Cyber Security
This domain tests the control frameworks, incident timelines and reporting obligations that apply to regulated entities in India, plus the ability to classify an attack and respond in the correct sequence.
Framework anchors
- RBI's Cyber Security Framework in Banks (2016) mandates a Board-approved cyber security policy, a CISO, a Security Operations Centre, baseline controls, IS audit, a Cyber Crisis Management Plan and incident reporting to RBI.
- CERT-In Directions (2022): report specified incidents within 6 hours of noticing, maintain logs for 180 days within India, synchronise clocks to NIC or NPL NTP servers, and designate a point of contact.
- RBI's Digital Payment Security Controls (2021) cover governance, identity, infrastructure, application security and customer awareness for payment channels.
- Defence in depth: network segmentation, MFA and privileged access management, patch management, EDR, encryption in transit and at rest, tokenisation, WAF and periodic red teaming.
Worked example
Ransomware is detected on a small finance bank's server at 10:00. Response sequence: isolate the host without powering it down, preserve forensic images, notify the CERT-In point of contact within 6 hours and RBI within its 2-6 hour window, convene the crisis management team, invoke BCP and restore from offline backups verified clean. Paying the ransom is not a control and carries sanctions exposure. If personal data was exfiltrated, the DPDP obligation to intimate the Data Protection Board and affected data principals is triggered separately.
Traps that cost marks
Reporting to CERT-In but not RBI, or reporting internally only. Assuming antivirus equals security. Believing the cloud provider's certification transfers liability. Keeping logs outside India. Treating cyber insurance as a substitute for controls. Missing that DPDP and CERT-In timelines run in parallel.