PART 1 AUDIT OF OWNER DIVISION

CHECKLIST FOR OWNER DIVISION AUDIT OF OUTSOURCING OF IT SERVICES

DATE:

OWNER DIVISION:

REFERENCE: RBI Circular no. 2023-24/102 DoS.CO.CSITEG /SEC.1/ 31.01.015/ 2023-24 dated April 10, 2023

S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER

No. Partial / No / /VENDOR
Not
Applicable
Regulatory and Supervisory 4
requirements
1 Whether Outsourced Activity is 4(a)
approved by Competent Authority
and Data on Outsourcing
Arrangement has been obtained
and kept on record.
2 If yes, whether vendor entered into 4(a)
an Agreement with Bank before
start of the activity and whether
activity has been carried out within
validity period of the Agreement.
3 Whether Owner Division has taken 4(a)
steps to ensure that the service
provider employs the same high
S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER
No. Partial / No / /VENDOR
Not
Applicable
standard of care in performing the
services as would have been
employed by the them, if the same
activity was not outsourced.
4 Whether Owner Division has taken 4(a)
into consideration into not to
engage an IT service provider that
would result in reputation of Bank
being compromised or weakened.
5 Whether outsourcing of IT Services 4(b)
does not impede the RBI in
carrying out its supervisory
functions and objectives

6 Whether Owner Division ensured 4(c)

that the service provider, if not a
group company, is not be owned or
controlled by any director, or key
managerial personnel, or approver
of the outsourcing arrangement of
the RE, or their relatives.
7 Whether Owner Division inter-alia 4(c)
ensured that there is no conflict of
interest arising out of third-party
engagements.
8 Whether Owner Division has
evaluated the need for Outsourcing
of IT Services based on
comprehensive assessment of
attendant benefits, risks and
availability of commensurate
processes to manage those risks.
S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER
No. Partial / No / /VENDOR
Not
Applicable
9 Whether Owner Division has inter-
alia considered:
a) determining the need for 5 (a)
outsourcing based on criti-
cality of activity to be out-
sourced;
b) determining expectations 5 (b)
and outcome from outsourc-
ing;
c) determining success factors 5 (c)
and cost-benefit analysis;
and
d) deciding the model for out- 5 (d)
sourcing.
Compliance with all applicable 6
statutory and regulatory
requirements
10 Whether the owner division has
considered all relevant laws,
regulations, rules, guidelines and
conditions of approval, licensing or
registration, when performing its
due diligence in relation to
outsourcing of IT services.
Grievance Redressal Mechanism 7
11 Whether Owner Division has a 7(a)
robust grievance redressal
mechanism that is not be
compromised in any manner on
account of outsourcing, i.e.,
responsibility for redressal of
customers’ grievances related to
S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER
No. Partial / No / /VENDOR
Not
Applicable
outsourced services shall rest with
the Bank.
12 Whether Outsourcing 7(b)
arrangements affects the rights of a
customer against the Bank,
including the ability of the customer
to obtain redressal as applicable
under relevant laws.
Inventory of Outsourced 8
Services
13 Whether Bank has created an
inventory of services provided by
the service providers (including key
entities involved in their supply
chains).
14 Whether Bank has mapped their
dependency on third parties and
periodically evaluate the
information received from the
service providers
IT Outsourcing Policy 9
15 Whether Owner Division intended
to outsource any of its IT activities
has put in place a comprehensive
Board approved IT outsourcing
policy.
Role of the Senior Management 11

16 Whether Senior Management of the

Owner Division is, inter alia,
responsible for:
a) formulating IT outsourcing
S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER
No. Partial / No / /VENDOR
Not
Applicable
policies and procedures, 11 (a)
evaluating the risks and ma-
teriality of all existing and
prospective IT outsourcing
arrangements based on the
framework commensurate
with the complexity, nature
and scope, in line with the
enterprise-wide risk man-
agement of the organization
approved by the Board and
its implementation;
b) prior evaluation of prospec-
tive IT outsourcing arrange- 11 (b)
ments and periodic evalua-
tion of the existing outsourc-
ing arrangements covering
the performance review,
criticality and associated
risks of all such arrange-
ments based on the policy
approved by the Board;
c) identifying IT outsourcing
risks as they arise, monitor-
ing, mitigating, managing
and reporting of such risks 11 (c)
to the Board/ Board Com-
mittee in a timely manner;
d) ensuring that suitable busi-
ness continuity plans based
on realistic and probable
disruptive scenarios, includ-
ing exit of any third-party
S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER
No. Partial / No / /VENDOR
Not
Applicable
service provider, are in 11 (d)
place and tested periodi-
cally;
e) ensuring (i) effective over-
sight over third party for
data confidentiality and (ii)
appropriate redressal of
customer grievances in a 11 (e)
timely manner;
f) ensuring an independent re-
view and audit on a periodic
basis for compliance with
the legislations, regulations,
Board-approved policy and 11 (f)
performance standards and
reporting the same to
Board/ Board Committee;
and
g) creating essential capacity
with required skillsets within
the organization for proper
oversight of outsourced ac-
tivities.
11 (g)
17 Role of IT Function 12

Whether the responsibilities of the

IT Function of the Owner Division
is, inter alia, include:

a) assisting the Senior Man- 12(a)

agement in identifying, mea-
suring, monitoring, mitigat-
S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER
No. Partial / No / /VENDOR
Not
Applicable
ing and managing the level
of IT outsourcing risk in the
organisation;
b) ensuring that a central data- 12(b)
base of all IT outsourcing
arrangements is maintained
and is accessible for review
by Board, Senior Manage-
ment, Auditors and Supervi-
sors;
c) effectively monitor and su-
pervise the outsourced ac- 12(c)
tivity to ensure that the ser-
vice providers meet the laid
down performance stan-
dards and provide uninter-
rupted services, report to
the Senior Management;
co-ordinate periodic due dili-
gence and highlight con-
cerns, if any; and
d) putting in place necessary
documentation required for 12(d)
contractual agreements in-
cluding service level man-
agement, monitoring of ven-
dor operations, key risk indi-
cators and classifying the
vendors as per the deter-
mined risk.

18 Due Diligence on Service Providers 13

S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER
No. Partial / No / /VENDOR
Not
Applicable
a) Whether in considering or 13(a)
renewing an Outsourcing of
IT Services arrangement,
appropriate due diligence
has performed to assess
the capability of the service
provider to comply with
obligations in the
outsourcing agreement on
an ongoing basis.
b) Whether a risk-based 13(b)
approach has adopted in
conducting such due
diligence activities.
c) Whether Due diligence has
taken into consideration 13(c)
qualitative, quantitative,
financial, operational, legal
and reputational factors.
Where possible, whether
the Owner Division obtains
independent reviews and
market feedback on the
service provider to
supplement its own
assessment.
d) Whether Owner Division 13(d)
also consider, while
evaluating the capability of
the service provider, risks
arising from concentration
of outsourcing
arrangements with a single
S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER
No. Partial / No / /VENDOR
Not
Applicable
or a few service provider/s.
e) Whether the owner division 13(e)
has taken adequate
cognition of historical
violations or issue
remediation during previous
audits and assessments.
f) Data provided by the vendor
for due diligences should 13(f)
not be more than 12 months
old.
g) Whether the owner division 13(g)
maintains the record of
previous audit and
assessment for the
regulatory requirement.
19 Whether Due Diligence of
the Outsourcing Vendor was
carried out and as stipulated in
Bank’s Outsourcing Policy. If so,
whether the same reads
satisfactory.
20 Whether Owner Division has SOP
in place on periodic due diligence
of vendors / sub vendor and
subsequent reporting to appropriate
authority.
21 Whether Owner Division has record
on the due diligence conducted on
outsourced agencies (date of
inspection, date of submission of
report, date of approval of report,
S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER
No. Partial / No / /VENDOR
Not
Applicable
date of approving authority)
22 Aspects to be considered 14

Whether Due diligence has

involved evaluation of all available
information, as applicable, about
the service provider, including but
not limited to:

a) past experience and 14 (a)

demonstrated competence
to implement and support
the proposed IT activity over
the contract period;
b) financial soundness and
ability to service 14 (b)
commitments even under
adverse conditions;
c) business reputation and 14 (c)
culture, compliance,
complaints and outstanding
or potential litigations;
d) conflict of interest, if any; 14 (d)
e) external factors like political,
economic, social and legal 14 (e)
environment of the
jurisdiction in which the
service provider operates
and other events that may
impact data security and
service performance;
f) details of the technology, 14 (f)
infrastructure stability,
S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER
No. Partial / No / /VENDOR
Not
Applicable
security and internal control,
audit coverage, reporting
and monitoring procedures,
data backup arrangements,
business continuity
management and disaster
recovery plan;
g) capability to identify and 14 (g)
segregate Bank data;
h) quality of due diligence 14 (h)
exercised by the service
provider with respect to its
employees and sub-
contractors;
i) capability to comply with the 14 (i)
regulatory and legal
requirements of the
Outsourcing of IT Services
arrangement;
j) information / cyber security 14 (j)
risk assessment;
k) ensuring that appropriate 14 (k)
controls, assurance
requirements and possible
contractual arrangements
are in place to ensure data
protection and Bank's
access to the data which is
processed, managed or
stored by the service
provider;
l) ability to effectively service 14 (l)
all the customers while
S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER
No. Partial / No / /VENDOR
Not
Applicable
maintaining confidentiality,
especially where a service
provider has exposure to
multiple entities; and
m) ability to enforce 14 (m)
agreements and the rights
available thereunder
including those relating to
aspects such as data
storage, data protection and
confidentiality.
n) Whether Cyber Security
Risk Assessment Checklist
is obtained and held on
record.
o) Whether Annual Cyber Risk
Assessment of Vendor is
carried out.
23 Legally binding agreement 15

a) Whether owner division has 15(a)

ensured that their rights and
obligations and those of
each of their service
providers are clearly defined
and set out in a legally
binding written agreement.
b) Whether In principle, the 15(b)
provisions of the agreement
appropriately reckon the
criticality of the outsourced
task to the business of the
S. Check Points Reference Yes / Observation Risk Impact Recommendation OWNER
No. Partial / No / /VENDOR
Not
Applicable
Bank, the associated risks
and the strategies for
mitigating or managing
them.
c) Whether the terms and 15(c)
conditions governing the
contract has carefully
defined and vetted by the
Bank’s legal counsel for
their legal effect and
enforceability.
d) Whether agreement is 15(d)
sufficiently flexible to allow
the Bank to retain adequate
control over the outsourced
activity and the right to
intervene with appropriate
measures to meet legal and
regulatory obligations.
e) Whether the agreement has
also brought out the nature
of legal relationship
between the parties.

24 Aspects to be considered in 16
agreement
Whether the agreement at a
minimum includes (as applicable to
the scope of Outsourcing of IT
Services) the following aspects:

a) details of the activity being 16(a)

 outsourced, including
appropriate service and
performance standards
including for the sub-
contractors, if any;
b) effective access by the 16(b)
Bank to all data, books,
records, information, logs,
alerts and business
premises relevant to the
outsourced activity,
available with the service
provider; 16(c)
c) regular monitoring and
assessment of the service
provider by the Audit Office
for continuous management
of the risks holistically, so
that any necessary
corrective measure can be
taken immediately; 16(d)
d) type of material adverse
events (e.g., data breaches,
denial of service, service
unavailability, etc.) and the
incidents required to be
reported to Bank to enable
Bank to take prompt risk
mitigation measures and
ensure compliance with
statutory and regulatory
guidelines; 16(e)
e) compliance with the
provisions of Information
Technology Act, 2000, other
applicable legal
 requirements and standards
to protect the customer 16(f)
data;
f) the deliverables, including
Service-Level Agreements
(SLAs) formalising
performance criteria to
measure the quality and 16(g)
quantity of service levels;
g) storage of data (as
applicable to the concerned
Bank) only in India as per
extant regulatory 16(h)
requirements;
h) clauses requiring the
service provider to provide
details of data (related to
Bank and its customers) 16(i)
captured, processed and
stored;
i) controls for maintaining
confidentiality of data of
Bank’s and its customers’,
and incorporating service
provider’s liability to Bank in
the event of security breach 16(j)
and leakage of such
information;
j) types of data/ information
that the service provider
(vendor) is permitted to
share with Bank’s customer 16(k)
and / or any other party;
k) specifying the resolution
process, events of default,
indemnities, remedies, and 16(l)
 recourse available to the
respective parties;
l) contingency plan(s) to 16(m)
ensure business continuity
and testing requirements;
m) right to conduct audit of the
service provider (including
its sub-contractors) by the
Bank, whether by its internal
or external auditors, or by
agents appointed to act on
its behalf, and to obtain
copies of any audit or
review reports and findings
made about the service 16(n)
provider in conjunction with
the services performed for
the Bank;
n) right to seek information
from the service provider 16(o)
about the third parties (in
the supply chain) engaged
by the former;
o) recognising the authority of
regulators to perform
inspection of the service
provider and any of its sub-
contractors. Adding clauses
to allow RBI or person(s)
authorised by it to access
the Bank's IT infrastructure,
applications, data,
documents, and other
necessary information given
to, stored or processed by
the service provider and/ or
 its sub-contractors in 16(p)
relation and as applicable to
the scope of the outsourcing
arrangement;
p) including clauses making
the service provider
contractually liable for the 16(q)
performance and risk
management practices of its
sub-contractors;
q) obligation of the service
provider to comply with
directions issued by the RBI
in relation to the activities
outsourced to the service
16(r)
provider, through specific
contractual terms and
conditions specified by the
Bank;
r) clauses requiring prior
approval/ consent of the 16(s)
Bank for use of sub-
contractors by the service
provider for all or part of an
outsourced activity;
s) termination rights of the
Bank, including the ability to
orderly transfer the
proposed IT-outsourcing
arrangement to another 16(t)
service provider, if
necessary or desirable;
t) obligation of the service
provider to co-operate with
the relevant authorities in 16(u)
 case of insolvency/
resolution of the Bank;
u) provision to consider skilled
resources of service
provider who provide core
services as “essential
personnel” so that a limited
number of staff with back-up
arrangements necessary to
operate critical functions
can work on-site during 16(v)
exigencies (including
pandemic situations);
v) clause requiring suitable
back-to-back arrangements
16(w)
between service providers
and the OEMs; and
w) clause requiring non-
disclosure agreement with
respect to information
retained by the service
provider.

25 Risk Management Framework 17

a) Whether Owner Division put 17(a)
in place a Risk
Management framework for
Outsourcing of IT Services
that comprehensively deal
with the processes and
responsibilities for
identification, measurement,
mitigation, management,
and reporting of risks
associated with Outsourcing
 of IT Services
arrangements.
b) Whether the risk 17(b)
assessments carried out by
the Owner Division suitably
documented with necessary
approvals in line with the
roles and responsibilities for
the Board of Directors,
Senior Management and IT
Function. Such risk
assessments shall be
subject to internal and
external quality assurance
on a periodic basis as
determined by the Board-
approved policy.
c) Whether Owner Division is 17(c)
responsible for the
confidentiality and integrity
of data and information
pertaining to the customers
that is available to the
service provider.
d) Access to data at Owner 17(d)
Division’s location / data
centre by service providers
shall be on need-to-know
basis, with appropriate
controls to prevent security
breaches and/or data
misuse.
e) Whether Owner Division
ensure the preservation and 17(e)
protection of the security
and confidentiality of
 customer information in the
custody or possession of
the service provider. Access
to customer information by
staff of the service provider
shall be on need-to-know
basis.
f) In the event of multiple
service provider 17(f)
relationships where two or
more service providers
collaborate to deliver an
end-to-end solution, the
Owner Division remains
responsible for
understanding and
monitoring the control
environment of all service
providers that have access
to the Bank’s data, systems,
records or resources.
g) In instances where service
provider acts as an 17(g)
outsourcing agent for
multiple Banks, Whether
care has taken by Owner
Division to build adequate
safeguards so that there is
no combining of information,
documents, records and
assets.
h) Whether Owner Division
ensures that cyber incidents
are reported to the Bank by 17(h)
the service provider without
undue delay, so that the
 incident is reported by the
Bank to the RBI within 6
hours of detection by the
TPSP (Third Part Service
Provider).
i) Whether Owner Division
review and monitor the
control processes and 17(i)
security practices of the
service provider to disclose
security breaches. The
Bank shall immediately
notify RBI in the event of
breach of security and
leakage of confidential
customer related
information. In these
eventualities, Bank shall
adhere to the extant
instructions issued by RBI
from time to time on
Incident Response and
Recovery Management.
j) Concentration Risk:
Whether Owner Division 17(j)
effectively assess the
impact of concentration risk
posed by multiple
outsourcings to the same
service provider and/or the
concentration risk posed by
outsourcing critical or
material functions to a
limited number of service
providers.
k) Whether the owner division 17(k)
 places the minutes of Risk
Management Committee
meetings before the Board
for their information.
26 Business Continuity Plan and 18
Disaster Recovery Plan
a) Whether Owner Division 18(a)
ensure their service
providers to develop and
establish a robust
framework for documenting,
maintaining and testing
Business Continuity Plan
(BCP) and Disaster
Recovery Plan (DRP)
commensurate with the
nature and scope of the
outsourced activity as per
extant instructions issued by
RBI from time to time on
BCP/ DR requirements.
b) In establishing a viable 18(b)
contingency plan, Whether
Owner Division is
considered the availability of
alternative service providers
or the possibility of bringing
the outsourced activity back
in-house in an emergency
and the costs, time and
resources that would be
involved.
c) In order to mitigate the risk
of unexpected termination 18(c)
of the outsourcing
agreement or insolvency/
 liquidation of the service
provider, Whether Owner
Division retains an
appropriate level of control
over their IT-outsourcing
arrangement along with
right to intervene, with
appropriate measures to
continue its business
operations.
d) Whether Owner Division 18(d)
ensures that service
providers are able to isolate
the Bank’ information,
documents and records and
other assets. This is to
ensure that, in adverse
conditions or termination of
the contract, all documents,
record of transactions and
information with the service
provider and assets of the
Bank can be removed from
the possession of the
service provider, or deleted,
destroyed or rendered
unusable.

27 Monitoring and Control of 19

Outsourced Activities
a) Owner Division shall have in 19 (a)
place a management
structure to monitor and
control its Outsourced IT
activities. This shall include
(as applicable to the scope
of Outsourcing of IT
 Services) but not limited to
monitoring the performance,
uptime of the systems and
resources, service
availability, adherence to
SLA requirements, incident
response mechanism, etc.
b) Whether audit office assess 19(b)
the performance of the
service provider, adequacy
of the risk management
practices adopted by the
service provider,
compliance with laws and
regulations, etc.
c) Whether Owner Division 19 (c)
monitors and controls the
activities and report
periodically by the Senior
Management and in case of
any adverse development,
the same shall be put up to
the Board for information.
d) Whether Owner Division 19 (d)
has relied on any globally
recognized third party
certifications which have
been made available by the
service provider? If Yes,
please specify the same.
e) Whether Owner Division
reviews periodically the 19 (e)
financial and operational
condition of the service
provider to assess its ability
to continue to meet its
 Outsourcing of IT Services
obligations.
f) Whether Owner Division
adopts risk-based approach
in defining the periodicity 19 (f)
and such due diligence
reviews whether highlights
by audit office any
deterioration or breach in
performance standards,
confidentiality, and security,
and in operational resilience
preparedness.
g) In the event of termination
of the outsourcing 19(g)
agreement for any reason in
cases where the service
provider deals with the
customers of the Bank, the
same shall be given due
publicity by the Owner
Division so as to ensure that
the customers stop dealing
with the concerned service
provider.
h) Whether Owner Division
ensures that the service 19(h)
provider grants unrestricted
and effective access to a)
data related to the
outsourced activities; b) the
relevant business premises
of the service provider;
subject to appropriate
security protocols, for the
purpose of effective
 oversight use by the Bank,
their auditors, regulators
and other relevant
Competent Authorities, as
authorised under law.
i) If Bank terminates services
of a service provider, 19(i)
whether owner division of
the Bank, informs to IBA
with reasons for termination
to maintain a caution list of
such service providers for
the entire banking industry
for sharing amongst banks.
28 Outsourcing within a Group / 20
Conglomerate
a) Owner Division may 20(a)
outsource any IT activity/ IT
enabled service within its
business group/
conglomerate, provided that
such an arrangement is
backed by the Board-
approved policy and
appropriate service level
arrangements/ agreements
with its group entities are in
place.
b) Whether the selection of a
group entity is based on
objective reasons that are 20(b)
similar to selection of a
third-party, and any conflicts
of interest that such an
outsourcing arrangement
may entail shall be
 appropriately dealt with.
c) Whether Owner Division, at
all times, maintains an arm's 20(c)
length relationship in
dealings with their group
entities.
d) Whether Risk management
practices being adopted by 20(d)
the Owner Division while
outsourcing to a group
entity have been identified
to those specified for a non-
related party.
29 Additional requirements for Cross- 21
Border Outsourcing
a) The engagement of a 21(a)
service provider based in a
different jurisdiction
exposes the Bank to
country risk. To manage
such risk, Whether Bank
closely monitors
government policies of the
jurisdiction in which the
service provider is based
and the political, social,
economic and legal
conditions on a continuous
basis, as well as establish
sound procedures for
mitigating the country risk.
This includes, inter alia,
having appropriate
contingency and exit
strategies. Further, it shall
be ensured that availability
of records to the Bank and
 the RBI will not be affected
even in case of liquidation
of the service provider. 21(b)
b) Whether the governing law
of the arrangement also be
clearly specified. In
principle, arrangements
have entered into with
parties operating in
jurisdictions upholding
confidentiality clauses and 21(c)
agreements.
c) Whether the right of the
Bank and the RBI to direct
and conduct audit or
inspection of the service
provider based in a foreign
jurisdiction is ensured. 21(d)
d) Whether the arrangement
are complied with all
statutory requirements as
well as regulations issued
by the RBI from time to
time.
30 Exit Strategy 22

a) Whether Outsourcing of IT 22(a)

Services agreement
contains a clear exit
strategy with regard to
outsourced IT activities/ IT
enabled services, while
ensuring business continuity
during and after exit. The
strategy should include exit
strategy for different
 scenarios of exit or
termination of services with
stipulation of minimum
period to execute such
plans, as necessary. In
documenting an exit
strategy, the Owner Division
shall, inter alia, identify
alternative arrangements,
which may include
performing the activity by a
different service provider or
Owner Division itself.
b) Whether Owner Division 22(b)
ensures that the agreement
has necessary clauses on
safe removal/ destruction of
data, hardware and all
records (digital and
physical), as applicable.
However, service provider
shall be legally obliged to
cooperate fully with both the
Owner Division and new
service provider(s) to
ensure there is a smooth
transition.
22(c)
c) Whether agreement
ensures that the service
provider is prohibited from
erasing, purging, revoking,
altering or changing any
data during the transition
period, unless specifically
advised by the regulator/
concerned Bank.
31 Whether the Owner Division has OTHER
provided details of outsourced
vendor (s)
32 Whether half yearly / yearly review OTHER
of the vendor is carried out by the
Owner Division.
33 Whether Performance OTHER
Measurement scoring of the
Vendor is held on record as per the
Outsourcing Policy of the Bank
34 Whether Statement of age-wise OTHER
breakup of entries pending for
reconciliation with outsourced
vendor is maintained and
monitored, if any.
35 Whether Owner Division has details OTHER
of reconciliation of transactions
between Owner Division and
service provider for cash
management services / other recon
entries
36 Whether Standard OTHER
Agreement for the Activities
Outsourced is held on record
37 Whether confirmation on OTHER
Due-Diligence and Police
verification of vendors staff involved
in Outsourcing Activity has been
carried out of Outsourcing policy. If
so, whether the same reads
satisfactory.
38 Whether cost-benefit analysis of OTHER
the Outsourcing Activity has been
conducted or not.

If conducted, whether benefit

 arrived at is realistic and justified.
39 Whether Process involved OTHER
in appointing the service provider
and monitoring his activities as per
the Bank’s Outsourcing Policy
including levying of penalty is being
followed by the respective Owner
Division?.
40 Whether owner division OTHER
ensured that while outsourcing any
activity that a suitable clause be
incorporated in SLA agreement
specifying that any loss due to
system/ process/ people failure at
vendor’s part shall be borne by the
vendor.
41 Whether the contract with service OTHER
provider has suitable clause which
provides the Bank and RBI the
ability to access all books, records
and information relevant to the
Outsourced activity within a
reasonable time.
42 Whether vendor has submitted the OTHER
information and Yearly Cyber
Security Risk Assessment
certificate received from the CERT-
In empaneled IS auditor and duly
signed by vendor’s competent
authority.
43 Whether the Outsourcing is OTHER
Material or Non-Material.
44 Whether new material outsourced OTHER
risk has been identified by the
auditor during the audit.
45 Whether owner division analyzed OTHER
 potential impact of the outsourcing
on the bank on various parameters
such as earnings, solvency,
liquidity, funding capital and risk
profile.
46 Whether owner division has taken OTHER
into consideration the aggregate
exposure to that particular service
provider, in cases where the bank
outsource various functions to the
same service provider is .
47 Whether the Key OTHER
Performance Indicator (KPIs) of
agencies / vendors / sub vendor is
prepared and monitored.
48 Whether incorporation of clause is OTHER
ensured in SLA regarding penalty
provision with clarity in case of
occurrence of fraud due to
deficiency of service in verification
process or when TAT is not
adhered to.
49 Whether customer data OTHER
confidentiality and service
providers’ liability is ensured even
after the expiry of the contract, in
case of breach of security and
leakage of confidential customer
related information.
50 Whether data on outsourcing is OTHER
exhaustive and covers all the
vendors / sub vendor.
51 Whether contingency plan is tested OTHER
for outsourcing activities including
sub vendor.
52 Whether Owner Division is OTHER
 ensuring that the vendor is testing
business continuity and recovery
plans periodically.
53 Whether Owner Division is carrying OTHER
out annual review of all outsourced
entities.
54 Whether Owner Division is having OTHER
details of sub-contracting
arrangement.
55 Strategic Risk – The service OTHER
provider may conduct business on
its own behalf, which is inconsistent
with the overall strategic goals of
the bank.
56 Reputation Risk – Poor service OTHER
from the service provider, its
customer interaction not being
consistent with the overall
standards of the bank.
57 Compliance Risk – Privacy, OTHER
consumer and prudential laws not
adequately complied with.
58 Operational Risk – Arising due to OTHER
technology failure, fraud, error,
inadequate Information Technology
capacity to fulfill obligations and/or
provide remedies.
59 Legal Risk- includes but is not OTHER
limited to exposure to fines,
penalties, or punitive damages
resulting from supervisory actions,
as well as private settlements due
to omissions and commissions of
the service provider.
60 Exit Strategy Risk – This could arise OTHER
from over–reliance on one firm/service
 provider, the loss of relevant skills in
the bank itself preventing it from
bringing the activity back in-house and
contracts entered into wherein speedy
exits would be prohibitively expensive.
61 Counter party Risk – Due to OTHER
inappropriate underwriting or credit
assessments.
62 Country Risk – Due to the political, OTHER
social or legal climate creating added
risk.
63 Contractual Risk – Arising from OTHER
whether or not the bank has the ability
to enforce the contract.
64 Concentration and Systemic Risk – OTHER
Due to lack of control of bank over a
service provider, more so when overall
banking industry has considerable
exposure to one service provider. The
failure of a service provider in providing
a specified service, a breach in
security/ confidentiality, or non-
compliance with legal and regulatory
requirements by either the service
provider or the outsourcing bank can
lead to Information Technology losses
or loss of reputation for the bank and
could also lead to systemic risks within
the entire banking system in the
country. It would therefore be
imperative for the bank outsourcing its
activities to ensure effective
management of these risks.

ANNEXURE 1
 USAGE OF CLOUD COMPUTING SERVICES

S. Check Points Reference Yes / Partial Observation Risk Impact Recommendation

No. / No / Not
Applicable
1 Whether Bank while considering
adoption of cloud solution, it is
imperative to analyses the
business strategy and goals
adopted to the current IT
applications footprint and
associated costs7. Cloud adoption
ranges from moving only non-
business critical workloads to the
cloud to moving critical business
applications such as SaaS
adoption and the several
combinations in-between, which
should be based on a business
technology risk assessment.

2 In engaging cloud services,

Whether Bank has ensured, inter
alia, that the Outsourcing of IT
Services policy addresses the
entire lifecycle of data, i.e.,
covering the entire span of time
from generation of the data, its
entry into the cloud, till the data is
permanently erased/ deleted.

Whether Bank ensured that the

procedures specified are
consistent with business needs
and legal and regulatory
requirements.
3 In adoption of cloud services,
Whether Bank has taken into
account the cloud service specific
factors, viz., multi-tenancy, multi-
location storing/ processing of
data, etc., and attendant risks,
while establishing appropriate risk
management framework. Cloud
security is a shared responsibility
between the Bank and the Cloud
Service Provider(CSP).

Whether Bank has referred to

some of the cloud security best
practices, for implementing
necessary controls, as per
applicability of the shared
responsibility model in the adoption
of cloud services.
4 Cloud Governance: Whether Bank
has adopted and demonstrated a
well-established and documented
cloud adoption policy. Such a
policy should, inter alia, identify the
activities that can be moved to the
cloud, enable and support
protection of various stakeholder
interests, ensure compliance with
regulatory requirements, including
those on privacy, security, data
sovereignty, recoverability and
data storage requirements, aligned
with data classification. The policy
should provide for appropriate due
diligence to manage and
continually monitor the risks
associated with CSPs.

5 Cloud Service Providers

 (CSP)
Considerations for selection
of CSP: Whether Bank has
ensured that the selection of
the CSP is based on a
comprehensive risk
assessment of the CSP.

Whether Bank has entered

into a contract only with
CSPs subject to jurisdictions
that uphold enforceability of
agreements and the rights
available thereunder to Bank,
including those relating to
aspects such as data
storage, data protection and
confidentiality.
6 Cloud Services
Management and Security
Considerations
a) Service and Technol-
ogy Architecture:
Whether Bank has
ensured that the ser-
vice and technology
architecture support-
ing cloud-based ap-
plications is built in
adherence to globally
recognized architec-
ture principles and
 standards.
b) Whether Bank has
preferred a technol-
ogy architecture that
provides for secure
container-based data
management, where
encryption keys and
Hardware Security
Modules are under
the control of the
Bank. The architec-
ture should provide
for a standard set of
tools and processes
to manage contain-
ers, images and re-
leases. Multi- tenancy
environments should
be protected against
data integrity and
confidentiality risks,
and against co-min-
gling of data. The ar-
chitecture should be
resilient and enable
smooth recovery in
case of failure of any
one or combination of
components across
the cloud architecture
with minimal impact
on data/ information
 security.
c) Identity and Access
Management (IAM):
IAM shall be agreed
upon with the CSP
and ensured for pro-
viding role-based ac-
cess to the cloud
hosted applications,
in respect of user-ac-
cess and privileged-
access. Stringent ac-
cess controls, as ap-
plicable for an on-
premise application,
may be established
for identity and ac-
cess management to
cloud-based applica-
tions. Segregation of
duties and role con-
flict matrix should be
implemented for all
kinds of user- access
and privileged-access
roles in the cloud-
hosted application ir-
respective of the
cloud service model.
Access provisioning
should be governed
by principles of ‘need
to know’ and ‘least
 privileges’. In addi-
tion, multi-factor au-
thentication should
be implemented for
access to cloud appli-
cations.
d) Security Controls:
Whether bank has
ensured that the im-
plementation of secu-
rity controls in the
cloud-based applica-
tion achieves similar
or higher degree of
control objectives
than those achieved
in/ by an on-premise
application. This in-
cludes ensuring - se-
cure connection
through appropriate
deployment of net-
work security re-
sources and their
configurations; appro-
priate and secure
configurations, moni-
toring of the cloud as-
sets utilised by the
Bank; necessary pro-
cedures to authorise
changes to cloud ap-
plications and related
 resources.
e) Robust Monitoring
and Surveillance:
Whether Bank has
ensured accurately
define minimum mon-
itoring requirements
in the cloud environ-
ment.
f) Whether Bank has
ensured the assess-
ment of the informa-
tion/ cyber security
capability of the cloud
service provider,
such that, the
i) CSP main-
tains an infor-
mation secu-
rity policy
framework
commensu-
rate with its
exposures to
vulnerabilities
and threats;
ii) CSP is able
to maintain its
information/
cyber security
capability with
respect to
changes in
 vulnerabilities
and threats,
including
those resulting
from changes
to information
assets or its
business envi-
ronment;
iii) nature and fre-
quency of test-
ing of controls
by the CSP in
respect of the
outsourced
services is
commensu-
rate with the
materiality of
the services
being out-
sourced by the
Bank and the
threat environ-
ment; and
iv) CSP has
mechanisms
in place to as-
sess the sub-
contractors
with regards to
confidentiality,
integrity and
 availability of
the data being
shared with
the sub-con-
tractors,
where applica-
ble.
g) Appropriate integra-
tion of logs, events
from the CSP into the
Bank’s SOC, wher-
ever applicable and/
or retention of rele-
vant logs in cloud
shall be ensured for
incident reporting
and handling of inci-
dents relating to ser-
vices deployed on
the cloud.
h) The Bank’s own ef-
forts in securing its
application shall be
complemented by the
CSP’s cyber re-
silience controls. The
CSP / Bank should
ensure continuous
and regular updates
of security-related
software including
upgrades, fixes,
patches and service
 packs for protecting
the application from
advanced threats/
malware.
i) Vulnerability Man-
agement: Whether
Bank has ensured
that CSPs have a
well-governed and
structured approach
to manage threats
and vulnerabilities
supported by requi-
site industry-specific
threat intelligence ca-
pabilities.
7 Disaster Recovery & Cyber
Resilience
a) Whether the
Bank’s business
continuity frame-
work has ensured
that, in the event of
a disaster affecting
its cloud services
or failure of the
CSP, the Bank can
continue its critical
operations with
minimal disruption
of services while
ensuring integrity
and security.
 b) Whether Bank has
ensured that the
CSP puts in place
demonstrative ca-
pabilities for pre-
paredness and
readiness for cyber
resilience as re-
gards cloud ser-
vices in use by
them. This should
be systematically
ensured, inter alia,
through robust in-
cident response
and recovery prac-
tices including con-
duct of Disaster
Recovery (DR)
drills at various
levels of cloud ser-
vices including
necessary stake-
holders.
8 Whether Bank has evaluated
the following points while
developing an exit strategy:
a) the exit strategy
and service level
stipulations in the
SLA shall factor in,
inter alia, agreed
processes and
 turnaround times
for returning the
Bank’s service col-
laterals and data
held by the CSP;
i) data complete-
ness and porta-
bility;
ii) secure purge of
Bank’s informa-
tion from the
CSP’s environ-
ment;
iii) smooth transi-
tion of services;
and
iv) unambiguous
definition of lia-
bilities, dam-
ages, penalties
and indemni-
ties.
b) monitoring the on-
going design of ap-
plications and ser-
vice delivery tech-
nology stack that
the exit plans
should align with.
c) contractually
agreed exit / termi-
nation plans
should specify how
 the cloud- hosted
service(s) and
data will be moved
out from the cloud
with minimal im-
pact on continuity
of the Bank’s busi-
ness, while main-
taining integrity
and security.
d) All records of
transactions, cus-
tomer and opera-
tional information,
configuration data
should be promptly
taken over in a
systematic manner
from the CSP and
purged at the
CSP-end and inde-
pendent assurance
sought before
signing off from the
CSP.
9 Audit and Assurance:
Whether the Bank has done
audit/ periodic review/ third-
party certifications, as per
applicability and cloud usage,
inter alia, aspects such as
roles and responsibilities of
both Bank and CSP in cloud
 governance, access and
network controls,
configurations, monitoring
mechanism, data encryption,
log review, change
management, incident
response, and resilience
preparedness and testing,
etc.

ANNEXURE – II
Outsourcing of Security Operations Centre
S. Check Points Reference Yes / Partial Observation Risk Impact Recommendation
No. / No / Not
Applicable

1 Whether Bank has

unambiguously identify the
owner of assets used in
providing the services (systems,
software, source code,
processes, concepts, etc.);
2 Whether Bank has adequate
 oversight and ownership over
the rule definition, customisation
and related data/ logs, meta-
data and analytics.
3 Whether Bank has assessed
SOC functioning, including all
physical facilities involved in
service delivery, such as the
SOC and areas where client
data is stored / processed
periodically;

4 Whether Bank has integrated

the outsourced SOC reporting
and escalation process with the
RE’s incident response
process; and
5 Whether Bank has reviewed
the process of handling of the
alerts / events.