RBI SAR Audit Checklist: 12-Point Pre-Audit Prep Guide

Sahil Dubey

Cloud DevOps & Compliance Architect · CISA #232322528, CDPSE, ISO 27001 LA

Published 18 June 2026

RBI SAR Audit Checklist: Your 12-Point Pre-Audit Prep Guide

The RBI Security Audit Report (SAR) is India's mandatory cybersecurity assessment framework for regulated entities under the Reserve Bank of India. If you're facing an audit within weeks, a structured 12-point checklist ensures you meet all control objectives without last-minute gaps. This guide—informed by CISA, CISM, and ISO 27001 Lead Auditor expertise—walks you through essentials: governance documentation, access controls, encryption standards, incident response workflows, and evidence artifacts. At Praxis-Q, we've compressed audit readiness from 4–6 months to 3–4 weeks by systematizing this exact checklist with certified assessors.

1. Governance & Policy Framework (Points 1–3)

Why it matters: RBI SAR auditors begin by reviewing your information security governance structure. Weak policies or missing documentation is the #1 finding in Indian banking audits.

• Point 1: Information Security Policy
  • Board-approved policy document (last review date within 12 months)
  • Covers data classification, incident handling, access controls, encryption
  • Aligned with RBI guidelines and DPDP Act 2023 (personal data protection)
  • Cascaded into role-specific procedures (e.g., DBA, SOC, compliance)
• Point 2: Risk Management Framework
  • Annual risk assessment covering IT, operational, and regulatory risks
  • Risk register with controls mapped to each risk
  • Evidence of board/audit committee review and sign-off
  • Residual risk acceptance documentation
• Point 3: Audit & Compliance Committee Charter
  • Committee minutes from last 12 months showing cybersecurity agenda items
  • Third-party audit reports (SOC 2, ISO 27001, PCI DSS) filed and discussed
  • Management action tracker for audit findings

2. Access Control & Identity Management (Points 4–6)

Why it matters: RBI SAR audits rigorously verify that only authorized users access sensitive systems. Weak PAM (Privileged Access Management) is a critical finding.

• Point 4: User Access Provisioning & De-provisioning
  • Role-based access control (RBAC) matrix approved by department heads
  • Evidence of timely access removal (within 5 days of termination/role change)
  • Quarterly user access reviews signed off by business owners
  • Documented exceptions with approval records
• Point 5: Privileged Account Management (PAM)
  • Dedicated PAM tool (e.g., CyberArk, BeyondTrust) or manual controls with strong logging
  • Privileged account inventory with justification for each account
  • Mandatory password rotation logs (90 days for DB/OS admins)
  • Session recording for critical privileged actions (sample logs from last 3 months)
• Point 6: Multi-Factor Authentication (MFA)
  • MFA enforced for all remote access (VPN, RDP, SSH)
  • MFA enabled for sensitive applications (core banking, payment systems)
  • Configuration records and support ticket logs showing MFA implementation

3. Data Protection & Encryption (Points 7–8)

Why it matters: DPDP Act 2023 and RBI guidance mandate encryption of sensitive personal and financial data. Non-compliance carries fines and reputational risk.

• Point 7: Data Classification & Encryption at Rest
  • Data classification policy (public, internal, confidential, restricted)
  • Inventory of systems storing sensitive data (customer PII, account numbers, cards)
  • Encryption standards (AES-256 or equivalent) applied to all restricted data
  • Key management procedures (key rotation, escrow, access logs)
  • Encryption validation reports from CISO or appointed assessor
• Point 8: Encryption in Transit (TLS/SSL)
  • TLS 1.2+ enforced on all external-facing applications
  • Valid SSL certificates from recognized CAs (not self-signed for production)
  • Evidence of quarterly vulnerability scans showing no weak cipher suites
  • API encryption standards documented (OAuth 2.0, TLS, signing)

4. Incident Response & Business Continuity (Points 9–10)

Why it matters: RBI expects rapid incident detection, logging, and breach notification. Weak IR capability is flagged as a critical gap.

• Point 9: Incident Response Plan & Logs
  • Documented IR plan covering detection, containment, eradication, recovery
  • Defined escalation matrix (time-to-report to CISO: <2 hours)
  • RBI/DPDP breach notification procedures (72-hour rule for personal data)
  • Sample incident logs from last 12 months (security events, malware detections)
  • Post-incident reviews or "lessons learned" documentation
• Point 10: Business Continuity & Disaster Recovery
  • BCP/DRP documents approved by board/ALCO
  • Recovery Time Objective (RTO) and Recovery Point Objective (RPO) defined per system
  • Evidence of annual BC/DR testing with results and sign-off
  • Backup integrity validation (successful restore tests, encryption verified)

5. Monitoring, Logging & Third-Party Audits (Points 11–12)

• Point 11: Security Monitoring & SIEM
  • SIEM or log aggregation tool in place (Splunk, ELK, Exabeam)
  • Logs retained for minimum 6 months (preferably 1+ year)
  • Alerts configured for suspicious activities (failed logins, privilege escalation)
  • SOC team on-call procedures and alert response times documented
  • Sample alert investigation records from last quarter
• Point 12: Third-Party Risk & Vendor Audits
  • Vendor risk assessment framework (security questionnaire, SOC 2/ISO 27001 proof)
  • Data processing agreements (DPA) signed with all vendors handling sensitive data
  • Annual third-party audit reports (SOC 2 Type II preferred) or attestations
  • Contractual data protection & incident notification clauses
  • Inventory of critical vendors with risk ratings

Supporting Documentation Artifact Checklist

Organize evidence into these folders for auditor access:

• Board minutes & approvals (policies, risk assessments)
• Risk register & remediation tracker
• Access control reports (user lists, PAM logs, MFA configs)
• Encryption inventory & key management logs
• Vulnerability scan results (last 3 months)
• Incident logs & response records
• BC/DR test results & backup validation reports
• Third-party audit reports & vendor agreements
• VAPT (Vulnerability Assessment & Penetration Test) reports (latest)

FAQ: RBI SAR Audit Preparation

1. How long does RBI SAR audit readiness typically take?

At Praxis-Q, using this 12-point checklist and certified CISA/CISM assessors, we compress readiness from 4–6 months to 3–4 weeks. This fast-track is possible when you already have foundational controls (e.g., SIEM, PAM tool, policies). If you're starting from scratch, expect 8–12 weeks. The checklist prioritizes high-impact controls first.

2. What's the difference between RBI SAR and ISO 27001?

RBI SAR is India-specific, regulatory-driven, and focuses on banking cybersecurity maturity (governance, access, encryption, incident response). ISO 27001 is global, certification-based, and broader in scope (77 controls). Many entities pursue both: ISO 27001 as the foundational framework, then layer RBI SAR requirements on top.

3. Is MFA mandatory for all systems under RBI SAR?

RBI SAR mandates MFA for remote access (VPN, RDP) and sensitive applications (core banking, payments, admin portals). Internal LAN access to non-sensitive systems may not require MFA if strong network segmentation is in place, but auditors will challenge this—MFA is the safer choice.

4. What happens if we find a critical control gap during pre-audit prep?

Document the gap, create a remediation plan with a realistic timeline (e.g., "PAM tool deployment by Month 2"), and inform your audit committee. RBI auditors expect you to have a roadmap. Acknowledge + action plan is better than hiding it. Many findings result in "in-progress" ratings rather than failures if you show commitment.

5. Do we need a VAPT (Vulnerability Assessment & Penetration Test) before RBI SAR audit?

Yes. RBI SAR auditors review your latest VAPT report. Conduct VAPT 4–6 weeks before your scheduled audit, remediate critical/high findings, and re-test. Your remediation tracker becomes audit evidence.

Next Steps: Fast-Track Your RBI SAR Audit Readiness

Use this 12-point checklist to audit yourself today. For entities with aggressive timelines or complex environments, engage certified assessors early. At Praxis-Q, our CISA and ISO 27001 Lead Auditor team will conduct a 2-week diagnostic, prioritize gaps, and hand off a remediation roadmap. We've successfully prepped 50+ Indian regulated entities (banks, fintech, payment processors) for RBI SAR audits—delivering audit-ready status in 3–4 weeks. Learn how our RBI SAR Audit Services can compress your timeline and reduce compliance risk.