Policy ID: PCI/POL/08/2026-27 • Version 1.0 Owner: COO / Head of IT • Approver: Board of Directors Sources: TECH, ALM, OUT • Review: Annual / regulatory change
Purpose and application
Branches, critical systems, records, staff and service providers.
1. Business impact assessment:- Identify critical processes: disbursement, repayment posting, customer support, treasury, statutory reports and document custody. Map dependencies and establish Board-approved maximum downtime, RTO and RPO for each service.
2. Activation and command:- The COO shall act as incident commander with a named alternate. Activate continuity when normal operations cannot safely continue. Priorities staff safety, secure cash/ records and use approved alternate sites or remote arrangements.
3. Recovery controls:- Maintain tested backups separated from production, secure communications and manual workarounds with transaction numbering and dual approval. Reconcile manual records before re-entry; do not bypass KYC or payment authorization during an outage.
4. Communication and testing:- Notify customers of service disruption and safe repayment channels. Compliance shall assess regulator reporting. Test the plan and vendors at least annually as a Company baseline and more often where RBI requires; include cyber and liquidity scenarios.
5. Restoration and review:- Only the incident commander may declare normal operations after reconciliation and security checks. Record losses, root cause, recovery times and corrective actions. Report significant events to the Board and refresh contacts/plan after every test or event.
Source codes are linked to the Reference Register. Read with the common implementation controls and relevant annexes. Applicable law and RBI Directions prevail.