INFORMATION TECHNOLOGY & DIGITAL BANKING MODULE D QUIZ 2

Logical security uses technical controls such as authentication, authorisation, encryption and system configuration to protect digital resources. Locks, barriers, guards and building access systems are physical security controls.

Least privilege grants only the access needed for the task and only for the required period. Time-bound accounts, approvals, monitoring and prompt revocation reduce the risk of lingering or excessive access.

Rapid containment may include isolating the affected device from the network, notifying the security/incident-response team and preserving evidence. Recovery should follow validated procedures; paying a ransom or deleting evidence should not be an improvised first response.

Encryption is primarily used to protect confidentiality, while digital signatures support integrity and authentication of origin. A signed message may still be readable unless separately encrypted; encrypted data is not automatically digitally signed.

A compromised key undermines trust in the corresponding certificate. The organisation should follow incident procedures, revoke or otherwise invalidate the certificate through the relevant CA process, replace the key pair and certificate, and investigate potential misuse.

A hash function maps data to a fixed-length digest. A signature process commonly signs the digest rather than the entire message, making verification efficient and allowing changes to the message to be detected with overwhelming probability when secure algorithms are used.

A BIA identifies critical business activities, the effects of disruption over time, dependencies and recovery priorities. It informs RTO/RPO targets and continuity strategies; it is not simply an inventory of computer hardware.

Disaster avoidance aims to reduce the likelihood or impact of disruption before it occurs. Examples include resilient power, fire suppression, redundant network paths, preventive maintenance and protection against environmental hazards.

A successful backup job does not guarantee that data can be restored, is complete, or is free of corruption or malware. Restoration tests validate recoverability and help confirm that recovery procedures meet required objectives.

Segregation of duties divides sensitive activities among different people or roles so one person cannot initiate, approve and conceal an unauthorised action. Where staffing limits prevent full separation, compensating controls and monitoring may be needed.

Audit sampling examines less than the full population to draw conclusions about controls or transactions. The sample method and size should be appropriate to the risk and audit objective, and sampling limitations should be recognised.

An RFP communicates the organisation’s requirements, scope, evaluation criteria, commercial terms and submission instructions so potential vendors can propose solutions on a comparable basis. It supports transparency and structured evaluation.

A documented evaluation framework applies predefined technical, security, regulatory, service, resilience, implementation and commercial criteria. Weighted scoring may help, but material risks and mandatory requirements should not be overridden simply by a low price.

An SLA should specify measurable service expectations, measurement methods, reporting, exclusions and remedies. Availability percentage is a common metric, but it must be defined clearly, including the measurement window and treatment of planned maintenance.

SLA management should verify measurements, record the breach, assess business impact, require corrective actions and apply contractual remedies or escalation as provided. Repeated failures may prompt a formal service review, remediation plan or exit decision.

Outsourcing does not transfer the bank’s ultimate responsibility for regulatory compliance and risk management. Contracts and oversight should address due diligence, access and audit rights, security, resilience, incident notification, subcontracting, data handling and exit/transition arrangements.

Information security protects information’s confidentiality, integrity and availability in any form, including paper and digital records. Cybersecurity focuses more specifically on digital systems, networks and cyber threats; the two fields overlap substantially.

Senior governance is needed to establish risk appetite, accountability, oversight and resources for cyber risk. A policy should be supported by implementation, monitoring, incident response, testing and periodic review; merely approving a document is not sufficient.

Digital-payment security requires layered, risk-based controls such as strong customer authentication where applicable, transaction monitoring, secure application design, device/session controls, alerts, fraud response and customer awareness. The exact requirements depend on the payment product and applicable RBI directions.

The bank should activate its incident-response and continuity processes, contain the threat, preserve evidence, assess impact, restore safely and notify the appropriate internal and external authorities within applicable timelines. Reporting requirements should be checked against current RBI directions and other applicable obligations.