Context

The Reserve Bank of India issued the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices in November 2023, effective from 1 April 2024. It consolidates earlier guidance and applies to banks, NBFCs and other regulated entities in scope.

The direction is explicit that IT and cyber risk are board-level matters, not something to delegate entirely to technology teams.

What the Board must own

  • Approving the IT strategy and ensuring it supports business objectives
  • Setting risk appetite for IT and cyber risk
  • Overseeing the IT Strategy Committee, which reviews IT and information security risks and the adequacy of resources
  • Ensuring periodic review of IT and information security policies

Senior management and committees

The IT Steering Committee turns strategy into execution: project prioritisation, resource allocation and monitoring of IT performance. A Head of IT is accountable for day-to-day technology operations.

The CISO's mandate

The CISO drives the information security programme and must be independent enough to report risks without filtering. Typical responsibilities include:

  1. Maintaining the information security policy and standards
  2. Running vulnerability management and security monitoring
  3. Reporting security posture and incidents to senior management and the board committee
  4. Coordinating with the business on risk acceptance

Areas supervisors probe

Business continuity and DR

Documented BCP and DR plans with tested recovery objectives. Supervisors look at drill results, not plan documents.

IS audit

A risk-based information systems audit programme, with findings tracked to closure and reported to the audit committee.

Third parties

Outsourced IT and cloud arrangements must not reduce the entity's ability to meet regulatory obligations or allow supervisory access.

Evidence pack checklist

  • Board and committee minutes showing IT and cyber risk discussion
  • Approved IT strategy and risk appetite statement
  • CISO reports with metrics and trends
  • DR drill reports and remediation tracking
  • IS audit plan and closure status

Key takeaways

  • The Master Direction makes IT and cyber risk a board responsibility from 1 April 2024.
  • Committees, the Head of IT and the CISO each have defined roles.
  • Supervisors look for evidence: minutes, tested DR, tracked IS audit findings.

Frequently asked questions

Which entities does the Master Direction cover?

It applies to banks and a range of other RBI-regulated entities, including many NBFCs, as specified in the direction. Check the applicability section for your entity type and size.

Must the CISO report to the CEO?

The direction expects the CISO to have direct access and sufficient independence to report risks to senior management and the board committee without filtering by the technology function.

How often should DR be tested?

Follow the frequency in the direction and your board-approved policy, and test critical systems end to end. Supervisors want to see drill results and how gaps were fixed.

If it is not in the minutes, the regulator will assume it did not happen.

Our regulatory compliance practice supports RBI-regulated entities with gap assessments and board reporting packs.