Frameworks · Asia-Pacific
Paragraph 13 asks you to assess each change’s impact, apply it with approvals and a business justification, and be able to recover from a failed change. That is what an Aspian change record holds.
- Instrument
- Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023 (RBI/2023-24/107, DoS.CO.CSITEG/SEC.7/31.01.015/2023-24)
- In force
- Issued 7 November 2023; effective 1 April 2024 (para 1(c))
- For
- Banks and other entities regulated by the Reserve Bank of India.
| Clause | What it requires | Evidenced by |
|---|---|---|
| Para 13(a)-(d) Change and Patch Management | Assess the impact of applying a change or patch; apply changes securely with approvals and documented business justification; have a way to recover from failed changes.Source: rbi.org.in | The change record: impact (risk and blast radius), approvals, the linked work item as justification, and the backout plan linked to any rollback that ran. |
| Para 15(a)-(c) Audit trails | Critical applications must log activity in enough detail to support audit, forensics, dispute resolution and non-repudiation, and logs must be monitored regularly.Source: rbi.org.in | The signed, append-only audit chain, with streaming to your SIEM. |
| Para 19(a)-(c) Access control | Grant access only on business need; supervise, log and review privileged users; require MFA for privileged users of critical systems.Source: rbi.org.in | Just-in-time privileged access tied to an approved change, with the session recorded. |
| Para 10 and 12(e)-(g) Vendor risk | Run proportionate vendor risk assessments for third-party IT arrangements; secure source-code access or escrow and vendor vulnerability certifications for critical applications.Source: rbi.org.in | Supplier engagements, with source code kept in your own organisation and an exit plan per engagement. |
Clause references and requirements were read on 8 November 2026 from the official text. Aspian Cloud evidences these clauses; it doesn’t make you compliant, and your assessor decides.
Want the mapping for a framework we don’t list? Ask us. A new framework is a data file, not a code change.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.