RBI's IT governance directions, what regulated entities must show

Base IT governance on strategic alignment, risk management, resource management, performance management and business continuity and disaster recovery.

Put in place an IT governance framework that sets structure, Board and senior management roles and oversight for IT and cyber risk.

Make the enterprise or operational risk policy include periodic assessment of inherent and potential IT risks.

Have the Board approve strategies and policies for IT, information assets, business continuity, information security and cyber security, including incident response and crisis management.

Have the Board review those strategies and policies at least annually.

Form a Board-level IT Strategy Committee with at least three directors, an independent chairperson with strong IT expertise and technically competent members.

Hold IT Strategy Committee meetings at least quarterly.

Have the committee oversee IT planning, accountability, risk processes, budgets and an annual review of continuity and disaster recovery.

Have senior management execute the IT strategy, run IT effectively, maintain IT risk processes and keep cyber security robust.

Set up an IT Steering Committee with senior representation from IT and business functions.

Hold IT Steering Committee meetings at least quarterly.

Appoint a sufficiently senior, technically competent and experienced Head of IT Function.

Have the Head of IT Function act as first line of defence for assessing and managing IT controls and risk, covering internal controls and compliance.

Put in place an IT service management framework that supports operational resilience, including at disaster recovery sites.

Classify information assets by confidentiality, integrity and availability based on how critical they are.

Avoid outdated and unsupported hardware and software and monitor end-of-support and maintenance contract dates.

Develop a technology refresh plan to replace hardware and software before they reach end of support.

Run vendor risk assessment and proportionate controls for IT and cyber security third-party arrangements that fall outside the separate outsourcing directions, covering concentration, conflicts, single points of failure, customer data and supply chain.

Assess IT capacity needs at least annually against past peaks, current needs and future plans, with review by the IT Strategy Committee.

Follow a consistent, formally defined project management approach for IT projects.

Obtain source code for critical applications from vendors, or set up a source code escrow or similar arrangement, including updates and fixes.

Obtain a certificate or written confirmation from the developer that the application is free of known vulnerabilities, malware and covert channels, and again after material code changes.

Put any new IT application introduced as a business product through product approval and quality assurance.

Keep documented change and patch management policies that assess business impact, apply changes securely and on time with approval, justify changes and allow recovery from failed changes.

Keep a documented data migration policy with business and application owner sign-offs at each stage and audit trails.

Give every IT application that can access or affect critical or sensitive information audit and logging capability and audit trails.

Monitor audit trails and system logs regularly to detect unauthorised activity.

Use strong key lengths, algorithms, cipher suites and protocols from internationally accepted standards that are not deprecated or known to be weak.

Avoid manual intervention or modification when critical application data moves between processes or applications, using straight through processing with checks and audit trails.

Allow access to information assets only where there is a valid business need, under documented standards approved by the IT Strategy Committee.

Supervise people with elevated access closely and log and periodically review their activity.

Use multi-factor authentication for privileged users of critical information systems and for critical activities based on risk.

Secure teleworking by protecting remote access, using multi-factor authentication to critical systems, identifying remote devices and protecting shared data.

Apply suitable physical and environmental controls at data centre and disaster recovery sites.

Keep data centre and disaster recovery sites geographically well separated so one local threat does not hit both.

Place data centre and disaster recovery sites under electronic surveillance.

Define metrics for system performance, recovery and business resumption, including recovery point and recovery time objectives, for all critical information systems.

Use a scorecard or similar method to measure IT performance and maturity.

Include IT and cyber security risks in the risk management policy and have the Risk Management Committee of the Board, with the IT Strategy Committee, review it at least yearly.

Set up an IT and information security risk management framework covering controls and processes, roles including third parties, critical systems and secure handling of data.

Guide the risk assessment of each information asset by suitable security standards or IT control frameworks.

Make sure staff and service providers follow information security and acceptable-use policies.

Review security infrastructure and policies at least yearly using experience and emerging threats, and tackle attacks such as phishing and spoofing.

Maintain an information security policy, a cyber security policy and a Cyber Crisis Management Plan.

Form an Information Security Committee under the IT Strategy Committee, led from the risk management side, to manage security policies, projects and incident reviews.

Designate a senior executive as CISO who has no direct reporting line to the Head of IT and no business targets, with a skilled office and a budget fitting the threat.

Document the CISO's duties, including cyber strategy, policy enforcement, SOC oversight, direct reporting to the executive overseeing risk, and a quarterly review to the Board or committees.

Run vulnerability assessment at least every six months and penetration testing at least every twelve months for critical systems and internet-facing systems in the DMZ, and across the system lifecycle.

Use a risk-based approach to decide how often non-critical systems are tested.

Use trained and independent information security experts or auditors for the tests.

Test production after implementation, or a test environment that matches production, and have the Information Security Committee approve any deviation.

Fix vulnerabilities and associated risks in a time-bound way and prevent known CVE-listed flaws from returning.

Document the approach to testing, including scope, coverage and vulnerability scoring such as CVSS, which may also apply to cloud-hosted systems.

Have an incident response and recovery policy covering classification, assessment, communication, containment and timely recovery.

Analyse cyber incidents, including forensic analysis where needed, for severity, impact and root cause, and take corrective and preventive action.

Have written incident response and recovery procedures that name key roles, including outsourced staff.

Have communication plans to escalate and report incidents to the Board, senior management and customers, and notify CERT-In and RBI as required.

Improve response and recovery through lessons from incidents, tests and drills, and test crisis communication with stakeholders including service providers.

Keep a BCP and DR policy based on best practice that is updated after major developments or risk assessment.

Design BCP and DR capabilities so critical operations, including security controls, can resume rapidly after cyber attacks or other incidents.

Run DR drills at least every six months for critical information systems and by risk for others.

Resolve major issues found in a DR drill and retest before the next cycle.

Make DR tests switch over to the DR site and run it as the primary site for at least a full working day, including start and end of day operations.

Test BCP and DR regularly under different scenarios to keep them current and effective.

Back up data and restore it periodically to check it can be used, keeping its integrity and protecting it from unauthorised access.

Make DR architecture and procedures strong enough to meet the defined RTO and RPO.

Aim for minimal RTO approved by the IT Strategy Committee and a near zero RPO for critical information systems.

Where RPO is not zero, document how data is reconciled when operations resume from the alternate site.

Keep system configurations and security patches identical at the data centre and the DR site.

Have BCP and DR capability across critical interconnected systems and networks, including vendors and partners, and show readiness through coordinated resilience testing.

Have the Audit Committee of the Board oversee information systems audit.

Keep an IS Audit Policy that sets mandate, authority, audit universe and frequency, approved by the Audit Committee and reviewed at least annually.

Have the Audit Committee review critical IT, information security and cyber security issues and guide management.

Have a separate IS audit function or skilled resources inside internal audit, and keep accountability for any external IS audit with internal audit.

Plan IS audits using a risk-based approach.

Consider continuous auditing of critical systems with more frequent control and risk assessments where possible.