RBI Ref: DoS.CO.CSITEG/SEC.1/31.01.015/2023-24

RBI IT Outsourcing & Vendor Risk Health Check

Review compliance with third-party IT risk directions: materiality thresholds, audit rights, sub-contracting chains and exit strategies.

FrameworkISO 27001:2022 RBI PA (S-633)RBI IT Governance RBI IT Outsourcing

Why it matters

A direct supervisory focus — missing mandatory clauses can invalidate contracts.

What you learn

Right-to-audit gaps, concentration risk and vendor exit viability.

Effort

~8 minutes · 12 questions · no documents required

Important notice & scope disclaimer

Directional dipstick only

These Self-Assessment Questionnaires are a high-level dipstick check to establish your current state. They are not a replacement for a formal audit, CERT-In system audit or comprehensive gap assessment.

Operational health questionnaire

Pick the option that best reflects day-to-day reality, not policy on paper.

1Governance, Materiality & Inventory

Is every IT vendor evaluated before engagement to decide whether it is 'material' based on business-disruption impact?

Chapter III · Materiality

Do you maintain a central inventory of all outsourced IT arrangements (including cloud & SaaS), reviewed annually?

Chapter III · Outsourcing Register

Before signing, is due diligence completed on the vendor's financial viability, technical competence and compliance history?

Chapter III · Due Diligence

2Contractual Safeguards

Do vendor agreements give internal / external auditors and RBI inspectors unrestricted audit and inspection rights?

Chapter IV · Right to Audit

Does the contract require prior written consent before a material vendor sub-contracts, keeping audit rights down the chain?

Chapter IV · Sub-Contracting

Does the contract state that all data belongs exclusively to you, stays segregated and cannot be repurposed?

Chapter IV · Data Ownership

3Cloud, Data Security & Monitoring

Is sensitive customer / payment data stored in India, with offshore support and cross-border flows formally risk-assessed?

Chapter V · Data Localisation

For cloud or outsourced SOC partners, do you retain direct visibility over configurations, keys and alerts?

Appendix II · Cloud Governance

Are vendor SLAs, uptime, patch compliance and security posture monitored throughout the engagement?

Chapter VI · Ongoing Monitoring

4Resilience, Exit & Termination

Do vendors have a tested BCP / DR plan, and join DR drills or provide audited BCP evidence annually?

Chapter VIII · Vendor Continuity

Do you track concentration risk — reliance on single vendors or cloud providers across functions?

Chapter III · Concentration Risk

Is there a documented exit strategy for each material vendor covering data handover and migration without downtime?

Chapter X · Exit Strategy

Bridging the gap to full assurance

From self-assessment to audit-ready compliance

The SAQ shows where you stand directionally. Formal regulatory comfort or certification needs hands-on gap closure, evidence and independent assurance — that is where Open Security Alliance steps in.

01 / Diagnostic

Full Regulatory & ISO Gap Assessment

Evidence-backed evaluation across every clause and control, with a Statement of Applicability and remediation roadmap.

02 / Audit Defense

Pre-Audit Readiness & CERT-In Audits

Mock inspections, VAPT, configuration reviews and annual cyber security audits for licensed entities.

03 / Governance

Board Advisory, CISO Reporting & Policies

Board-approved IT & cyber policies, ITSC agendas, CISO dashboards and escrow operating SOPs.

04 / Contracts

Vendor Contract Remediation

Clause-by-clause MSA review to add right-to-audit, sub-contracting and data-localisation safeguards.

Confidential discovery session

Unsure how regulators will read your gaps?

Book a 30-minute session with a principal consultant to review your SAQ results under a mutual NDA.