Directions on IT Framework for the NBFC Sector – RBI keen on implementing several operational requirements, by Anita Baid

IT Governance

b.      IT Strategy Committees,

c.       CEOs,

d.      Business Executives,

e.       Chief Information Officers (CIOs),

f.       Chief Technology Officers (CTOs),

g.      IT Steering Committees

(operating at an executive level and focusing on priority setting, resource allocation and project tracking),

h.      Chief Risk Officer and Risk Committees

An independent director

Other Members:

CIO & CTO

Frequency of Meeting:

An appropriate frequency with maximum gap of 6 months between two meetings

Role of the Committee:

1.       Providing input to other Board committees and Senior Management

2.       Carrying out review and amending the IT strategies in line with the corporate strategies, Board Policy reviews, cyber security arrangements and any other matter related to IT Governance

1. Approving IT strategy and policy documents and ensuring that the management has put an effective strategic planning process in place;
2. Ascertaining that management has implemented processes and practices that ensure that the IT delivers value to the business;
3. Ensuring IT investments represent a balance of risks and benefits and that budgets are acceptable;
4. Monitoring the method that management uses to determine the IT resources needed to achieve strategic goals and provide high-level direction for sourcing and use of IT resources;
5. Ensuring proper balance of IT investments for sustaining NBFC’s growth and becoming aware about exposure towards IT risks and controls.

IT Policy

Information and Cyber Security

1. Confidentiality – Ensuring access to sensitive data to authorized users only.
2. Integrity – Ensuring accuracy and reliability of information by ensuring that there is no modification without authorization.
3. Availability – Ensuring that uninterrupted data is available to users when it is needed.
4. Authenticity – For IS it is necessary to ensure that the data, transactions, communications or documents (electronic or physical) are genuine.

1. Identification and Classification of Information Assets.
2. Segregation of functions and responsibilities relating to system administration, database administration and transaction processing.
3. Role based Access Control by clear delegation of authority for right to upgrade/change user profiles and permissions and also key business parameters (eg. interest rates) which should be documented.
4. Personnel with privileged access like system administrator, cyber security personnel, etc should be subject to rigorous background check and screening.
5. Physical Security by creating a secured environment for physical security of IS Assets such as secure location of critical data, restricted access to sensitive areas like data center etc.
6. For each transaction, there must be at least two individuals (Maker-checker is one of the important principles of authorization in the information systems of financial entities) necessary for its completion as this will reduce the risk of error and will ensure reliability of information.
7. Incident Management – The IS Policy should define what constitutes an incident. NBFCs shall develop and implement processes for preventing, detecting, analysing and responding to information security incidents.
8. Trails- NBFCs shall ensure that audit trails exist for IT assets satisfying its business requirements. If an employee, for instance, attempts to access an unauthorized section, this improper activity should be recorded in the audit trail.
9. Public Key Infrastructure (PKI) – NBFCs may increase the usage of PKI to ensure confidentiality of data, access control, data integrity, authentication and nonrepudiation.

b.      Spreading awareness among the stakeholders including employees

(i) Detection

(ii) Response

(iii) Recovery and

(iv) Containment

1.  prevent cyber-attacks

2. promptly detect any cyber-intrusions

3. face emerging cyber-threats such as ‘zero-day’ attacks, remote access threats, and targeted attacks

IT Operations

1. prioritizing and responding to change proposals from business,
2. cost benefit analysis of the changes proposed,
3. assessing risks associated with the changes proposed,
4. change implementation, monitoring and reporting.

IS Audit

a.       Responsibilities for compliance/sustenance of compliance, reporting lines, timelines for submission of compliance, authority for accepting compliance should be clearly delineated in the framework.

b.      The framework may provide for an audit-mode access for auditors/ inspecting/ regulatory authorities.

c.       The framework should clearly prescribe the reporting framework

Guidance issued by Professional bodies like ISACA, IIA, ICAI in this regard shall be referred. For instance, ICAI has published “Standard on Internal Audit (SIA) 14: Internal Audit in an Information Technology Environment”.

Business Continuity Planning

b.      Recovery strategy/ Contingency Plan- NBFCs shall try to fully understand the vulnerabilities associated with interrelationships between various systems, departments and business processes. The BCP should come up with the probabilities of various failure scenarios. Evaluation of various options should be done for recovery and the most cost-effective, practical strategy should be selected to minimize losses in case of a disaster.

b.      CIO shall be responsible for formulation, review and monitoring of BCP to ensure continued effectiveness

IT Services Outsourcing

b) Access to books and records / Audit and Inspection: This would include:

1. Ensure that the NBFC has the ability to access all books, records and information relevant to the outsourced activity available with the service provider. For technology outsourcing, requisite audit trails and logs for administrative activities should be retained and accessible to the NBFC based on approved requests.
2. Provide the NBFC with the right to conduct audits on the service provider whether by its internal or external auditors, or by external specialists appointed to act on its behalf and to obtain copies of any audit or review reports and findings made on the service provider in conjunction with the services performed for the NBFC.
3. The contractual agreement may include clauses to allow the Reserve Bank of India or persons authorized by it to access the NBFC’s documents, records of transactions, and other necessary information given to, stored or processed by the service provider within a reasonable time. This includes information maintained in paper and electronic formats.

1. Instituting an appropriate governance mechanism for outsourced processes, comprising of risk based policies and procedures, to effectively identify, measure, monitor and control risks associated with outsourcing in an end to end manner;
2. Defining approval authorities for outsourcing depending on nature of risks and materiality of outsourcing;
3. Developing sound and responsive outsourcing risk management policies and procedures commensurate with the nature, scope, and complexity of outsourcing arrangements;
4. Undertaking a periodic review of outsourcing strategies and all existing material outsourcing arrangements;
5. Evaluating the risks and materiality of all prospective outsourcing based on the framework developed by the Board;
6. Periodically reviewing the effectiveness of policies and procedures;
7. Communicating significant risks in outsourcing to the NBFC’s Board on a periodic basis;
8. Ensuring an independent review and audit in accordance with approved policies and procedures;
9. Ensuring that contingency plans have been developed and tested adequately;
10. NBFC should ensure that the business continuity preparedness is not adversely compromised on account of outsourcing. NBFCs are expected to adopt sound business continuity management practices as issued by RBI and seek proactive assurance that the outsourced service provider maintains readiness and preparedness for business continuity on an ongoing basis.