Rbi: RBI proposes new norms on digital payment security controls – Times of India

The Reserve Bank of India (RBI) has proposed to establish robust governance mechanisms for authorised non-bank payment system operators (PSOs) to effectively address emerging cybersecurity risks. The central bank has issued a ‘Draft Master Directions on Cyber Resilience and Digital Payment Security Controls for Payment System Operators’. These guidelines cover governance mechanisms for the identification, assessment, monitoring and management of cybersecurity risks, including information security risks and vulnerabilities. They also specify baseline security measures to ensure safe and secure digital payment transactions. The RBI has invited stakeholders to provide comments and feedback on the draft by June 30.
The central bank made it clear that there is no change in the existing instructions concerning security and risk mitigation for card payments, prepaid payment instruments (PPIs) and mobile banking. The same will continue to remain in effect.
What the new guidelines say
“To effectively identify, monitor, control and manage cyber and technology related risks arising out of linkages of PSOs with unregulated entities, who are part of their digital payments ecosystem, PSOs shall ensure adherence to these Directions by such unregulated entities as well, subject to a mutual agreement,” the draft directions said.
“The Board of Directors (Board) of the PSO shall be responsible for ensuring adequate oversight over information security risks, including cyber risk and cyber resilience,” the draft said.

The draft requires PSOs to develop an approved Cyber Crisis Management Plan (CCMP) to detect, contain, respond to, and recover from cyber threats and attacks. It also mandates PSOs to maintain records of key roles, information assets, critical functions, processes, third-party service providers, and their interconnections, and document their levels of usage, criticality and business value. Relevant guidelines from CERT-In or National Critical Information Infrastructure Protection Centre (NCIIPC) or IDRBT and other agencies may be referred for guidance, it further said.
The draft also covers network security, application security life cycle (ASLC), security testing, vendor risk management, business continuity plans and other key issues.