RBI Ref: DoS.CO.CSITEG/SEC.7/31.01.015/2023-24

RBI IT Governance & Risk Health Check

Evaluate IT strategic alignment, CISO independence, change safeguards, production isolation and disaster-recovery drill compliance.

FrameworkISO 27001:2022 RBI PA (S-633)RBI IT Governance RBI IT Outsourcing

Why it matters

Statutory mandate for regulated entities since April 2024 — avoids penalties and downtime.

What you learn

Board oversight gaps, database hardening exposure and DR switch-over readiness.

Effort

~8 minutes · 12 questions · no documents required

Important notice & scope disclaimer

Directional dipstick only

These Self-Assessment Questionnaires are a high-level dipstick check to establish your current state. They are not a replacement for a formal audit, CERT-In system audit or comprehensive gap assessment.

Operational health questionnaire

Pick the option that best reflects day-to-day reality, not policy on paper.

1IT Governance & Strategy

Do the IT Strategy Committee of the Board and the IT Steering Committee meet regularly to review IT investments and risks?

Chapter II · IT Governance

Does the CISO have independent reporting to the Board / RMC and security authority without operational conflicts?

Chapter II · CISO Mandate

Is there an active plan to monitor and decommission End-of-Life / End-of-Support systems and hardware?

Chapter III · Obsolescence

2Infrastructure, Change & Operations

Are production changes tracked through formal requests, tested in pre-prod, and protected with rollback plans?

Chapter III · Change Management

Are compute, bandwidth and processing capacity monitored against thresholds to prevent peak-time outages?

Chapter III · Capacity Planning

Are golden configuration baselines enforced, with direct, unlogged access to production databases blocked?

Chapter III · Hardening

3Cyber Risk & Incident Response

Are authenticated vulnerability scans and penetration tests run periodically, with remediation tracked against SLAs?

Chapter IV · VAPT

Is privileged access managed via PAM with dual control, and are keys / certificates held in an HSM or KMS?

Chapter IV · Privileged & Crypto

Is there 24×7 SOC monitoring, with a workflow to contain incidents and notify RBI within mandated hours?

Chapter IV · Incident Reporting

4Business Continuity & IS Audit

Are DC and DR configurations synchronised, with a demonstrated ability to meet RPO / RTO targets?

Chapter V · DR Synchronisation

Are live DR switch-over drills performed for critical systems at least every six months and reviewed by ITSC?

Chapter V · 6-Monthly DR Drills

Does an independent IS Audit inspect critical systems on a risk-based schedule, reporting to the Audit Committee?

Chapter VI · IS Audit

Bridging the gap to full assurance

From self-assessment to audit-ready compliance

The SAQ shows where you stand directionally. Formal regulatory comfort or certification needs hands-on gap closure, evidence and independent assurance — that is where Open Security Alliance steps in.

01 / Diagnostic

Full Regulatory & ISO Gap Assessment

Evidence-backed evaluation across every clause and control, with a Statement of Applicability and remediation roadmap.

02 / Audit Defense

Pre-Audit Readiness & CERT-In Audits

Mock inspections, VAPT, configuration reviews and annual cyber security audits for licensed entities.

03 / Governance

Board Advisory, CISO Reporting & Policies

Board-approved IT & cyber policies, ITSC agendas, CISO dashboards and escrow operating SOPs.

04 / Contracts

Vendor Contract Remediation

Clause-by-clause MSA review to add right-to-audit, sub-contracting and data-localisation safeguards.

Confidential discovery session

Unsure how regulators will read your gaps?

Book a 30-minute session with a principal consultant to review your SAQ results under a mutual NDA.