IIBF Certified Information System Banker key terms

A centralized software system that holds customer accounts and processes transactions across all branches in real time, replacing branch-level ledgers with a single shared database of record.

Handling a transaction end to end by system logic alone, with no manual re-keying or intervention, so that validation, posting, and settlement happen automatically within defined rules.

The routing component that receives transaction messages from channels such as ATMs, POS terminals, and internet banking, then authenticates, routes, and reconciles them to the correct backend system.

Any interface through which a customer reaches bank services, including branch counters, ATMs, internet banking, mobile apps, and agency or correspondent points, each carrying its own risk profile.

An operating model where customer data and transaction history are shared across all channels, so a journey started on one channel can be continued seamlessly on another without re-entry.

The three baseline security objectives: information is disclosed only to authorized parties, remains accurate and unaltered, and is accessible to authorized users when needed.

Verification of identity using two or more independent evidence types, such as something known, possessed, or inherent, so that a single stolen credential cannot grant access to a banking system.

A social engineering attack that impersonates a trusted party through email, SMS, voice, or fake sites to trick a customer or employee into revealing credentials or authorizing a fraudulent transfer.

A scheme where an attacker persuades a mobile operator to port a victim's number to a new SIM, intercepting one-time passwords and transaction alerts sent by SMS.

A documented set of roles, escalation paths, containment steps, and communication duties that guides staff from detection of a security event through recovery and post-incident review.

India's national nodal agency for cyber incident reporting and response, which banks must notify of specified security incidents within mandated timelines and which issues advisories and vulnerability notes.

A board-approved document setting out the bank's security objectives, controls, responsibilities, and review cycle, approved by the board and reviewed at least annually.

The framework of board and management structures, policies, and accountability that directs how information technology is planned, funded, controlled, and monitored in line with business objectives.

A board-level committee that approves the bank's IT strategy and policy, oversees major technology investments, and ensures IT direction supports the institution's overall business plan.

A senior management group that translates approved IT strategy into execution, prioritizes projects, allocates resources, and monitors delivery of technology initiatives across business lines.

An independent examination of technology controls, systems, and processes to determine whether they safeguard assets, maintain data integrity, and support reliable operations and reporting.

A chronological, tamper-evident record of system activity showing who did what, when, and from where, enabling reconstruction of events and supporting investigations and regulatory inspection.

Splitting sensitive functions among different people so that no single individual can both initiate and conceal an error or fraud, such as separating transaction entry from authorization and reconciliation.

A control in which one user prepares or enters a transaction and a second, independent user reviews and authorizes it before it is posted to the books.

Documented procedures that enable critical business functions to keep operating or resume within a set time after disruption, covering people, premises, processes, and technology dependencies.

The maximum acceptable duration for restoring a function or system after disruption, used to size recovery arrangements and prioritize which services must return first.

The maximum tolerable amount of data, measured in time, that may be lost in a disruption, which determines the required frequency of backup and replication.

A standby facility with infrastructure and data copies that can take over processing when the primary site fails, classified as hot, warm, or cold by readiness and switchover speed.

A process-based approach to delivering and supporting technology services, covering incident, problem, change, and service-level management so that services meet agreed business expectations.

A formal contract clause or document specifying measurable service targets, such as uptime, response times, and remedies, between a service provider and the bank as customer.

A controlled process for requesting, assessing, approving, testing, and implementing alterations to production systems, preventing unauthorized or untested modifications from disrupting services.

The lifecycle of due diligence, contracting, monitoring, and exit planning applied to third parties, ensuring outsourced activities meet the same control and compliance standards as in-house operations.

Assigning a business activity or technology function to an external provider under contract, while the bank retains ultimate accountability to customers and regulators for that activity.

Origination and servicing of loans through digital channels, typically using data-driven credit assessment and straight-through processing, subject to rules on sourcing, disclosure, and recovery conduct.

The regulated process of identifying customers, verifying identity and address, and understanding expected transaction behavior, forming the basis for monitoring and reporting suspicious activity.

Laws, rules, and internal controls that require institutions to detect, monitor, and report attempts to disguise the origin of criminal proceeds moving through accounts and payment systems.

A transaction where the physical card is not presented at the point of sale, such as online or telephone payments, carrying higher fraud risk and requiring additional authentication measures.

Replacing sensitive card data with a surrogate value that maps back to the original only inside a secure vault, reducing exposure if merchant or channel systems are breached.

India's real-time account-to-account payment system that routes transactions between banks using a virtual payment address, operating around the clock through a central switch.

A defined interface letting one system request services or data from another, used by banks to expose account, payment, and verification functions to partners under controlled access.

A model where customers authorize third parties to access their account data or initiate payments through standardized interfaces, shifting control of data sharing to the customer.

A shared record maintained across multiple nodes with cryptographic linking and consensus rules, enabling parties to agree on transaction history without a single central keeper.

Self-executing code deployed on a distributed ledger that automatically enforces and records agreed conditions when triggered, removing some manual steps in settlement or collateral processes.

A structured evaluation that identifies threats and vulnerabilities, estimates likelihood and impact, and ranks risks so that controls and budgets are directed where exposure is greatest.

The centralized collection, secure retention, and review of system and network event records so that anomalies can be detected, investigations supported, and evidence preserved for auditors.