Definition
RBI · Master Direction RBI/2023-24/107, DoS.CO.CSITEG/SEC.7/31.01.015/2023-24, 7 Nov 2023The Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023, in force from 1 Apr 2024 for commercial banks, NBFCs in the top, upper and middle layers, credit information companies and all-India financial institutions. They require a board-level IT Strategy Committee chaired by an independent director with IT expertise, a CISO who does not report to the head of IT, a risk-based information systems audit function, vulnerability assessments every six months and penetration tests every twelve months for critical systems, and half-yearly disaster recovery drills. Cyber incidents must be reported to RBI and to CERT-In as required; the separate Master Direction on Outsourcing of IT Services (10 Apr 2023) covers your vendors.