What changed
RBI reinforced the need for banks to have consolidated BCP documents covering people, process, and technology, and to conduct regular Disaster Recovery drills and VAPT. It also requires board-level approval of information security policies and continued quarterly reporting on these activities.
What it means for you
Banks must strengthen their IT resilience by formalizing BCPs and testing them regularly to minimize operational, financial, and reputational risks from disruptions. VAPT becomes a non-negotiable periodic exercise to guard against cyber threats, with gaps needing timely closure. Board oversight and quarterly compliance reporting are now mandatory, making information security a governance priority.
What you must do
- Formulate or update consolidated BCP documents covering critical aspects of people, process, and technology.
- Conduct Disaster Recovery drills and VAPT on a regular basis and document the results.
- Ensure board-level discussion and approval of information security policies, with updates as needed.
- Submit a certificate to RBI confirming board approval of policies and continue quarterly reporting on DR drills and VAPT.
- Plug identified gaps from VAPT and DR drills in a timely manner as part of the information security assurance function.
Who it affects
All Scheduled Commercial Banks (excluding RRBs), Board of Directors and senior management, IT and information security teams, Risk management and compliance departments
What is the frequency of VAPT required by RBI?
RBI mandates periodic VAPT but does not specify an exact frequency in this circular; banks should determine a schedule based on risk assessment and ensure regular testing.
Do we need board approval for information security policies?
Yes, the circular states that policies governing security of information systems should be discussed and approved at the board level and updated from time to time.
What should be included in the BCP document?
The BCP document should cover policies, standards, and procedures to ensure continuity, resumption, and recovery of critical business processes, limiting impact on people, processes, and infrastructure.