Table Of Content

(cid:2) Guideline(cid:2)on(cid:2)ICT(cid:2)Security(cid:2) For(cid:2)Scheduled(cid:2)Banks(cid:2)and(cid:2)Financial(cid:2)Institutions(cid:2) (cid:2) (cid:2) April,(cid:2)2010(cid:2) Version(cid:2)2.0(cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) Bangladesh(cid:2)Bank(cid:2) (cid:2) (cid:2) (cid:2) (cid:2) Technical(cid:2)Team(cid:2) (cid:2) (cid:2) Coordinator(cid:2) Salima(cid:2)Khatun(cid:2) Senior(cid:2)Systems(cid:2)Analyst(cid:2) IT(cid:2)Operation(cid:2)&(cid:2)Communication(cid:2)Department(cid:2) Bangladesh(cid:2)Bank(cid:2) (cid:2) (cid:2) (cid:2) Members(cid:2) Mohammed(cid:2)Ishaque(cid:2)Miah(cid:2) Systems(cid:2)Analyst(cid:2) IT(cid:2)Operation(cid:2)&(cid:2)Communication(cid:2)Department(cid:2) Bangladesh(cid:2)Bank(cid:2) (cid:2) (cid:2) (cid:2) Md.(cid:2)Raihan(cid:2)Uddin(cid:2) Joint(cid:2)Director(cid:2) Department(cid:2)of(cid:2)Banking(cid:2)Inspection(cid:3)1(cid:2) Bangladesh(cid:2)Bank(cid:2) (cid:2) Manoj(cid:2)Kumar(cid:2)Howlader(cid:2) Joint(cid:2)Director(cid:2) Foreign(cid:2)Exchange(cid:2)Inspection(cid:2)&(cid:2)Vigilance(cid:2)Department(cid:2) Bangladesh(cid:2)Bank(cid:2) (cid:2) Jayanta(cid:2)Kumar(cid:2)Bhowmick(cid:2) Programmer(cid:2) IT(cid:2)Operation(cid:2)&(cid:2)Communication(cid:2)Department(cid:2) Bangladesh(cid:2)Bank(cid:2) (cid:2) (cid:2) Md.(cid:2)Lutful(cid:2)Haidar(cid:2)Pasha(cid:2) Assistant(cid:2)Director(cid:2) Banking(cid:2)Regulations(cid:2)and(cid:2)Policy(cid:2)Department(cid:2) Bangladesh(cid:2)Bank(cid:2) (cid:2) Muhammed(cid:2)Anwarul(cid:2)Islam(cid:2) Senior(cid:2)Assistant(cid:2)Vice(cid:2)President(cid:2)&(cid:2)Head(cid:2)of(cid:2)IT(cid:2)Security(cid:2) Eastern(cid:2)Bank(cid:2)Limited(cid:2) (cid:2) Sk.(cid:2)Zaminur(cid:2)Rahman(cid:2) Senior(cid:2)Systems(cid:2)Analyst(cid:2) Information(cid:2)Technology(cid:2)System(cid:2)Department(cid:2) Janata(cid:2)Bank(cid:2)Limited(cid:2) (cid:2) ANM(cid:2)Kamrul(cid:2)Islam(cid:2) Relationship(cid:2)Manager(cid:2)(IT)(cid:2) Standard(cid:2)Chartered(cid:2)Bank(cid:2) (cid:2) M.(cid:2)Asheq(cid:2)Rahman(cid:2) Vice(cid:2)President(cid:2) Head(cid:2)of(cid:2)Regulatory(cid:2)&(cid:2)Internal(cid:2)Control(cid:2) BRAC(cid:2)Bank(cid:2)Limited(cid:2) (cid:2) Md.(cid:2)Mashuqur(cid:2)Rahman(cid:2) Senior(cid:2)Principal(cid:2)Officer(cid:2) IT(cid:2)Division(cid:2) AB(cid:2)Bank(cid:2)Limited(cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) Contents(cid:2) CHAPTER(cid:2)1(cid:2)......................................................................................................................................(cid:2)1(cid:2) 1.(cid:2) Introduction(cid:2)........................................................................................................................................(cid:2)1(cid:2) 1.1(cid:2) Scope(cid:2)....................................................................................................................................................(cid:2)1(cid:2) 1.2(cid:2) Objectives(cid:2).............................................................................................................................................(cid:2)2(cid:2) 1.3(cid:2) Categorization(cid:2)of(cid:2)banks/branches/units(cid:2)depending(cid:2)on(cid:2)ICT(cid:2)Operation(cid:2)................................................(cid:2)2(cid:2) CHAPTER(cid:2)2(cid:2)......................................................................................................................................(cid:2)4(cid:2) 2.(cid:2) ICT(cid:2)Security(cid:2)Management(cid:2)...................................................................................................................(cid:2)4(cid:2) 2.1(cid:2) ICT(cid:2)Security(cid:2)Policy(cid:2)................................................................................................................................(cid:2)4(cid:2) 2.2(cid:2) Documentation(cid:2).....................................................................................................................................(cid:2)5(cid:2) 2.3(cid:2) Internal(cid:2)Information(cid:2)System(cid:2)Audit(cid:2)......................................................................................................(cid:2)5(cid:2) 2.4(cid:2) Training(cid:2)and(cid:2)Awareness(cid:2).......................................................................................................................(cid:2)6(cid:2) 2.5(cid:2) Insurance(cid:2)or(cid:2)Risk(cid:2)Coverage(cid:2)Fund(cid:2).........................................................................................................(cid:2)6(cid:2) 2.6(cid:2) Problem(cid:2)Management..........................................................................................................................(cid:2)6(cid:2) 2.7(cid:2) Risk(cid:2)Management(cid:2).................................................................................................................................(cid:2)6(cid:2) CHAPTER(cid:2)3(cid:2)......................................................................................................................................(cid:2)8(cid:2) 3.(cid:2) ICT(cid:2)Operation(cid:2)Management(cid:2)................................................................................................................(cid:2)8(cid:2) 3.1(cid:2) Change(cid:2)Management(cid:2)...........................................................................................................................(cid:2)8(cid:2) 3.2(cid:2) Asset(cid:2)Management(cid:2)..............................................................................................................................(cid:2)8(cid:2) 3.3(cid:2) Operating(cid:2)Procedures(cid:2)..........................................................................................................................(cid:2)9(cid:2) 3.4(cid:2) Request(cid:2)Management(cid:2)..........................................................................................................................(cid:2)9(cid:2) CHAPTER(cid:2)4(cid:2)....................................................................................................................................(cid:2)10(cid:2) 4.(cid:2) Physical(cid:2)Security(cid:2)...............................................................................................................................(cid:2)10(cid:2) 4.1(cid:2) Physical(cid:2)Security(cid:2)for(cid:2)Tier(cid:3)1(cid:2).................................................................................................................(cid:2)10(cid:2) 4.1.1(cid:2) Data(cid:2)Center(cid:2)Access(cid:2)....................................................................................................................(cid:2)10(cid:2) 4.1.2(cid:2) Environmental(cid:2)Security(cid:2)..............................................................................................................(cid:2)11(cid:2) 4.1.3(cid:2) Fire(cid:2)Prevention(cid:2)..........................................................................................................................(cid:2)12(cid:2) 4.2(cid:2) Physical(cid:2)Security(cid:2)for(cid:2)Tier(cid:3)2(cid:2).................................................................................................................(cid:2)13(cid:2) 4.2.1(cid:2) Server(cid:2)Room(cid:2)Access(cid:2)...................................................................................................................(cid:2)13(cid:2) 4.2.2(cid:2) Environmental(cid:2)Security(cid:2)..............................................................................................................(cid:2)13(cid:2) 4.2.3(cid:2) Fire(cid:2)Protection(cid:2)...........................................................................................................................(cid:2)14(cid:2) 4.3(cid:2) Physical(cid:2)Security(cid:2)for(cid:2)Tier(cid:3)3(cid:2).................................................................................................................(cid:2)14(cid:2) 4.3.1(cid:2) Computer(cid:2)Room(cid:2)Access(cid:2).............................................................................................................(cid:2)14(cid:2) 4.3.2(cid:2) Environmental(cid:2)Security(cid:2)..............................................................................................................(cid:2)14(cid:2) 4.3.3(cid:2) Fire(cid:2)Protection(cid:2)...........................................................................................................................(cid:2)14(cid:2) 4.4(cid:2) Physical(cid:2)Security(cid:2)for(cid:2)Desktop(cid:2)and(cid:2)Laptop(cid:2)Computers(cid:2)........................................................................(cid:2)15(cid:2) CHAPTER(cid:2)5(cid:2)....................................................................................................................................(cid:2)17(cid:2) 5.(cid:2) Information(cid:2)Security(cid:2)Standard(cid:2)..........................................................................................................(cid:2)17(cid:2) 5.1(cid:2) Access(cid:2)Control(cid:2)for(cid:2)Information(cid:2)Systems(cid:2)............................................................................................(cid:2)17(cid:2) 5.1.1(cid:2) User(cid:2)ID(cid:2)Maintenance(cid:2).................................................................................................................(cid:2)17(cid:2) 5.1.2(cid:2) Password(cid:2)Control(cid:2).......................................................................................................................(cid:2)17(cid:2) 5.1.3(cid:2) Input(cid:2)Control(cid:2).............................................................................................................................(cid:2)18(cid:2) 5.2(cid:2) Network(cid:2)Security(cid:2)................................................................................................................................(cid:2)18(cid:2) 5.3(cid:2) Data(cid:2)Encryption(cid:2)..................................................................................................................................(cid:2)19(cid:2) 5.4(cid:2) Virus(cid:2)Protection(cid:2)..................................................................................................................................(cid:2)19(cid:2) 5.5(cid:2) Internet(cid:2)and(cid:2)e(cid:3)mail(cid:2).............................................................................................................................(cid:2)19(cid:2) 5.6(cid:2) Transactions(cid:2)through(cid:2)Alternative(cid:2)Channels(cid:2).......................................................................................(cid:2)20(cid:2) 5.6.1(cid:2) Services(cid:2)through(cid:2)Mobile(cid:2)............................................................................................................(cid:2)20(cid:2) 5.6.2(cid:2) Internet(cid:2)Banking(cid:2)........................................................................................................................(cid:2)21(cid:2) 5.6.3(cid:2) Payment(cid:2)Cards(cid:2)...........................................................................................................................(cid:2)22(cid:2) CHAPTER(cid:2)6(cid:2)....................................................................................................................................(cid:2)24(cid:2) 6.(cid:2) Software(cid:2)Development(cid:2)and(cid:2)Acquisition(cid:2).............................................................................................(cid:2)24(cid:2) 6.1(cid:2) In(cid:3)house(cid:2)Software(cid:2)..............................................................................................................................(cid:2)24(cid:2) 6.2(cid:2) Outsourced(cid:2)Software(cid:2).........................................................................................................................(cid:2)25(cid:2) 6.2.1(cid:2) Vendor(cid:2)Selection(cid:2).......................................................................................................................(cid:2)25(cid:2) 6.2.2(cid:2) Software(cid:2)Documentation(cid:2)...........................................................................................................(cid:2)25(cid:2) 6.2.3(cid:2) Other(cid:2)Requirements(cid:2)..................................................................................................................(cid:2)26(cid:2) CHAPTER(cid:2)7(cid:2)....................................................................................................................................(cid:2)27(cid:2) 7.(cid:2) Business(cid:2)Continuity(cid:2)and(cid:2)Disaster(cid:2)Recovery(cid:2)Plan(cid:2)................................................................................(cid:2)27(cid:2) 7.1(cid:2) Business(cid:2)Continuity(cid:2)Plan(cid:2)(BCP)(cid:2)...........................................................................................................(cid:2)27(cid:2) 7.2(cid:2) Disaster(cid:2)Recovery(cid:2)Plan(cid:2)(DRP)(cid:2).............................................................................................................(cid:2)28(cid:2) 7.3(cid:2) Backup(cid:2)and(cid:2)Restore(cid:2)Plan(cid:2)(BRP)(cid:2)..........................................................................................................(cid:2)28(cid:2) CHAPTER(cid:2)8(cid:2)....................................................................................................................................(cid:2)30(cid:2) 8.(cid:2) Service(cid:2)Provider(cid:2)Management...........................................................................................................(cid:2)30(cid:2) 8.1(cid:2) Service(cid:2)Level(cid:2)Agreement(cid:2)(SLA)(cid:2)...........................................................................................................(cid:2)30(cid:2) 8.2(cid:2) Outsourcing(cid:2)........................................................................................................................................(cid:2)31(cid:2) 8.3(cid:2) Cross(cid:3)border(cid:2)System(cid:2)Support(cid:2).............................................................................................................(cid:2)31(cid:2) GLOSSARY(cid:2)AND(cid:2)ACRONYMS(cid:2).....................................................................................................(cid:2)32(cid:2) ANNEXURE(cid:2)1(cid:2).................................................................................................................................(cid:2)35(cid:2) ANNEXURE(cid:2)2(cid:2).................................................................................................................................(cid:2)36(cid:2) ANNEXURE(cid:2)3(cid:2).................................................................................................................................(cid:2)37(cid:2) ANNEXURE(cid:2)4(cid:2).................................................................................................................................(cid:2)38(cid:2) Chapter(cid:2)1(cid:2) (cid:2) 1. Introduction(cid:2) The(cid:2)banking(cid:2)industry(cid:2)has(cid:2)changed(cid:2)the(cid:2)way(cid:2)they(cid:2)provide(cid:2)services(cid:2)to(cid:2) their(cid:2)customers(cid:2)and(cid:2)process(cid:2)information(cid:2)in(cid:2)recent(cid:2)years.(cid:2)Information(cid:2) and(cid:2) Communication(cid:2) Technology(cid:2) (ICT)(cid:2) has(cid:2) brought(cid:2) about(cid:2) this(cid:2) momentous(cid:2) transformation.(cid:2) Security(cid:2) of(cid:2) Information(cid:2) for(cid:2) a(cid:2) financial(cid:2) institution(cid:2)has(cid:2)therefore(cid:2)gained(cid:2)much(cid:2)importance,(cid:2)and(cid:2)it(cid:2)is(cid:2)vital(cid:2)for(cid:2)us(cid:2) to(cid:2) ensure(cid:2) that(cid:2) the(cid:2) risks(cid:2) are(cid:2) properly(cid:2) identified(cid:2) and(cid:2) managed.(cid:2) Moreover,(cid:2) information(cid:2) and(cid:2) information(cid:2) technology(cid:2) systems(cid:2) are(cid:2) essential(cid:2)assets(cid:2)for(cid:2)the(cid:2)banks(cid:2)as(cid:2)well(cid:2)as(cid:2)for(cid:2)their(cid:2)customers(cid:2)and(cid:2)stake(cid:3) holders.(cid:2)Information(cid:2)assets(cid:2)are(cid:2)critical(cid:2)to(cid:2)the(cid:2)services(cid:2)provided(cid:2)by(cid:2)the(cid:2) banks(cid:2)to(cid:2)their(cid:2)customers.(cid:2)Protection(cid:2)and(cid:2)maintenance(cid:2)of(cid:2)these(cid:2)assets(cid:2) are(cid:2)critical(cid:2)to(cid:2)the(cid:2)organizations’(cid:2)sustainability.(cid:2)Banks(cid:2)must(cid:2)take(cid:2)the(cid:2) responsibility(cid:2)of(cid:2)protecting(cid:2)the(cid:2)information(cid:2)from(cid:2)unauthorized(cid:2)access,(cid:2) modification,(cid:2)disclosure(cid:2)and(cid:2)destruction.(cid:2) (cid:2) Bangladesh(cid:2)Bank(cid:2)has(cid:2)prepared(cid:2)a(cid:2)Guideline(cid:2)for(cid:2)ICT(cid:2)Security(cid:2)for(cid:2)banks(cid:2)&(cid:2) FIs(cid:2)to(cid:2)be(cid:2)used(cid:2)as(cid:2)a(cid:2)minimum(cid:2)requirement(cid:2)and(cid:2)as(cid:2)appropriate(cid:2)to(cid:2)the(cid:2) level(cid:2)of(cid:2)computerization(cid:2)of(cid:2)their(cid:2)operations.(cid:2) (cid:2) (cid:2) 1.1 Scope(cid:2) (cid:2) This(cid:2)ICT(cid:2)Security(cid:2)Guideline(cid:2)is(cid:2)a(cid:2)systematic(cid:2)approach(cid:2)to(cid:2)policies(cid:2)required(cid:2) to(cid:2)be(cid:2)formulated(cid:2)for(cid:2)ensuring(cid:2)security(cid:2)of(cid:2)information(cid:2)and(cid:2)information(cid:2) systems.(cid:2) (cid:2) This(cid:2)Guideline(cid:2)covers(cid:2)all(cid:2)information(cid:2)that(cid:2)are(cid:2)electronically(cid:2)generated,(cid:2) received,(cid:2)stored,(cid:2)printed,(cid:2)scanned,(cid:2)and(cid:2)typed.(cid:2)The(cid:2)provisions(cid:2)of(cid:2)this(cid:2) Guideline(cid:2)are(cid:2)applicable(cid:2)for:(cid:2) (cid:2) (cid:2) Scheduled(cid:2)banks(cid:2)&(cid:2)FIs(cid:2)for(cid:2)all(cid:2)of(cid:2)their(cid:2)Information(cid:2)Systems.(cid:2) (cid:2) (cid:2) All(cid:2)activities(cid:2)and(cid:2)operations(cid:2)required(cid:2)to(cid:2)ensure(cid:2)data(cid:2)security(cid:2) including(cid:2) facility(cid:2) design,(cid:2) physical(cid:2) security,(cid:2) network(cid:2) security,(cid:2) disaster(cid:2) recovery(cid:2) and(cid:2) business(cid:2) continuity(cid:2) planning,(cid:2) use(cid:2) of(cid:2) hardware(cid:2) and(cid:2) software,(cid:2) data(cid:2) disposal,(cid:2) and(cid:2) protection(cid:2) of(cid:2) copyrights(cid:2)and(cid:2)other(cid:2)intellectual(cid:2)property(cid:2)rights.(cid:2) (cid:2) (cid:2) 1 | Page 1.2 Objectives(cid:2) (cid:2) This(cid:2)Guideline(cid:2)defines(cid:2)the(cid:2)minimum(cid:2)requirements(cid:2)to(cid:2)which(cid:2)each(cid:2)bank(cid:2) must(cid:2)adhere.(cid:2)The(cid:2)primary(cid:2)objectives(cid:2)of(cid:2)the(cid:2)Guideline(cid:2)are:(cid:2) (cid:2) (cid:2) To(cid:2) establish(cid:2) a(cid:2) standard(cid:2) ICT(cid:2) Security(cid:2) Policy(cid:2) &(cid:2) ICT(cid:2) Security(cid:2) Management(cid:2) (cid:2) (cid:2) To(cid:2)help(cid:2)the(cid:2)banks(cid:2)and(cid:2)FIs(cid:2)for(cid:2)secured(cid:2)and(cid:2)stable(cid:2)setup(cid:2)of(cid:2)its(cid:2)ICT(cid:2) platform(cid:2) (cid:2) (cid:2) To(cid:2)establish(cid:2)a(cid:2)secured(cid:2)environment(cid:2)for(cid:2)the(cid:2)processing(cid:2)of(cid:2)data(cid:2) (cid:2) (cid:2) To(cid:2)identify(cid:2)information(cid:2)security(cid:2)risks(cid:2)and(cid:2)their(cid:2)management(cid:2) (cid:2) (cid:2) To(cid:2) communicate(cid:2) the(cid:2) responsibilities(cid:2) for(cid:2) the(cid:2) protection(cid:2) of(cid:2) information(cid:2)(cid:2) (cid:2) (cid:2) To(cid:2)prioritize(cid:2)information(cid:2)and(cid:2)information(cid:2)systems(cid:2)those(cid:2)need(cid:2)to(cid:2) be(cid:2)protected(cid:2) (cid:2) (cid:2) To(cid:2)aware(cid:2)and(cid:2)train(cid:2)the(cid:2)users(cid:2)associated(cid:2)with(cid:2)managing(cid:2)the(cid:2)ICT(cid:2) infrastructure(cid:2) (cid:2) (cid:2) To(cid:2) explain(cid:2) procedure(cid:2) for(cid:2) periodic(cid:2) review(cid:2) of(cid:2) the(cid:2) policy(cid:2) and(cid:2) security(cid:2)measures(cid:2) (cid:2) (cid:2) To(cid:2)ensure(cid:2)the(cid:2)best(cid:2)practices(cid:2)(industry(cid:2)standard)(cid:2)of(cid:2)the(cid:2)usage(cid:2)of(cid:2) ICT(cid:2)that(cid:2)is(cid:2)not(cid:2)limited(cid:2)to(cid:2)this(cid:2)guideline.(cid:2) (cid:2) 1.3 Categorization(cid:2)of(cid:2)banks/branches/units(cid:2)depending(cid:2)on(cid:2)ICT(cid:2) Operation(cid:2) (cid:2) The(cid:2)locations(cid:2)for(cid:2)which(cid:2)the(cid:2)ICT(cid:2)Security(cid:2)Guideline(cid:2)is(cid:2)applicable(cid:2)i.e.,(cid:2)the(cid:2) Head(cid:2)Office,(cid:2)Zonal(cid:2)Office,(cid:2)Branch(cid:2)and/or(cid:2)Booth/Unit(cid:2)of(cid:2)a(cid:2)bank(cid:2)or(cid:2)FI(cid:2) may(cid:2)be(cid:2)categorized(cid:2)into(cid:2)three(cid:2)tiers(cid:2)depending(cid:2)on(cid:2)their(cid:2)ICT(cid:2)setup(cid:2)and(cid:2) operational(cid:2)environment/procedures(cid:2)as:(cid:2) (cid:2) Tier(cid:3)1:(cid:2) Centralized(cid:2) ICT(cid:2) Operation(cid:2) through(cid:2) Data(cid:2) Center(cid:2) (DC)(cid:2) including(cid:2)Disaster(cid:2)Recovery(cid:2)Site(cid:2)(DRS)(cid:2)to(cid:2)which(cid:2)all(cid:2)other(cid:2) offices,(cid:2)branches(cid:2)and(cid:2)booths(cid:2)are(cid:2)connected(cid:2)through(cid:2)WAN(cid:2) with(cid:2)24x7(cid:2)hours(cid:2)attended(cid:2)operation.(cid:2) (cid:2) 2 | Page Tier(cid:3)2:(cid:2) Head(cid:2)Office,(cid:2)Zonal(cid:2)Office,(cid:2)Branch(cid:2)or(cid:2)booth(cid:2)having(cid:2)Server(cid:2) to(cid:2)which(cid:2)all(cid:2)or(cid:2)a(cid:2)part(cid:2)of(cid:2)the(cid:2)computers(cid:2)of(cid:2)that(cid:2)locations(cid:2) are(cid:2)connected(cid:2)through(cid:2)LAN.(cid:2) (cid:2) Tier(cid:3)3:(cid:2) Head(cid:2) Office,(cid:2) Zonal(cid:2) Office,(cid:2) Branch(cid:2) or(cid:2) booth(cid:2) having(cid:2) standalone(cid:2)computer(s).(cid:2) (cid:2) The(cid:2)proposed(cid:2)ICT(cid:2)Security(cid:2)Guideline(cid:2)will(cid:2)be(cid:2)applicable(cid:2)for(cid:2)all(cid:2)the(cid:2)three(cid:2) tiers(cid:2)if(cid:2)not(cid:2)mentioned(cid:2)otherwise.(cid:2) (cid:2) 3 | Page Chapter(cid:2)2(cid:2) (cid:2) 2. ICT(cid:2)Security(cid:2)Management(cid:2) (cid:2) ICT(cid:2) Security(cid:2) Management(cid:2) must(cid:2) ensure(cid:2) that(cid:2) the(cid:2) ICT(cid:2) functions(cid:2) and(cid:2) operations(cid:2) are(cid:2) efficiently(cid:2) and(cid:2) effectively(cid:2) managed.(cid:2) They(cid:2) should(cid:2) be(cid:2) aware(cid:2)of(cid:2)the(cid:2)capabilities(cid:2)of(cid:2)ICT(cid:2)and(cid:2)be(cid:2)able(cid:2)to(cid:2)appreciate(cid:2)and(cid:2)recognize(cid:2) opportunities(cid:2) and(cid:2) risks(cid:2) of(cid:2) possible(cid:2) abuses.(cid:2) They(cid:2) have(cid:2) to(cid:2) ensure(cid:2) maintenance(cid:2)of(cid:2)appropriate(cid:2)systems(cid:2)documentations,(cid:2)particularly(cid:2)for(cid:2) systems,(cid:2)which(cid:2)support(cid:2)financial(cid:2)reporting.(cid:2)They(cid:2)have(cid:2)to(cid:2)participate(cid:2)in(cid:2) ICT(cid:2)security(cid:2)planning(cid:2)to(cid:2)ensure(cid:2)that(cid:2)resources(cid:2)are(cid:2)allocated(cid:2)consistent(cid:2) with(cid:2) business(cid:2) objectives.(cid:2) They(cid:2) have(cid:2) to(cid:2) ensure(cid:2) that(cid:2) sufficient(cid:2) and(cid:2) qualified(cid:2)technical(cid:2)staffs(cid:2)are(cid:2)employed(cid:2)so(cid:2)that(cid:2)continuance(cid:2)of(cid:2)the(cid:2)ICT(cid:2) operation(cid:2)area(cid:2)is(cid:2)unlikely(cid:2)to(cid:2)be(cid:2)seriously(cid:2)at(cid:2)risk(cid:2)all(cid:2)times.(cid:2)(cid:2) (cid:2) ICT(cid:2) Security(cid:2) Management(cid:2) deals(cid:2) with(cid:2) ICT(cid:2) Security(cid:2) Policy(cid:2) Documentation,(cid:2) Internal(cid:2) Information(cid:2) System(cid:2) Audit,(cid:2) Training(cid:2) and(cid:2) Insurance.(cid:2) ICT(cid:2) security(cid:2) planner(cid:2) and/or(cid:2) steering(cid:2) committee(cid:2) shall(cid:2) be(cid:2) responsible(cid:2)for(cid:2)overall(cid:2)ICT(cid:2)security(cid:2)management.(cid:2) (cid:2) (cid:2) 2.1 ICT(cid:2)Security(cid:2)Policy(cid:2) 2.1.1(cid:2) Every(cid:2) bank(cid:2) having(cid:2) Information(cid:2) systems(cid:2) must(cid:2) have(cid:2) an(cid:2) ‘ICT(cid:2) Security(cid:2) Policy’(cid:2)which(cid:2)must(cid:2)be(cid:2)fully(cid:2)complied(cid:2)with(cid:2)this(cid:2)ICT(cid:2)Security(cid:2)Guideline(cid:2) and(cid:2)be(cid:2)approved(cid:2)by(cid:2)the(cid:2)board(cid:2)of(cid:2)the(cid:2)bank.(cid:2)For(cid:2)foreign(cid:2)banks,(cid:2)the(cid:2) documents(cid:2) must(cid:2) also(cid:2) be(cid:2) in(cid:2) conformity(cid:2) with(cid:2) their(cid:2) global(cid:2) policy(cid:2) documents.(cid:2)(cid:2) (cid:2) This(cid:2)document(cid:2)provides(cid:2)the(cid:2)guideline(cid:2)for(cid:2)Information(cid:2)System(cid:2)and(cid:2)its(cid:2) secured(cid:2)usage(cid:2)for(cid:2)the(cid:2)banks.(cid:2)It(cid:2)establishes(cid:2)general(cid:2)requirements(cid:2)and(cid:2) responsibilities(cid:2)for(cid:2)protecting(cid:2)Information(cid:2)and(cid:2)Information(cid:2)System.(cid:2)The(cid:2) policy(cid:2)covers(cid:2)common(cid:2)technologies(cid:2)such(cid:2)as(cid:2)computers(cid:2)&(cid:2)peripherals,(cid:2) data(cid:2)and(cid:2)network,(cid:2)web(cid:2)system,(cid:2)and(cid:2)other(cid:2)specialized(cid:2)ICT(cid:2)resources.(cid:2) The(cid:2)bank’s(cid:2)delivery(cid:2)of(cid:2)services(cid:2)depends(cid:2)on(cid:2)availability,(cid:2)reliability(cid:2)and(cid:2) integrity(cid:2)of(cid:2)its(cid:2)information(cid:2)technology(cid:2)system.(cid:2)Therefore,(cid:2)each(cid:2)bank(cid:2) must(cid:2)adopt(cid:2)appropriate(cid:2)methods(cid:2)to(cid:2)protect(cid:2)its(cid:2)information(cid:2)system.(cid:2)The(cid:2) senior(cid:2)management(cid:2)of(cid:2)the(cid:2)bank(cid:2)must(cid:2)express(cid:2)a(cid:2)commitment(cid:2)to(cid:2)ICT(cid:2) security(cid:2)by(cid:2)continuously(cid:2)increasing(cid:2)awareness(cid:2)and(cid:2)ensuring(cid:2)training(cid:2)of(cid:2) the(cid:2)bank's(cid:2)staff.(cid:2)(cid:2) (cid:2) The(cid:2) policy(cid:2) will(cid:2) require(cid:2) regular(cid:2) update(cid:2) to(cid:2) cope(cid:2) with(cid:2) the(cid:2) evolving(cid:2) changes(cid:2) in(cid:2) the(cid:2) ICT(cid:2) environment(cid:2) both(cid:2) within(cid:2) the(cid:2) bank(cid:2) and(cid:2) overall(cid:2) industry.(cid:2) 4 | Page (cid:2) 2.1.2(cid:2)(cid:2)(cid:2)(cid:2) For(cid:2) noncompliance(cid:2) issues,(cid:2) compliance(cid:2) plan(cid:2) shall(cid:2) be(cid:2) submitted(cid:2) to(cid:2) Bangladesh(cid:2)Bank(cid:2)for(cid:2)dispensation(cid:2)as(cid:2)per(cid:2)format(cid:2)given(cid:2)in(cid:2)Annexure(cid:2)1.(cid:2) (cid:2) (cid:2) 2.2 Documentation(cid:2) (cid:2) 2.2.1(cid:2)(cid:2) (cid:2) The(cid:2)following(cid:2)shall(cid:2)be(cid:2)documented:(cid:2) (cid:2) a) Organogram(cid:2)chart(cid:2)for(cid:2)ICT(cid:2)department/division(cid:2)(centralized/(cid:2) decentralized)(cid:2) (cid:2) b) Branch(cid:2)organogram(cid:2)with(cid:2)the(cid:2)ICT(cid:2)support(cid:2)unit/section/personnel(cid:2) (Business/ICT)(cid:2) (cid:2) c) Job(cid:2)description(cid:2)(JD)(cid:2)for(cid:2)each(cid:2)individual(cid:2)within(cid:2)ICT(cid:2)department/(cid:2) division(cid:2) (cid:2) d) A(cid:2)scheduled(cid:2)roster(cid:2)for(cid:2)personnel(cid:2)doing(cid:2)shifting(cid:2)duties(cid:2) (cid:2) e) Segregation(cid:2)of(cid:2)duties(cid:2)for(cid:2)IT(cid:2)tasks(cid:2) (cid:2) f) Fallback(cid:2)plans(cid:2)for(cid:2)various(cid:2)levels(cid:2)of(cid:2)system(cid:2)support(cid:2)personnel(cid:2) (cid:2) (cid:2) (cid:2) (cid:2) 2.3 Internal(cid:2)Information(cid:2)System(cid:2)Audit(cid:2) 2.3.1 Internal(cid:2)Information(cid:2)System(cid:2)Audit(cid:2)shall(cid:2)be(cid:2)carried(cid:2)out(cid:2)by(cid:2)Internal(cid:2)Audit(cid:2) or(cid:2)relevant(cid:2)Department(cid:2)(other(cid:2)than(cid:2)ICT(cid:2)Department).(cid:2) (cid:2) 2.3.2 Internal(cid:2) Audit(cid:2) Team(cid:2) should(cid:2) have(cid:2) sufficient(cid:2) ICT(cid:2) expertise/resources(cid:2) capable(cid:2)of(cid:2)conducting(cid:2)Information(cid:2)System(cid:2)Audit.(cid:2) (cid:2) 2.3.3 Internal(cid:2)Information(cid:2)System(cid:2)audit(cid:2)shall(cid:2)be(cid:2)done(cid:2)periodically(cid:2)at(cid:2)least(cid:2) once(cid:2) a(cid:2) year.(cid:2) The(cid:2) report(cid:2) must(cid:2) be(cid:2) preserved(cid:2) for(cid:2) Bangladesh(cid:2) Bank(cid:2) officials(cid:2)as(cid:2)and(cid:2)when(cid:2)required.(cid:2)An(cid:2)annual(cid:2)system(cid:2)audit(cid:2)plan(cid:2)shall(cid:2)be(cid:2) developed.(cid:2) Banks(cid:2) shall(cid:2) also(cid:2) ensure(cid:2) that(cid:2) audit(cid:2) issues(cid:2) are(cid:2) properly(cid:2) tracked(cid:2)and,(cid:2)in(cid:2)particular,(cid:2)completely(cid:2)recorded,(cid:2)adequately(cid:2)followed(cid:2) up(cid:2)and(cid:2)satisfactorily(cid:2)rectified.(cid:2) (cid:2)(cid:2) 2.3.4 The(cid:2) bank/branch(cid:2) shall(cid:2) take(cid:2) appropriate(cid:2) measures(cid:2) to(cid:2) address(cid:2) the(cid:2) recommendations(cid:2) made(cid:2) in(cid:2) the(cid:2) last(cid:2) Audit(cid:2) Report.(cid:2) This(cid:2) must(cid:2) be(cid:2) documented(cid:2)and(cid:2)kept(cid:2)along(cid:2)with(cid:2)the(cid:2)Audit(cid:2)Report(cid:2)mentioned(cid:2)in(cid:2)2.3.3.(cid:2) 5 | Page

Description:

ANM Kamrul Islam. Relationship Manager (IT). Standard Chartered Bank. M. Asheq Rahman. Vice President. Head of Regulatory & Internal Control. BRAC Bank Limited. Md. Mashuqur Rahman. Senior Principal .. Information Security Standard Business Continuity and Disaster Recovery Plan .

Guideline on ICT Security For Scheduled Banks and Financial Institutions PDF

43 Pages·2010·0.15 MB·English

Checking for file health...

Save to my drive

Quick download

Download

Download Guideline on ICT Security For Scheduled Banks and Financial Institutions PDF Free - Full Version

by Unknow| 2010| 43 pages| 0.15| English

Download Guideline on ICT Security For Scheduled Banks and Financial Institutions by in PDF format completely FREE. No registration required, no payment needed. Get instant access to this valuable resource on PDFdrive.to!

Free Download PDF

About Guideline on ICT Security For Scheduled Banks and Financial Institutions

Detailed Information

Author:	Unknown
Publication Year:	2010
Pages:	43
Language:	English
File Size:	0.15
Format:	PDF
Price:	FREE

Download Free PDF

Safe & Secure Download - No registration required

Why Choose PDFdrive for Your Free Guideline on ICT Security For Scheduled Banks and Financial Institutions Download?

100% Free: No hidden fees or subscriptions required for one book every day.
No Registration: Immediate access is available without creating accounts for one book every day.
Safe and Secure: Clean downloads without malware or viruses
Multiple Formats: PDF, MOBI, Mpub,... optimized for all devices
Educational Resource: Supporting knowledge sharing and learning

Frequently Asked Questions

Is it really free to download Guideline on ICT Security For Scheduled Banks and Financial Institutions PDF?

Yes, on https://PDFdrive.to you can download Guideline on ICT Security For Scheduled Banks and Financial Institutions by completely free. We don't require any payment, subscription, or registration to access this PDF file. For 3 books every day.

How can I read Guideline on ICT Security For Scheduled Banks and Financial Institutions on my mobile device?

After downloading Guideline on ICT Security For Scheduled Banks and Financial Institutions PDF, you can open it with any PDF reader app on your phone or tablet. We recommend using Adobe Acrobat Reader, Apple Books, or Google Play Books for the best reading experience.

Is this the full version of Guideline on ICT Security For Scheduled Banks and Financial Institutions?

Yes, this is the complete PDF version of Guideline on ICT Security For Scheduled Banks and Financial Institutions by Unknow. You will be able to read the entire content as in the printed version without missing any pages.

Is it legal to download Guideline on ICT Security For Scheduled Banks and Financial Institutions PDF for free?

https://PDFdrive.to provides links to free educational resources available online. We do not store any files on our servers. Please be aware of copyright laws in your country before downloading.

The materials shared are intended for research, educational, and personal use in accordance with fair use principles.