# QS Assets — RBI Cyber Security Framework Mapping

**Date:** 2026-07-26  
**Audience:** Regulated banks / NBFCs / payment-system operators assessing QS Assets as an IT asset / ITSM platform (SaaS, private MPLS SaaS, or on-prem appliance).  
**Status:** Control **design alignment** for bank IT risk assessment — **not** an RBI approval, license, or certification.

Primary references (customer must apply the circular version in force for their entity class):

- RBI *Cyber Security Framework for Banks* (and subsequent advisories)
- RBI *Guidelines on Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds* (as applicable)
- CERT-In Directions (log retention, incident reporting timelines)
- India’s DPDP Act 2023 (personal data)

QS Assets is **application software**. Board-approved IS policy, SOC operations, CERT-In reporting mailboxes, and third-party audits remain **customer / bank obligations**.

---

## How to use

1. Map each RBI theme to Evidence in this product + your org SOPs.  
2. Prefer **private SaaS on MPLS** or **on-prem appliance** when data residency / network segmentation requires it (`docs/PRIVATE_SAAS_MPLS.md`, `docs/ONPREM_LAUNCH.md`).  
3. Attach VAPT evidence from a CERT-In empanelled auditor to Changes (`vaptEvidence` fields) — the product stores evidence; it does not perform the VAPT.  
4. Do **not** claim “RBI certified” in marketing or RFPs.

---

## Theme → product control matrix

| RBI CSF / IT risk theme | Product capability | Evidence | Bank residual duty |
|-------------------------|--------------------|----------|--------------------|
| **Governance & board oversight** | Role-based admin; Platform Owner vs Tenant Admin separation; audit trails | `/admin`, RBAC, `audit-logs` | Board IS policy, risk appetite, CISO reporting |
| **Identify (asset inventory)** | Discovery agents, agentless scans, CMDB, cloud connectors | Discovery, CMDB, Assets modules | Scope critical assets; network allowlists |
| **Protect — access control** | MFA (TOTP), SSO SAML/OIDC, password policy (≥14 + complexity), lockout, least-privilege roles | `mfa.service.ts`, `sso.service.ts`, `password-policy.ts`, `POLICY_ACCESS_CONTROL.md` | Enforce MFA for all privileged bank users; IdP policies |
| **Protect — encryption** | TLS in transit; vault-sealed secrets; optional disk encryption checks via CIS/RBI endpoint policies | `vault-crypto.ts`, Caddy TLS, Compliance policies | HSM/KMS for bank keys; DB TDE on your Postgres |
| **Protect — network security** | Private SaaS / appliance on bank MPLS; collectors ACL; outbound SSRF guards | `PRIVATE_SAAS_MPLS.md`, `outbound-safety.ts`, collector ACLs | Segment VLANs; WAF; no public exposure unless approved |
| **Protect — change management** | CAB gates, dual approval for high-risk scripts, CODEOWNERS + CI | `changes.service.ts`, script dual approval, `POLICY_CHANGE_MANAGEMENT.md` | CAB calendar; emergency change SOP |
| **Detect — monitoring & logging** | Audit export (hash-chained), alerts, syslog/NetFlow/SNMP on appliance, SIEM webhook channels | `audit-logs`, Alerts, NMS collectors, Notification channels | SIEM retention ≥ bank policy; 24×7 SOC |
| **Detect — vulnerability / patch** | CVE matching, patch rings (PILOT→STAGED→ALL), CIS/RBI endpoint policy templates | Patches, Vulnerabilities, Compliance | SLA for critical CVEs per RBI advisories |
| **Respond — incident handling** | Incident tickets, IR plan mapping, CERT-In timing in runbook | Tickets/ITSM; `INCIDENT_RESPONSE_PLAN.md` | CERT-In 6-hour reporting; DPB/DPDP notices |
| **Recover — BCP/DR** | Backup CLI (appliance), BCP runbook, restore drill log | `BCP_DR_RUNBOOK.md`, `RESTORE_DRILL_LOG.md`, `qsassets backup` | Tested RTO/RPO; DR site |
| **Vendor / third-party risk** | Subprocessor register; BYO integrations (customer accounts) | `VENDOR_REGISTER.md`, Integrations setup-first | Bank vendor due diligence; DPAs |
| **Data localization / residency** | On-prem / private MPLS hub keeps data on bank-controlled infra; SaaS region per contract | Deploy docs; Trust Center subprocessors | Contractual residency; India hosting where required |
| **Audit & compliance evidence** | Compliance module policies (CIS + RBI templates), reports, access-review procedure | Compliance UI “Setup Default Policies”, `ACCESS_REVIEW_PROCEDURE.md` | Internal IS audit; RBI inspection packs |

---

## In-product RBI endpoint policy templates

When a Tenant Admin runs **Compliance → Setup Default Policies**, templates include **RBI:** prefixed policies (alongside CIS), e.g.:

- Privileged access MFA expectation (platform enforce + IdP)
- Privileged session / screen-lock ≤ 15 minutes (endpoint)
- Audit logging enabled on endpoints
- Disk encryption required
- Removable media control
- Unauthorized remote admin ports (RDP/SSH root)

These are **configuration baselines** for agents — enable and tune per bank standard.

---

## Recommended deployment for RBI-regulated entities

| Pattern | When |
|---------|------|
| **On-prem appliance** | Single bank / DC; air-gap or tightly controlled LAN |
| **Private multi-tenant SaaS on MPLS** | Group / shared services hosting multiple entities with tenant isolation |
| **Public cloud SaaS** | Only with bank-approved cloud, contractual residency, and risk acceptance |

Hardening defaults for regulated installs:

```bash
JWT_EXPIRATION=15m          # short-lived access tokens
JWT_REFRESH_EXPIRATION=7d
DISABLE_PUBLIC_SIGNUP=true
# MFA: enforce in Tenant Settings → Security for all admins
# Prefer PRIVATE_SAAS=true or DEPLOYMENT_MODE=onprem on bank network
```

Password policy (application accounts): **minimum 14 characters**, upper, lower, digit, special (`password-policy.ts`).

Audit retention: platform default retention jobs keep audit-oriented data on a **≥180 day** CERT-In-aligned footing; banks should set tenant `auditRetentionDays` to match internal / RBI inspection needs (often longer).

---

## Explicit non-claims

| Do not claim | Reality |
|--------------|---------|
| “RBI approved / certified” | RBI does not certify this product class via a public badge |
| “Meets all RBI circulars automatically” | Circulars bind the **regulated entity**; software is one control |
| “VAPT complete” | Requires CERT-In empanelled assessment ([VAPT_SCOPE.md](VAPT_SCOPE.md)) |

---

## Related

- [CONTROL_MAPPING_MATRIX.md](../CONTROL_MAPPING_MATRIX.md)  
- [SECURITY.md](../../SECURITY.md) · Trust Center `/security`  
- [INCIDENT_RESPONSE_PLAN.md](../INCIDENT_RESPONSE_PLAN.md)  
- [PRIVATE_SAAS_MPLS.md](../PRIVATE_SAAS_MPLS.md)  
- [compliance/EXTERNAL_ENGAGEMENT_BRIEF.md](EXTERNAL_ENGAGEMENT_BRIEF.md)