PPB Module CChapter Notes5–7 Marks Expected

Security Considerations and Mitigation Measures in Banks

Principles & Practices of Banking | Module C · Chapter 48

Covers the full security landscape in computerised banking — risk areas, threat taxonomy, control mechanisms, audit approaches (around/through/with computer), IS audit, IS security (CIA framework), cyber fraud modus operandi (phishing, vishing, BEC, SIM swapping), disaster recovery (RTO/RPO), the IT Act 2000, digital signatures, the G. Gopalakrishna Committee's 9-chapter report, and the Integrated Ombudsman Scheme 2021.

By Bankopedia.co.inUpdated 2026JAIIB PPB · Module C

📌 Why This Chapter Matters in JAIIB

Expect 5–7 questions from this chapter. Key exam focus areas: Risk areas (Data/Software, Infrastructure, Peopleware — three components of a computerised environment); Threat types (Accidental: environmental hazards, human errors, unreliable systems; Malicious: interruption of services, frauds); Control types (Preventive eliminates errors from reoccurring; Detective identifies errors after they occur; Corrective removes effects of errors); Audit approaches (Around the Computer: examines I/O without touching software; Through the Computer: uses computers to test logic; With the Computer: uses CAATT software); IS Audit 4 control types (Deterrent, Preventive, Detective, Corrective); IS Security CIA (Confidentiality, Availability, Integrity); Threats (Phishing, Vishing, Smishing, Ransomware, DDoS/Botnet, Malware, Spear Phishing, Whaling, BEC, SIM Swapping); Disaster Recovery (RPO = point in past to which you recover; RTO = point in future when you are back up — for banks RPO ideally = zero); Gopalakrishna Committee (9 chapters: IT Governance, Information Security, IT Operations, Outsourcing, IS Audit, Cyber Fraud, BCP, Customer Education, Legal Issues); Ombudsman Scheme 2021 (integrates 3 prior schemes; no limit on dispute amount; appeal within 30 days).

Key Facts & References — Chapter 48 at a Glance

3 risk components:Data & Software, Infrastructure (hardware/networking/power), Peopleware (stagnation, attrition)

Preventive control:Eliminates errors from reoccurring — e.g. good UI validation design

Detective control:Identifies errors after they occur — e.g. input validation programme checking boundary limits

Corrective control:Removes or reduces effects of errors after identification — e.g. error communications/alerts

Physical controls:Access to computer room, output hard copies, smoke detectors/fire extinguishers, source code not on system

Logical controls:Access control at directory/file level (OS) and record/field level (database); authentication + authorisation

Audit trail:Chronological record of all events; Accounting trail (data updates) + Operations trail (resource consumption)

Checksum:Number calculated on key data items to verify file integrity at day-begin; involves account number, balances, names

Data encryption:Converts data to ciphertext; MAC (Message Authentication Code) verifies integrity of EFT message in transit

Data masking:Hides personal data (card numbers, SSN, names) to prevent breaches; used in test/dev environments from production data

Audit around computer:Examines I/O; no direct examination of application software; suitable for simple systems with clear audit trails

Audit through computer:Uses computers to test logic and records; useful for complex systems with large data volumes

Audit with computer:Uses CAATT (Computer-Aided Audit Tools and Techniques) — software to audit computer-generated files and evaluate internal controls

IS Audit objective:Collect & evaluate evidence: can system safeguard assets, maintain data integrity, achieve goals, use resources efficiently?

4 IS Audit controls:Deterrent (discourage), Preventive (prevent), Detective (detect — honeypots, IDS), Corrective (recover — BCP, patching)

IS Security CIA:Confidentiality (authorised users only), Availability (authorised persons when required), Integrity (authorised modification only)

CISO:Chief Information Security Officer — rank of GM/DGM/AGM; reports to Head of Risk Management (NOT CIO)

Phishing:Fraudulent e-mail/website impersonating bank; asks for account number, card number, PIN; creates sense of urgency

Vishing:Voice call fraud; impersonates bank/telecom; asks for KYC update, unblocking account/SIM

Smishing:SMS-based fraud; contains URL or phone number; asks for User ID, Password, ATM PIN via return SMS

DDoS:Distributed Denial of Service; Botnet (compromised systems) floods target system → shuts it down

Ransomware:Blocks access to victim data or threatens to publish it unless ransom is paid

Whaling:Spear phishing targeted at senior executives / high-profile targets

BEC:Business Email Compromise; tricks people into transferring money to criminal bank accounts by impersonating someone in the organisation

SIM Swapping:Fraudster contacts cell operator under false pretences → existing SIM deactivated → new SIM issued → OTP intercepted

RPO:Recovery Point Objective — point in the PAST to which data is recovered; ideally zero for banks

RTO:Recovery Time Objective — point in the FUTURE at which bank will be up and running again

IT Act 2000:Received President's assent 9 June 2000; gives legal recognition to EDI, Electronic Records, Electronic Signatures; amended in 2008

Digital Signature:Uses public-private key pair (asymmetric cryptography); Private Key creates signature; Public Key verifies it

Gopalakrishna Committee:Set up April 2010; final report 29 April 2011; 9 chapters; Working Group on Information Security, Electronic Banking, Tech Risk Management & Cyber Fraud

Ombudsman 2021:Integrates 3 prior schemes (Banking Ombudsman 2006, NBFC Ombudsman 2018, Digital Transactions Ombudsman 2019); no limit on dispute amount; appeal within 30 days

Introduction & Risk Concern Areas

Free

48.1

Introduction

Banking operations are prone to various risks and online frauds. The deployment of IT has changed the scale of risks, but not their nature. Securing technology and protecting customer data is one of the highest priorities for any financial institution. The unprecedented growth in digital payments and the push towards a cashless economy has intensified focus on financial cybersecurity.

Risks in a Computerised Environment Broadly Lead To
1	Incorrect decision making → setback to the business
2	Interruption in activities due to loss of data, hardware, software, peopleware
3	Violation of privacy
4	Direct financial loss due to computer frauds

48.2

Risk Concern Areas — 3 Components of a Computerised Environment

A typical computerised environment has three interdependent but separate components: Data, Software, and Hardware. Risks are not specific to banking — they exist in all business activities.

48.2.1 Data & Software

•Data is critical for continuing operations — incorrect data leads to wrong decisions
•Lack of control over data enables fraud by unscrupulous elements
•Confidential data falling into wrong hands damages customer relations and bank reputation
•Unauthorised changes to application software directly lead to fraud
•Utility software on operational systems can bypass validation controls
•Errors due to software modifications are difficult to detect

48.2.2 Infrastructure

•Hardware: CPUs, controllers, modems, switches/multiplexers, routers
•Environment: Precision ACs, fire extinguishers, smoke detectors
•Power supply: UPS, CVT (constant voltage stabilisers), generators
•Equipment not regularly maintained → malfunctioning → service interruption or asset/data loss

48.2.3 Peopleware

Refers to the role played by persons directly or indirectly involved in managing computerised systems.

•(a) Stagnation in knowledge and skill levels → affects efficiency of newer systems
•(b) High turnover due to attrition → difficult to get suitable replacements
•Impact felt most for technical staff handling highly specialised functions
•Impact comes from both internal staff and software house personnel

Types of Threats & Control Mechanism

Free

48.3

Different Types of Threats

48.3.1 Accidental Damages

Environmental Hazards

Fire, floods, unstabilised power supply, natural calamities — systems not properly tested also lead to higher failure rates.

Human Errors and Omissions

Errors occur at time of: (a) systems design/process development, (b) data entry at terminal, (c) programme maintenance and corrections.

Primary cause: Human failure. Secondary cause: Machine failure.

Unreliable Systems

In multi-programming/multi-user environments, systems are prone to errors and intentional frauds. Customisation of standard packages often introduces new errors.

48.3.2 Malicious Damages

Interruption in Services

From disgruntled employees or individuals with mala fide intentions. Branches/delivery channels are networked — any damage can bring system down partially or completely. Banks must build redundancy (24×7 for critical infrastructure).

Frauds — Common Methods

→Utility programmes used to make unauthorised changes bypassing validation controls
→Unauthorised amendments to payment instructions before entry into system
→Unauthorised manipulation of important files bypassing security controls
→Unauthorised programme changes causing automatic fraudulent transactions
→In networked systems: intercepting data in transit

48.4

Control Mechanism — 4 Types

48.4.1 Physical Controls

→Control over access to assets — only authorised persons enter computer room
→Software techniques protect against unlimited access attempts
→Access log maintained; passwords, PIN, or biometric fingerprint verification
→Routine checks: smoke detectors, fire extinguishers must be effective and operational
→Control over outputs: hard copies preserved; access only to authorised persons
→Source code of running system not available on system to avoid tampering

48.4.2 Logical Controls

→Operating system controls access at directory and file level
→Database controls access at record and field level
→Two types: Authentication (only authorised users access) + Authorisation (just-minimum access to files/directories)
→System Administration manages both authentication and authorisation in operating systems
→Provide interface between application controls and general IS controls

48.4.3 Internal Controls

→Check accuracy and reliability of accounting data, ensure operational efficiency, safeguard assets
→Two types: Application controls (dual controls, validation checks, numerical sequencing) + Administrative controls (defined responsibilities, formal policies/procedures)
→For customer accounting: validations on stop payments, post-dated/stale cheques, invalid dates
→Verification of sensitive parameters: due dates, drawing limits, rates, stop instructions

48.4.4 Operational Controls

→Embedded in software to ensure data integrity, consistency, and processing
→Example: verification of checksum and database integrity as part of day-begin functions
→Audit trail types: Accounting audit trail (data updates) + Operations audit trail (resource consumption)
→Both successful and unsuccessful transactions logged with terminal no., user-id, transaction details, timestamp

Checksum

Number calculated on key data items of a file to ensure integrity. In branch banking, checksum from closing of previous day is tallied with day-begin of next day. Involves: account number, balances, account holder names.

Data Encryption

Systematically converts data to ciphertext (non-readable form). In EFT systems, MAC (Message Authentication Code) is a secret key applied to selected data items to verify message integrity in transit. MAC is recalculated by receiver — if different, message was altered.

Data Masking

Hides personal data (credit card numbers, SSN, names, addresses, phone numbers) to prevent breaches. Used in test/development environments created from production data. Helps meet PCI DSS and other compliance requirements.

Computer Audit & Information System (IS) Audit

48.5

Computer Audit

Computer Audit is the generic organisational function for evaluation of asset safeguarding, data integrity, system effectiveness, and system efficiency in computerised systems.

48.5.1 Scope of Computer Audit (3 areas)

1. Compliance Review

Review of operations to establish compliance with established policies, standards, and procedures.

2. Quality Review

Review of quality of formal policies, standards, procedures; efficiency of operations; adequacy of controls.

3. Integrity Review

Focused on fraud detection/prevention, application programme and OS integrity, system design, and monitoring of employee activities.

48.5.2 Three Audit Approaches

Approach	What is examined	When to use	Limitation
Audit AROUND the Computer	Examines input & output; infers about processing; does NOT directly examine application software	Simple systems with well-tested software, proper physical controls, segregation of duties, clear audit trail	Not suitable for complex, high-volume systems; cannot anticipate future software deficiencies
Audit THROUGH the Computer	Uses computers to test logic and controls in the system AND records produced by the system — requires technical competence	Complex systems handling large data volumes; audit trail has gaps due to cost considerations	Requires technical expertise; more resource-intensive
Audit WITH the Computer (CAATT)	Uses CAATT (Computer-Aided Audit Tools and Techniques) software — efficient and effective way to audit computer-generated files/records/documents	Evaluating internal controls over processing in a computerised environment	Depends on availability and capability of audit software tools

⚠️ MCQ answer — CAATT approach

IS audit for the software used carried out by CAATT is the Audit WITH the Computer (option c). Audit AROUND = examines I/O only. Audit THROUGH = tests logic directly using computers.

48.6

Information System (IS) Audit

Objective of IS Audit

Process of collecting and evaluating evidence to determine whether a computer system can: (1) safeguard its assets with adequate security & control measures, (2) maintain data integrity, (3) achieve organisational goals effectively, and (4) use resources efficiently.

Key: IS Audit is carried out through

CAATT — Computer Aided Audit Tools and Techniques

Readily available user-friendly software with features for IS audit. Core Banking made audit less cumbersome — most auditing can now be done centrally.

4 Types of Controls in IS Audit (48.6.4)

a. Deterrent

Designed to discourage people from undesirable activities. Examples: written policies with punitive measures, warning banners.

b. Preventive

Designed to avoid errors, omissions, or security incidents from occurring. Examples: user access controls, input validation.

c. Detective

Designed to identify and characterise security incidents after they occur. Examples: smoke detectors, honeypots, Intrusion Detection Systems (IDS). IS auditing itself is a detective control.

d. Corrective

Designed for recovery from a loss situation. Examples: Business Continuity Planning (BCP), patching a system, quarantining a virus, terminating a process, rebooting.

Benefits of IS Audit (48.6.5)

→Identifies risks of exposure in existing computerised environment

→Deters employees/users from indulging in data manipulation and frauds

→Verifies whether controls are adequate to safeguard bank assets

→Indicates the health of an information system

→IS audit reports help strengthen the system

→Promotes best practices for controls

→Ensures compliance with policies and regulations

→Reviews IT projects, systems, and technology

IS Security, Cyber Threats & Fraud Modus Operandi

48.7

Information System (IS) Security

IS Security Policy — 3 Objectives (CIA)

Confidentiality

Disclosure of information stored or processed on bank's information systems should be made available to authorised users only.

Integrity

Modification to information should happen by an authorised user and in an authorised manner.

Availability

Information is available to authorised persons when required.

Controls Required for IS Security (48.7.4)

Identification

Means by which a user provides a claimed identity to the system.

Authentication — 3 means

(1) Something the user KNOWS: password, PIN, cryptographic key; (2) Something the user POSSESSES: ATM card, smart card; (3) Something the user IS: biometrics (fingerprint, iris/retinal scan, palm vein, facial recognition, voice pattern).

Authorisation

Function of specifying access rights to resources.

Non-repudiation

Ability to prove an operation/event took place so it cannot be denied — sender cannot deny sending; receiver cannot deny receiving.

Access Control

Limits access to system or physical/virtual resources. Users must present credentials before access is granted.

IS Security in Banking — 8 Cyber Threats (48.7.6)

1Computer Virus

Malicious software loaded onto computers without user knowledge; attaches to host programmes; can steal credentials, destroy data. Spreads via network, disk, or infected e-mail attachments.

2DDoS — Distributed Denial of Service

Large numbers of compromised systems (Botnet) attack a single target → forces target to shut down → legitimate users denied service.

3Ransomware

Malicious crypto-virology software that threatens to publish victim's data or block access to it unless a ransom is paid.

4Malware

Maliciously crafted software code. Special programmes enable intruders to fool individuals into believing traditional security is protecting them during online transactions.

5Phishing

Fraudulent attempt to obtain sensitive information (usernames, passwords, card details) by disguising as a trustworthy entity in electronic communication.

6Spear Phishing

Phishing directed at specific individuals or companies — attackers gather and use personal information about target to increase probability of success.

7Whaling

Spear phishing directed specifically at senior executives and other high-profile targets (e.g. subpoena, customer complaint content).

8Vishing

Illegal access of data via VoIP (Voice over Internet Protocol) — voice messages to steal identities and financial resources. Combination of 'voice' + 'phishing'.

48.8

Modus Operandi of Online Frauds & Cyber Security Awareness

48.8.2 Steps in a Cyber-Attack Modus Operandi

Reconnaissance & Compromise

Research target — IP addresses, domain names, email addresses; use phishing emails; may wait months.

Obtain Credentials

Use tools to steal credentials; gain administrator-level access to penetrate deeper into the network.

Send Fraudulent Messages

Implant malware into vital systems; submit fraudulent payment instructions using fake operator or approver.

Hide / Cover Up Evidence

Destroy proof of operations — tools and strategies to remove/change records and corrupt systems to confound forensic investigators.

48.8.3 Common Modus Operandi of Cyberattacks (9 Types)

1Card Skimming

Hidden devices or cameras at ATMs capture card data and PIN to create a duplicate card and withdraw cash.

2Phishing / Vishing / Smishing

Spoofed emails, phone calls pretending to be bank/telecom, or SMS with URLs — all lure customers into sharing confidential details under pretexts like KYC update or account unblocking.

3Lottery / Fake Prize Fraud

Email or call claiming victim won a large lottery prize; asks for advance taxes/processing fees; victim falls for relatively small 'processing' amount.

4Fraud via Unknown Mobile Apps

Fraudsters trick victims into downloading unverified apps that allow access to mobile device, laptop, or desktop; distributed via SMS, social media, instant messaging.

5Account Takeover

Criminal obtains access to legitimate account through deception; impersonates cardholder to request replacement card by falsely reporting theft or loss.

6Online Marketplace Fraud

Fraudsters act as buyers/sellers; send Money Requests via UPI app; instruct victim to enter MPIN to 'receive money' — money is instead transferred to fraudster.

7Card Fraud (CNP & CP)

CNP (Card-Not-Present): uses card details without physical card (e-commerce). CP (Card-Present): card data stolen at ATMs/POS devices.

8SIM Swapping

Fraudster contacts cell operator under false pretence (lost phone, robbery) → existing SIM deactivated → new SIM issued to fraudster → OTP intercepted for banking transactions.

9Business Email Compromise (BEC)

Impersonates someone in a business network to trick targets into transferring money to attacker's account. Techniques: email spoofing, spear-phishing, malware for internal email access. Most prevalent victims: companies making cross-border payments.

Safe Online Banking Tips (for customers)

Type Internet banking URL directly — don't click linksUse two-factor authentication accountsDisable the 'remember password' optionAlways use licensed software including anti-virusDisconnect internet when not in useNever click links/images from unknown e-mailsMonitor accounts regularlyAlways log out when doneKeep computer up-to-date with security patches

IT Resources, Disaster Recovery, IT Act 2000, Gopalakrishna Committee & Ombudsman Scheme 2021

48.9

IT Resources Evaluation Requirements

Computer Hardware

Obsolescence is a major problem. High acquisition/replacement costs. Banks need proper hardware purchase policies — balance between technology and cost. Loss of service → goodwill/reputation loss.

Computer Software

System software (OS, compilers, utilities) and application software both require evaluation. Frequent changes cause patching and make systems complex. Shift from TBA to CBS is an example of such changes.

Data

Most critical asset of a bank. Accidental loss < loss due to irregularities. Data stolen by competitor is more serious than accidental destruction. Magnetic media changes are not easily detected — proper archival policies needed.

Communication Channels

Backbone of electronic banking. Geographically spread banking depends on communication links. Requires well-defined technological competence and policies for absorption of new communication technologies.

48.10

Disaster Recovery Management

Disaster — Definition

Any event that results in direct denial or stoppage of essential business functions for a considerable period of time. Short interruptions not resulting in denial of service are classified as disruptions, not disasters.

4 Phases of Disaster Recovery Planning

1. Awareness

Identify critical activities, systems, and processes. Front-end operations = critical; back-end = second priority. Identify resources needed at short notice.

2. Financial & Legal Issues

Maintain inventory of all assets; insure against loss. Only licensed software to be used. All licensed media (CD, floppy) recorded and stored.

3. Preparation

(i) Core and support teams of skilled personnel. (ii) Daily data backup at a different location. (iii) Alternate recovery sites / disaster recovery sites. (iv) Documentation and SLAs with service providers.

4. Testing

BCP must be regularly tested to ensure it is up-to-date and effective.

📌 MCQ: Phases do NOT include

The 4 phases are: Awareness, Financial & Legal Issues, Preparation, Testing. "Recovery" is the action phase AFTER a disaster is declared — it is the outcome, not a planning phase. "Increased Manpower" is NOT a phase.

RTO vs RPO — Critical Objectives

Term	Definition
RPO — Recovery Point Objective	Point in the PAST to which you will recover. The gap between disaster and RPO = data lost. For banks, RPO should ideally be ZERO.
RTO — Recovery Time Objective	Point in the FUTURE at which the bank will be up and running again. The gap between disaster and RTO = timeframe services are down.

Business Impact Analysis (BIA)

Must be carried out by functional units before devising any disaster recovery plan. Identifies critical areas and systems. Calculates lead time between complaint and vendor response. Compares with past occurrences and determines RTO and RPO.

48.11

Legal Framework — IT Act 2000 & Digital Signature

IT Act 2000

→Based on UNCITRAL Model Law on Electronic Commerce (1996) — India is a signatory
→Indian Parliament enacted Information Technology Bill — received President's assent 9 June 2000
→Provides legal recognition for transactions carried out via electronic communication
→Validates use of EDI, Electronic Records, and Electronic Signatures
→Chapter XI identifies IT offences (hacking, tampering source code, publishing obscene material)
→Consequential amendments made to: Indian Evidence Act 1872, Indian Penal Code 1860, Banker's Books Evidence Act 1891, RBI Act 1934
→RBI Act 1934 amended to empower central board to make regulations for electronic fund transfers between banks
→Amended again in 2008

Digital Signature (48.11.1)

A digital signature is NOT a digital image of a handwritten signature. It is a key applied cryptographically. It must satisfy: Authenticity (verify source), Integrity (message received intact, not altered), Non-repudiation (cannot deny sending/receiving).

Public Key

Used by recipient/relying party to VERIFY the digital signature. Distributed openly.

Private Key

Kept confidential by signer. Used to CREATE the digital signature (transform data into unintelligible form).

Hash / Message Digest

Sender first creates a hash (message digest) using a hashing algorithm — this is what is actually signed. Unique to each message — any change to message changes the digital signature.

48.12

G. Gopalakrishna Committee Report — 9 Chapters

Set up: April 2010 under RBI ED Shri G. Gopalakrishna. Final Report released: 29 April 2011.Title: "Working Group on Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds". Banks are required to adhere to the Committee's recommendations.

Ch 1: IT Governance

→Board + Executive Management responsible for effective IT Governance
→CIO ensures IT strategy implementation; CISO reports to Head of Risk Management (NOT CIO)
→Annual review of IT strategy and policies
→Enterprise architecture framework for applications/decisions
→Data classification scheme (public, confidential, top secret)

Ch 2: Information Security

→Board ultimately responsible for information security
→Board-approved Information Security policy — reviewed at least annually
→CISO: rank of GM/DGM/AGM — not under CIO
→CISO must directly report to Head of Risk Management
→Banks should implement ISO 27001-based ISMS
→Penetration testing, audits, and vulnerability assessments periodically

Ch 3: IT Operations

→IT Operations must support processing/storage so information is available in a timely, reliable, secure, resilient manner
→Covers: IT Service Management, Infrastructure Management, Application Lifecycle Management, IT Operations Risk Framework
→Evaluate service capabilities and risk profile before releasing new/changed service into production

Ch 4: IT Services Outsourcing

→Activities that CANNOT be outsourced: Internal Audit, Compliance, KYC compliance, loan sanctioning, managing investment portfolio
→Banks remain accountable for all outsourcing decisions
→Service providers must meet minimum security baselines
→Periodic independent audits of service providers
→Outsourcing outside India must allow regulatory audits/inspections
→Customer grievance time limit: 30 days

Ch 5: IS Audit

→Board/Audit Committee must provide internal audit function capable of evaluating IT controls
→IS Audit = integral part of Internal Audit function
→Audit Charter/Policy governs IS Audit — approved by Board — annual review
→Banks carry out IS Audit planning using Risk-Based Audit Approach

Ch 6: Cyber Fraud

→All frauds above ₹1 crore reported to Audit Committee of Board
→Special committee for frauds ≥ ₹1 crore
→Fraud vulnerability assessments for business functions and delivery channels
→Root cause analysis for actual frauds above ₹10 lakhs
→Transaction monitoring group within fraud risk management group
→Fraud reports to RBI for frauds ≥ ₹1 lakh (as per RBI circular July 1, 2010)

Ch 7: Business Continuity Planning (BCP)

→Senior official designated as Head of BCP in each department
→BCP must be regularly tested — including people, processes, and technology
→Annual reviews and updates; changes follow formal change management process
→Unplanned BCP drills; Internal Auditors (including IS Auditors) to audit effectiveness
→Backup sites for critical payment systems interacting with RBI Data Centres

Ch 8: Customer Education

→Board/Senior Management must commit adequate resources to consumer education
→Systematic process: planning/design → execution/management → evaluation/course correction
→Awareness programs customised for specific audiences (customers, employees, law enforcement, media)
→Research group to continually update communications team on latest fraud trends

Ch 9: Legal Issues

→Banks must consider impact of IT Act 2000 (amended 2008) to mitigate cyber legal risks
→Legal function advises business groups on IT-related legal risks
→Banks must keep abreast of IT Act 2000 rules/regulations/notifications
→Two important subsequent directions: (1) RBI Cyber Security Framework in Banks — Feb 2016; (2) Master Direction on Digital Payment Security Controls — Feb 2021

48.13

Cyber Security Framework in Banks

RBI has advised all banks to put in place a Board-approved Cyber Security Policy distinct from the broader IT/IS Security policy. Key aspects:

→1. Cyber Security Policy distinct from IT policy/IS Security Policy — specific to cyber threats
→2. Continuous surveillance — SOC (Security Operations Centre) must be set up and kept updated on emerging threats
→3. IT architecture conducive to security — security measures in place at all times
→4. Network and database security — unauthorised access not allowed; well-defined processes where permitted
→5. Protection of customer information — confidentiality of custodial information not compromised
→8. Share information on cyber-security incidents with RBI — all unusual incidents (successful or attempted) must be reported
→9. Supervisory Reporting framework — immediate assessment of gaps in preparedness reported to RBI
→10. Organisational arrangements — cyber-security awareness among stakeholders/Top Management/Board

48.14

Integrated Ombudsman Scheme, 2021 — RBI

Integrates 3 Prior Schemes

• Banking Ombudsman Scheme, 2006
• Ombudsman Scheme for NBFCs, 2018
• Ombudsman Scheme for Digital Transactions, 2019

Who it covers

•All Commercial Banks, RRBs, Scheduled/Non-Scheduled Primary (Urban) Co-operative Banks with deposits ≥ ₹50 crore
•All NBFCs (other than Housing Finance Companies) authorised to accept deposits OR with customer interface with assets ≥ ₹100 crore
•All System Participants

Key Provisions

→Complaints filed online on CMS portal (https://cms.rbi.org.in)
→No limit on amount of dispute that can be filed before the Ombudsman
→Regulated Entity must file written version within 15 days of receiving complaint
→Ombudsman may award compensation up to ₹1 lakh for complainant's lost time, expenses, harassment, mental anguish
→Regulated Entity: 30 days compliance after receiving complainant's letter of acceptance
→Appeal before Appellate Authority within 30 days of Award/closure — by Chairman/MD/CEO/ED only (for RE)
→Appellate Authority: Executive Director-in-Charge of the Department of RBI administering the scheme

← Chapter 47: Impact of Technology Adoption & Trends|PPB Overview|JAIIB Exam Hub

Free — no credit card needed

Unlock the complete JAIIB PPB chapter notes

✓ All 32 PPB chapters — complete notes for every syllabus topic
✓ Mnemonics, amber exam traps, and case law summaries
✓ 25+ revision flashcards per chapter for last-minute prep
✓ Mock tests for key chapters — practice in real exam format

Create free account →Sign in

Discussion

No comments yet. Be the first to share your thoughts.