RBI's Cyber Security Framework for Banks (RBI/2015-16/418, issued 2 June 2016) requires scheduled commercial banks to report security incidents within two to six hours of detection and to run continuous monitoring through a Security Operations Centre. Physical security systems — alarms, fire panels, CCTV — sit inside that same operational posture. A branch alarm that isn't monitored in real time can't realistically meet a six-hour clock.
Who This Is For
- Bank risk, compliance, and audit teams preparing for an RBI inspection
- IT and security heads evaluating whether existing branch monitoring meets reporting timelines
- Vendors and integrators being evaluated as third-party service providers under RBI's outsourcing guidelines
- Anyone trying to understand where physical security fits inside a cybersecurity-framed regulation
What RBI Actually Requires
The 2016 circular requires every scheduled commercial bank to adopt a board-approved cybersecurity policy, operate a 24/7 Security Operations Centre, report incidents to RBI within two to six hours of detection, and undergo annual penetration testing by CERT-In empanelled auditors. Banks and their auditors generally treat the framework's baseline controls, including continuous monitoring and environmental safeguards, as extending to the physical infrastructure that supports IT operations — server rooms, data centres, and by extension branch security.
Why a Two-to-Six-Hour Clock Changes How You Monitor a Branch
If detection depends on a manual guard check or a monthly maintenance visit, a bank cannot reliably hit a six-hour clock — the clock starts at detection, not at the moment the incident actually happened. Continuous, automated monitoring is what makes the timeline realistically achievable, whichever platform or vendor provides it.
Meeting the clock doesn't require a custom platform specifically — an outsourced 24/7 Central Monitoring Station can meet it too. What matters to an auditor is continuous detection and verification, not who owns the software underneath it.
Outsourced Monitoring vs In-House: Both Can Be Compliant
An outsourced CMS provider falls under RBI's outsourcing-of-IT-services guidance, which means due diligence, ongoing oversight, and documentation of that vendor relationship. An in-house platform keeps the monitoring function — and the third-party risk question — inside the bank, but the bank carries the full operational burden of running it continuously.
For a bank with a handful of branches, an outsourced CMS is very likely the simpler, faster path to compliance. The case for bringing it in-house gets stronger as branch count and hardware diversity grow, and as a bank's existing security operations team is already staffed for other reasons.
What Auditors Actually Look For
- Time-stamped audit trails and documented incident logs, not just the fact that an alarm exists
- Evidence of continuous monitoring uptime and redundant communication paths in case one fails
- Vendor due-diligence documentation, if any part of monitoring is outsourced
Case in Point
Alartx gives banks continuous, automated monitoring across every branch's alarm, fire, and CCTV hardware from a single dashboard, with an omni-channel notification engine that can escalate a verified incident within minutes of detection. Built to run as a managed cloud service or fully on-premise, it lets a bank keep monitoring — and the underlying event data — inside its own operational control rather than handing it to a third-party monitoring station.
Frequently Asked Questions
How quickly must a bank report a security incident to RBI?
Within two to six hours of detection, under RBI's Cyber Security Framework circular (RBI/2015-16/418, June 2016). The clock starts at detection, not at the time the incident actually occurred, which is why continuous monitoring matters more than the incident's severity alone.
Does RBI's cybersecurity framework cover physical security like alarms and CCTV?
The framework is written primarily around cyber risk, but its baseline controls extend to the physical and environmental infrastructure that supports IT operations. Banks generally treat physical monitoring as part of the same continuous-monitoring posture, particularly around server rooms and data centres.
Do I need a 24/7 Security Operations Centre to be compliant?
Scheduled commercial banks are required to operate one under the framework. Whether that SOC's physical-security monitoring runs in-house or through an outsourced Central Monitoring Station is a separate decision — both can satisfy the underlying requirement if monitoring is genuinely continuous.
What happens if a bank can't meet the reporting timeline?
Non-compliance has led to supervisory scrutiny for banks in the past. The practical fix is almost always upstream of the reporting step itself — if detection isn't real-time, no amount of process discipline makes a six-hour clock achievable.
