all processors and sub-processors.
72-Hour Breach Notification
Personal data breaches reported to supervisory authority within 72 hours. High-risk breaches also notified to individuals.
Privacy by Design
Data minimisation, pseudonymisation, and access controls built into new systems from inception — not bolted on.
⚠️ Top Audit Failure Triggers
✕
No Records of Processing Activities (RoPA) maintained — Article 30 violation
✕
Data breach discovered but not reported to DPA within 72 hours
✕
Cookie consent banner using pre-checked boxes or no reject option
✕
No DPA appointed for large-scale systematic processing of personal data
🇮🇳 India
SEBI CSCRF
SEBI Cybersecurity & Cyber Resilience Framework 2023
Stock brokers, Depositories, AMCs, MIIs
5
Pillars
Critical Controls
Cyber Governance
Mandatory CISO, Cyber Security Policy, and Board-level oversight. Annual third-party audit required.
Cyber Resilience
Business Continuity Plan (BCP) tested bi-annually. RTO and RPO defined for all critical trading systems.
Vulnerability Assessment
VAPT on all internet-facing systems bi-annually. Critical vulnerabilities remediated within 30 days.
⚠️ Top Audit Failure Triggers
✕
No appointed CISO or CISO lacks board-level reporting authority
✕
BCP not tested in last 6 months; RTO/RPO not documented
✕
Internet-facing trading portal VAPT overdue — findings unremediated
Governance & Standards Also Applicable
ISO 27001:2022
ISMS Standard
Baseline ISMS certification increasingly required for banking vendor onboarding and GCC operations.
NIST CSF 2.0
Risk Framework
Identify, Protect, Detect, Respond, Recover framework adopted by Indian regulators as reference.
DPDP Act 2023
India Data Protection
Digital Personal Data Protection Act applies to all customer data held by banks and NBFCs.
DORA (EU)
Digital Operational Resilience
ICT risk management, third-party risk, and incident reporting for EU financial entities from Jan 2025.