Secure info systems, RBI tells banks

In the wake of increasing cyber attacks, Reserve Bank of India (RBI) on wednesday asked banks to test their information systems (IS) and check their robustness periodically.

RBI has also asked the banks to put in place appropriate business continuity plans (BCPs) and test them periodically. These ISs should also be subjected to vulnerability assessment and penetration testing (VAPT).   

A BCP document should cover policies, standards and procedures to ensure continuity, resumption and recovery of critical business processes and limit the impact of any disaster on people, processes and infrastructure (including information technology). The document should also contain steps taken to minimise the operational, financial, legal, reputational and other material consequences arising from such a disaster, the central bank said.

RBI also asked banks to conduct disaster recovery drills to test their internal IT systems to handle unforeseen disruptions.

Also, in the view of increasing cyber attacks, VAPT should be conducted periodically, RBI said. The banks should prepare documents detailing cyber attacks and ensure gaps identified from the tests are plugged in a timely manner.

Further, RBI said policies governing security of ISs might be discussed and approved at the board level and updated from time-to-time. A certificate confirming the approval of the policies should be submitted to RBI, it said.  It might be inspected during annual financial inspection of banks, the banking regulator said.