IT Framework for the HFCs

2.       IT Strategy Committees,

3.       CEOs,

4.       Business Executives,

5.       Chief Information Officers (CIOs),

6.       Chief Technology Officers (CTOs),

7.       IT Steering Committees (operating at an executive level and focusing on priority setting, resource allocation and project tracking),

8.       Chief Risk Officer and Risk Committees

An independent director

Other Members:

CIO & CTO

Frequency of Meeting:

An appropriate frequency with maximum gap of 6 months between two meetings

Role of the Committee:

1.       Providing input to other Board committees and Senior Management

2.       Carrying out review and amending the IT strategies in line with the corporate strategies, Board Policy reviews, cyber security arrangements and any other matter related to IT Governance

1. Approving IT strategy and policy documents and ensuring that the management has put an effective strategic planning process in place;
2. Ascertaining that management has implemented processes and practices that ensure that the IT delivers value to the business;
3. Ensuring IT investments represent a balance of risks and benefits and that budgets are acceptable;
4. Monitoring the method that management uses to determine the IT resources needed to achieve strategic goals and provide high-level direction for sourcing and use of IT resources;
5. Ensuring proper balance of IT investments for sustaining HFC’s growth and becoming aware about exposure towards IT risks and controls.

1. Confidentiality – Ensuring access to sensitive data to authorized users only.
2. Integrity – Ensuring accuracy and reliability of information by ensuring that there is no modification without authorization.
3. Availability – Ensuring that uninterrupted data is available to users when it is needed.
4. Authenticity – For IS it is necessary to ensure that the data, transactions, communications or documents (electronic or physical) are genuine.

1. Identification and Classification of Information Assets.
2. Segregation of functions and responsibilities relating to system administration, database administration and transaction processing.
3. Role based Access Control by clear delegation of authority for right to upgrade/change user profiles and permissions and also key business parameters (eg. interest rates) which should be documented.
4. Personnel with privileged access like system administrator, cyber security personnel, etc should be subject to rigorous background check and screening.
5. Physical Security by creating a secured environment for physical security of IS Assets such as secure location of critical data, restricted access to sensitive areas like data center etc.
6. For each transaction, there must be at least two individuals (Maker-checker is one of the important principles of authorization in the information systems of financial entities) necessary for its completion as this will reduce the risk of error and will ensure reliability of information.
7. Incident Management – The IS Policy should define what constitutes an incident. HFCs shall develop and implement processes for preventing, detecting, analysing and responding to information security incidents.
8. Trails- HFCs shall ensure that audit trails exist for IT assets satisfying its business requirements. If an employee, for instance, attempts to access an unauthorized section, this improper activity should be recorded in the audit trail.
9. Public Key Infrastructure (PKI) – HFCs may increase the usage of PKI to ensure confidentiality of data, access control, data integrity, authentication and nonrepudiation.

b.      Spreading awareness among the stakeholders including employees

(i) Detection

(ii) Response

(iii) Recovery and

(iv) Containment

1.  prevent cyber-attacks

2. promptly detect any cyber-intrusions

3. face emerging cyber-threats such as ‘zero-day’ attacks, remote access threats, and targeted attacks

incidents to its IT Steering Committee and the Risk Management Committee.

Incidents involving compromise of the IT systems of the HFC such as data breach, data destruction etc. severely affecting the operations of the company shall be reported to the NHB along with the action take thereon by the HFC, within two working days.

1. prioritizing and responding to change proposals from business,
2. cost benefit analysis of the changes proposed,
3. assessing risks associated with the changes proposed,
4. change implementation, monitoring and reporting.

of an effective system generated MIS (indicative list)

a) A dashboard for the Top Management summarising financial position vis-a-vis

targets. It may include information on trend on returns on assets across categories,

major growth business segments, movement of net-worth etc.

b) System enabled identification and classification of NPA as well as generation of

MIS reports in this regard.

c) The MIS should facilitate pricing of products, especially large ticket loans.

d) The MIS should capture regulatory requirements and their compliance.

e) Financial Reports including operating and non-operating revenues and expenses,

cost benefit analysis of segments/verticals, cost of funds, etc. (also regulatory

compliance at transaction level)

f) Reports relating to treasury operations.

g) Fraud analysis- Suspicious transaction analysis, embezzlement, theft or suspected

money laundering, misappropriation of assets, manipulation of financial records

etc. The regulatory requirement of reporting frauds, if any, should be system

driven.

h) Capacity and performance analysis of IT security systems

i) Incident reporting, their impact and steps taken for non -recurrence of such events

in the future.

a.       Responsibilities for compliance/sustenance of compliance, reporting lines, timelines for submission of compliance, authority for accepting compliance should be clearly delineated in the framework.

b.      The framework may provide for an audit-mode access for auditors/ inspecting/ regulatory authorities.

c.       The framework should clearly prescribe the reporting framework

Guidance issued by Professional bodies like ISACA, IIA, ICAI in this regard shall be referred. For instance, ICAI has published “Standard on Internal Audit (SIA) 14: Internal Audit in an Information Technology Environment”.

once in two years or for three successive terms if conducted once a year.

Recovery strategy/ Contingency Plan- HFCs shall try to fully understand the vulnerabilities associated with interrelationships between various systems, departments and business processes. The BCP should come up with the probabilities of various failure scenarios. Evaluation of various options should be done for recovery and the most cost-effective, practical strategy should be selected to minimize losses in case of a disaster.

b) Access to books and records / Audit and Inspection: This would include:

1. Ensure that the HFC has the ability to access all books, records and information relevant to the outsourced activity available with the service provider. For technology outsourcing, requisite audit trails and logs for administrative activities should be retained and accessible to the HFC based on approved requests.
2. Provide the HFC with the right to conduct audits on the service provider whether by its internal or external auditors, or by external specialists appointed to act on its behalf and to obtain copies of any audit or review reports and findings made on the service provider in conjunction with the services performed for the HFC.
3. The contractual agreement may include clauses to allow the National Housing Bank or persons authorized by it to access the HFC’s documents, records of transactions, and other necessary information given to, stored or processed by the service provider within a reasonable time. This includes information maintained in paper and electronic formats.

1. Instituting an appropriate governance mechanism for outsourced processes, comprising of risk based policies and procedures, to effectively identify, measure, monitor and control risks associated with outsourcing in an end to end manner;
2. Defining approval authorities for outsourcing depending on nature of risks and materiality of outsourcing;
3. Developing sound and responsive outsourcing risk management policies and procedures commensurate with the nature, scope, and complexity of outsourcing arrangements;
4. Undertaking a periodic review of outsourcing strategies and all existing material outsourcing arrangements;
5. Evaluating the risks and materiality of all prospective outsourcing based on the framework developed by the Board;
6. Periodically reviewing the effectiveness of policies and procedures;
7. Communicating significant risks in outsourcing to the HFC’s Board on a periodic basis;
8. Ensuring an independent review and audit in accordance with approved policies and procedures;
9. Ensuring that contingency plans have been developed and tested adequately;
10. HFC should ensure that the business continuity preparedness is not adversely compromised on account of outsourcing. HFCs are expected to adopt sound business continuity management practices as issued by NHB and seek proactive assurance that the outsourced service provider maintains readiness and preparedness for business continuity on an ongoing basis.