RBI Cybersecurity Framework for Banks 40: Para 40: IT and information security risk management framework

The bank establishes a robust IT and information security risk management framework (it may keep a separate cyber risk framework) covering an information security management function, internal controls and processes including insurance cover, periodically reviewed for efficacy; the roles of stakeholders including third-party personnel with role conflicts and accountability gaps identified and removed or managed; identification and fortification of critical information systems; and systems, procedures and controls for secure storage, transmission and processing of data.