INFORMATION TECHNOLOGY FRAMEWORK
The Board of Directors of the Company ensures implementation of this IT Framework which, inter alia, includes (i) Security aspects; (ii) User Role; (iii1 maker-checker concept to reduce the risk of error aiid misr›se and to ensure reliability of data/information; (iv) Information Security and Cyber Security;
(iv) Business Continuity Planning Policy; (v) Back up Data. For the purpose of effective implementation of this IT Framework, the Company shall ensure technical competence at senior/middle level management of NBFC. It is also responsible for periodic assessment of the IT training requirements to ensure the availability of sufficient, competent and capable human resources in NBFC.
(Formulated in terms of Para 8 of the Master Direction - Information Technology Framework for the NBFC Sector Dated: June 08,2017; approved and adopted by the Board of Directors at their meeting held on 21" AUgUSt, 2024}
INTRODUCTION
IT governance is an integral part of corporate governance of NBFC, and effective IT governance is the responsibility of the board of directors of NBFC (“Board”) and its executive management.
CONSTITUTION OF IT COMMITTEE
1. Mr. Rajesh Jain
2. Mr. Dhiraj Bhutoria
3. Mr. Vaibhav Anil Jain
ROLE OF IT COMMITTEE
1. Developing Basic IT systems mainly for mair’.taini ng the database.
2. System generated reports for Top Management summaris’ng financial position including operating and non-operating revenues and expenses, cost benefit analysis of segments/verticals, cost of funds, etc.
APPLICABILITY OF FAIR PRACTICE CODE
CHAIRMAN
The Chairman of the IT Committee shall be Mr. Rajesh Jain.
MEETING
The Committee shall meet at least half yearly or any time when necessary or desirable.
QUORUM
The Quorum at the meeting of the committee shall be two members.
RESPONSIBILITIES, DUTIES AND AUTHRORITIES OF THE COMMITTEE
I. Basic security aspects such as physical/ logical access controls and well defined password policy;
II. A well-defined user role;
III. A Maker-checker concept to reduce the risk of error and misuse and to ensure reliability of data/information;
IV. Information Security and Cyber Security;
V. Requirements as regards Mobile Financial Services, Social Media and Digital Signature Certificates as indicated in para 3.18, 3.10 & 3.11 above;
VI. System generated reports for Top Management summarising financial position including operating and non-operating revenues and expenses, cost benefit analysis of segments/verticals, cost of funds, etc.;
VII. Adequacy to file regulatory returns to RBI (CIMS Returns);
VIII. A BCP policy duly approved by the Board ensuring regular oversight of the Board by way of periodic reports (at least once every year);
IX. Arrangement for backup of data with periodic testing.
A. SECURITY ASPECTS
- Password Policy
All users are responsible for keeping their passwords secure and confidential. The password credentials of the users must comply with the password parameters (“Complexity Requirements”) and standards laid down in this IT Framework. Passwords must not be shared with or made available to anyone in any manner that is not consistent with this IT Framework.
The Complexity Requirements for setting passwords are as follows:
- A strong password must be at least 8 (Eight) characters
- It should not contain any of the user’s personal information—specifically his/her real name, user name, or even company
- It must be very unique from the passwords used previously by the
- It should not contain any word spelled
- It should contain characters from the four primary categories e. uppercase letters, lowercase letters, numbers, and characters.
- To ensure that a compromised password is not misused on a long-term basis, users are encouraged
to change the password every 30 (Thirty) days.
- Passwords must not be stored in readable form in computers without access control systems or in other locations where unauthorized persons might discover Passwords must not be written down and left in a place where unauthorized persons might discover them.
- immediately upon assignment of the initial password and in case of password “reset” situations, the password must be immediately changed by the user to ensure confidentiality of all
- Under no circumstances, the users shall use another user’s account or password without proper
- Under no circumstances, should the user share his/her password(s) with other user(s), unless the said user has obtained from the concerned branch manager/IT head the necessary approval in this In cases where the password(s) is shared in accordance with the above, the user shall be responsible for changing the said password(s) immediately upon the completion of the task for which the password was shared.
ii. Access Controls
- Access to the Company’s electronic information and information systems, and the facilities where they are housed, is a privilege that may be monitored and revoked without Additionally, allaccess is governed by law and NBFC policies including but not limited to requirements laid down in this policy.
- Persons or entities with access to the Company’s electronic information and information systems are accountable for all activities associated with their user They are responsible to protectthe confidentiality, integrity, and availability of information collected, processed, transmitted, stored, or transmitted by Company, irrespective of the medium on which the information resides.
- Access must be granted on the basis of least privilege – only to resources required by the current
role and responsibilities of the person.
• Requirements:
- AlI users must use a unique ID to access Company’s systems and
- Alternative authentication mechanisms that do not rely on a unique ID and password must be formally approved.
- Remote access to Company systems and applications must use a two-factor authentication where possible
- Systemand application sessions must automatically lock after 10 (Ten) minutes of
B. INFORMATION SECURITY AND CYBER SECURITY
i. Information Security:
Company has an information security framework with the following principles:
- Identification and classification of information assets — Company maintains detailed inventory of information asset with distinct and clear identification of the
- Functions— The information security function is adequately resourced in terms of the number of
staff, level of skill and tools or techniques like risk assessment, security architecture, vulnerability assessment, forensic assessment, etc. Further, there is a clear segregation of responsibilities relating to system administration, database administration and transaction processing.
- Role based access control — Access to information is based on well-defined user roles (system
administrator, user manager, application owner). NBFC has a clear delegation of authority to
upgrade/change user profiles and permissions and also key business parameters.
- Personnel Security — A few authorized application owners/users may have intimate knowledge of financial institution processes and they pose potential threat to systems and Company has a process of appropriate checks and balances to avoid any such threat to its systems and data. Personnelwith privileged access like system administrator, cyber security personnel, etc are subject
to rigorous background check and screening.
- Physical Security — The confidentiality, integrity, and availability of information can be impaired through physical access and damage or destruction to physical Company has created a secured environment for physical security of information assets such as secure location of critical data, restricted access to sensitive areas like data centres etc. and has further obtained adequate
insurance to safeguard such data.
- Maker-checker — Maker checker is one of the important principles of authorization in the information systems of financial It means that for each transaction, there are at least two individuals necessary for its completion as this will reduce the risk of error and will ensure reliability of information. Company ensures that it complies with this requirement to carry out all its business operations.
- Trails — Company ensures that audit trails exist for IT assets satisfying its business requirements including regulatory and legal requirements, facilitating audit, serving as forensic evidence when required and assisting in dispute If an employee, for instance, attempts to access an unauthorized section, this improper activity is recorded in the audit trail.
- Mobile Financial Services — Company has a mechanism for safeguarding information assets that are used by mobile applications to provide services to The technology used by Company for mobile services ensures confidentiality, integrity and authenticity and provides for end-to-end encryption.
- Social Media Risks — Company uses social media to market their products and is well equipped in handling social media risks and threats in order to avoid any account takeover or malware Company further ensures proper controls such as encryption and secure connections to mitigate such risks.
- Digital Signatures — A Digital signature certificate authenticates entity’s identity Company protects the authenticity and integrity of important electronic documents and also for high value fund transfer.
- Regulatory Returns — Company has adequate system and formats to file regulatory returns to the RBI on a periodic Filing of regulatory returns is managed and verified by the authorised representatives of Company.
- System generated reports— Company has adequate system for generation of reports for Top
Management summarising financial position including operating and non-operating revenues and expenses, cost benefit analysis of segments/verticals, cost of funds, etc.
B. INFORMATION SECURITY AND CYBER SECURITY
(ii) cyber Security
- Company takes effective measures to prevent cyber-attacks and to promptly detect any cyber intrusions to respond / recover / contain the fall Among other things, Company takes necessary preventive and corrective measures in addressing various types of cyber threats which includes denial of service, distributed denial of services (DDoS), ransom-ware / crypto ware, destructive malware, business email frauds including spam, email phishing, spear phishing, whaling, vishing frauds, drive-by downloads, browser gateway fraud, ghost administrator exploits, identity frauds,
memory update frauds and password related frauds.
- Company realises that managing cyber risk requires the commitment of the entire organization to create a cyber-safe This requires a high level of awareness among staff at all levels. Company ensures that the top management and the Board have a fair degree of awareness of the fine nuances of the threats. Further, it also proactively promotes, among their customers, vendors, service providers and other relevant stakeholders an understanding of their cyber resilience objectives, and ensures appropriate action to support their synchronised implementation and
testing.
(iii) Confidentiality
- Company along with preservation and protection of the security (as set out in detail above), also ensures confidentiality of customer information in the custody or possession of the service
- Access to customer information by employees of the service provider to Company is on ‘need to know’ basis i.e., limited to those areas where the information is required in order to perform the outsourced
- Company further ensures that the service provider isolates and clearly identifies Company’s customer information, documents, records and assets to protect the confidentiality of the
- Company has strong safeguards in place so that there is no comingling of information / documents, records and
- It ensures that it immediately notifies RBI in the event of any breach of security and leakage of confidential customer related
C. BUSINESS CONTINUITY PLANNING (BCP)
- BCP forms a significant part of any organisation’s overall Business Continuity Management plan, which includes policies, standards and procedures to ensure continuity, resumption and recovery of critical business processes. BCP at Company is also designed to minimise the operational, financial, legal, reputational and other material consequences arising from a Company has a Board approved BCP Policy. The functioning of BCP shall be monitored by the Board by way of periodic reports
- Company requires its service providers to develop and establish a robust framework for documenting, maintaining and testing business continuity and recovery It ensures that the service provider periodically tests the Business Continuity and Recovery Plan and occasionally conducts joint testing and recovery exercises with its service provider
- In order to mitigate the risk of unexpected termination of the outsourcing agreement or liquidation of the service provider, Company retains an appropriate level of control over their outsourcing and the right to intervene with appropriate measures to continue its business operations in such cases without incurring prohibitive expenses and without any break in its operations and its services to the
- It ensures that service providers are able to isolate Company’s information, documents and records and other In appropriate situations, it can remove, all its assets, documents, records of transactions and information given to the service provider, from the possession of the service provider in order to continue its business operations, or delete, destroy or render the same unusable.
- The Board is responsible for formulation, review and monitoring of BCP to ensure continued effectiveness including identifying critical business verticals, locations and shared resources to prepare a detailed business impact
- After the vulnerabilities and inter relationships between various systems, departments and business processes are identified, there should be a recovery strategy available with the Company to minimise losses in case of a Company also has the option of alternate service providers and would be able to bring the outsourced activity back in-house in case of an emergency.
- It also has in place necessary backup sites for their critical business systems and Data
- These plans are also tested by Company on a regular The results along with the gap analysis are placed before the Board.
D. BACK-UP OF DATA WITH PERIODIC TESTING
- In order to prevent loss of information by destruction of the magnetic means in which it is stored, a periodic backup procedure is carried The responsibility of backing up the information located in shared access servers is the network administrators’.
- Restoration testing on a time to time basis is done as both hard disks and magnetic tapes are prone to As a general rule, daily full backup happens for all critical business application and a complete weekly full backup is carried out including file servers/old data kept on servers.