IT and Information Security Risk Management
This domain tests how a regulated entity identifies, measures, treats and reports technology risk - the governance plumbing behind every digital product.
Core rules
- RBI's Master Direction on IT Governance, Risk, Controls and Assurance Practices (2023) requires a Board IT Strategy Committee, an IT Steering Committee, a CISO with direct access to the Board or MD, three lines of defence, and IT risk embedded in the enterprise risk framework.
- Risk is recorded as inherent risk, controls applied, and residual risk. Treatment options are avoid, mitigate, transfer and accept; acceptance must be by an authorised level with a documented rationale.
- Controls are preventive, detective or corrective, and automated or manual. RCSA and KRI reporting give early warning before an incident.
- IS audit is annual for material entities, and VA/PT is expected at least annually and after major change, using CERT-In empanelled auditors where required.
- BCP and DR need documented RTO and RPO, tested through annual drills; cloud and IT outsourcing require due diligence, data residency, audit rights, concentration assessment and an exit plan under RBI's 2023 outsourcing directions.
Worked example
An NBFC moves its loan management system to a cloud vendor. Classification: third-party IT risk in the risk register. Controls: pre-contract due diligence, contractual right to audit, data residency in India, tested RTO of 4 hours and RPO of 15 minutes, exit plan with data portability. The residual risk, after these controls, is accepted by the CRO and minuted at the Board IT Strategy Committee - not by the IT head alone.
Traps that cost marks
Treating IT risk as synonymous with cyber risk. Confusing inherent and residual risk. Equating IS audit with statutory audit. Ignoring vendor concentration risk. Assuming a certified vendor needs no due diligence. Forgetting that DR drills must be evidenced, not merely planned.