Cyb-D Solutions Pvt. Ltd. is a Chennai based Cyber security firm. This firm was hired by AB Bank after regulators flagged compliance gaps. During the audit, the bank faced insider fraud, were manipulation of online banki

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · PYQS · June 2026
Cyb-D Solutions Pvt. Ltd. is a Chennai based Cyber security firm. This firm was hired by AB Bank after regulators flagged compliance gaps. During the audit, the bank faced insider fraud, were manipulation of online banking records was detected. Cyb-D collected logs and e-mails, but in court, the defence challenged the forensic preservation methods. Regulator also objected to AB bank's merged IT and cyber security policy. According to this policy, RBI mandates a separate cyber security framework. Cyb-D drafted a new cyber security policy covering incident response. VAPT, encryption and data protection, while keeping IT operations distinct. Later, AB Bank's lawyers wanted to use legal analytics tool to predict the outcome of customer disputes. While these tools gave useful insights, concerns about privacy and admissibility in court were raised. Cyb-D solved this by anonymizing data, taking consent and following the IT and data protection bill. In another fraud case, Cyb-D did forensic imaging of employee laptops but the defence argued that missing hash values and time stamps weakened the chain of custody. Cyb-D responded by maintaining proper custody logs and using standard forensic methods. Finally, Cyb-D VAPT testing found serious weaknesses in the bank's mobile app. Manager delayed fixing them and hackers later exploited these flaws causing a customer data breach. The bank was sued for negligence. To prevent this in future, Cyb-D setup a risk escalation system, having strict timelines for fixing issues and a high-level committee. In the light of the above case scenario, answer the following questions: Regulator said that AB Bank should not mix its IT and cyber security policies. How should Cyb-D create a distinct cyber security policy from the broader IT policy?

Answer & Explanation:

Cyber Security Policy to be distinct from the broader IT policy / IS Security Policy of a bank In order to address the need for the entire bank to contribute to a cyber-safe environment, the Cyber Security Policy should be distinct and separate from the broader IT policy / IS Security policy so that it can highlight the risks from cyber threats and the measures to address / mitigate these risks. A separate cyber security policy ensures focused governance, clear accountability, continuous monitoring of cyber risks, incident response preparedness and regulatory compliance. It also helps Boards and senior management address evolving cyber threats distinctly from general IT operational risks. The size, systems, technological complexity, digital products, stakeholders and threat perception vary from bank to bank and hence it is important to identify the inherent risks and the controls in place to adopt appropriate cyber-security framework. While identifying and assessing the inherent risks, banks are required to reckon the technologies adopted, alignment with business and regulatory requirements, connections established, delivery channels, online / mobile products, technology services, organizational culture and internal & external threats. Depending on the level of inherent risks, the banks are required to identify their riskiness as low, moderate, high and very high or adopt any other similar categorization. Riskiness of the business component also may be factored into while assessing the inherent risks. While evaluating the controls, Board oversight, policies, processes, cyber risk management architecture including experienced and qualified resources, training and culture, threat intelligence gathering arrangements, monitoring and analyzing the threat intelligence received vis-à-vis the situation obtaining in banks, information sharing arrangements (among peer banks, with Institute for Development and Research in Banking Technology (IDRBT)/ Reserve Bank of India (RBI)/ Computer Emergency Response Team (CERT-In), preventive, detective and corrective cyber security controls, vendor management and incident management & response are to be outlined.

Topics: Cyber Security

Open in Interactive Practice Hub · Full Practice Hub · Chapter Weightage · More in this subject

Related Questions in this Topic