Information Technology Policy

Policy ID: PCI/POL/04/2026-27 • Version 1.0 Owner: Head of IT / Information Security • Approver: Board of Directors Sources: TECH, OUT • Review: Annual / regulatory change

Purpose and application

All systems and vendors; apply the correct chapter of the 2026 technology Directions by layer and asset size.

1. Ownership and access:- Maintain a system, device, data and vendor inventory with accountable owners. Use individual IDs, least privilege, multi-factor authentication for privileged/remote access and prompt disabling after exit. Review access quarterly as a Company control.

2. Operations and change:- Separate production from test environments. Require approved change tickets, testing, rollback plans and maker-checker controls for loan master data, pricing, bank details and accounting entries. Patch based on risk and retain tamper-resistant logs.

3. Security and outsourcing:- Encrypt sensitive information; restrict exports and removable media. Assess vendors before appointment and include confidentiality, audit/RBI access, incident notification, subcontracting, continuity and exit clauses. Company accountability remains with management.

4. Incident and recovery:- Staff shall immediately report suspected compromise to IT. Contain the event, preserve evidence and assess customer impact. Compliance shall make RBI/CERT-In or other notifications within applicable deadlines. Test restoration against approved RTO/RPO.

5. Assurance:- Board-approved IT, security and continuity documents shall be maintained. Independent IS audit, vulnerability testing and committee structures shall meet the applicable 2026 chapter. Track overdue remediation and report material incidents to the Board. Source codes are linked to the Reference Register. Read with the common implementation controls and relevant annexes. Applicable law and RBI Directions prevail.