Cyber Security
What the exam tests
Cyber Security tests governance and incident-response discipline: who owns cyber risk, what must be reported, to whom, and within what time.
Core rules
- RBI's Cyber Security Framework (2016) requires a board-approved cyber security policy, a CISO, a security operations centre, a cyber crisis management plan, annual IS audit, gap assessment and incident reporting to RBI within 2–6 hours.
- CERT-In Directions (April 2022) require reporting of specified cyber incidents within six hours, maintenance of ICT logs for 180 days, synchronisation to NIC/NPL time, and a designated point of contact.
- Baseline controls include MFA, least privilege, network segmentation, patch and vulnerability management, penetration testing, third-party/vendor risk management, backup and restoration testing.
- Cyber risk is a board responsibility, not an IT-only matter; outsourcing does not transfer accountability.
Worked example
A branch server is hit by ransomware. The response sequence is: isolate affected systems, preserve logs and forensic images, notify CERT-In within six hours and RBI within the 2–6 hour window, activate the cyber crisis plan, restore from a clean backup, and avoid paying ransom. If the bank waits 24 hours, it breaches both CERT-In and RBI timelines, and if it wipes the server, it destroys evidence needed for investigation and regulatory reporting.
Traps
CERT-In reporting is not limited to government entities. Six hours is not 24 hours. Logs must be retained for 180 days, not 90. Treating cyber security as a pure technology issue and leaving the board out is a governance failure.