RBI cyber security audit checklist

What supervision is testing now

The pattern in supervisory findings has shifted from whether a control exists to whether the institution can show who owns it, who reviewed it, and what happened when it failed. That is a governance test wearing technical clothing.

The Master Direction on IT Governance, Risk, Controls and Assurance Practices places specific responsibilities on the board and on a board level IT strategy committee. In practice that means minutes recording decisions against named owners, and evidence of what changed by the next meeting.

Two institutions with comparable security postures can receive very different inspection outcomes on that difference alone.

Third party and concentration risk

Outsourcing does not move accountability, and this is now tested directly. Which critical functions run on a vendor. What happens if that vendor is unavailable for a week. When did you last test that. What audit right do you hold.

Most institutions answer the first. Few answer the second with anything beyond a contractual clause. Almost none have exercised the third.

Concentration is the specific probe. If four critical services run in one cloud region operated by one provider, the fact that each contract is individually sound does not address the correlated failure.

Continuity, tested rather than documented

A BCP that has never been exercised counts for little. A DR test where the application team knew the date and pre-warmed the environment counts for less than the institution thinks.

What holds up is an unannounced or minimally announced failover, with recovery time measured rather than asserted, and a written record of what did not work.

Reports recording a clean test with no issues attract scepticism, correctly, because a real failover always surfaces something.

What to fix first

Board paperwork, because it is the cheapest gap to close and it colours how everything else is read. Named owners, dated decisions, recorded follow ups.

Then map critical services to their third parties and identify the concentration.

Then run one unannounced failover this quarter and write down honestly what broke.

Then reconcile privileged access against your HR record. Standing administrative access in a regulated institution is the finding that becomes an enforcement conversation, and the reconciliation is a fortnight of dull work that reliably finds accounts belonging to people who left years ago.

None of this requires new technology, which is usually the uncomfortable part of the conversation.