Chief Information Security Assurance Officer

Chief Information Security Assurance Officer

Function - Risk

Reporting To - Chief Risk Officer (CRO)

1. Role Purpose

To establish and strengthen the Information Security, Cyber Security and Technology Risk framework within the CRO function, ensuring that information-security risks are independently identified, assessed, monitored and reported.

The role will provide independent risk oversight over technology, information security, cyber security, data protection, third-party technology risks and business continuity, while working closely with IT, Information Security, Compliance, Internal Audit and Business functions.

2. Key Responsibilities

Roles and responsibilities of the CISO :

(1) The CISO shall be responsible for driving cybersecurity strategy and ensuring compliance to the extant regulatory / statutory instructions on information security / cybersecurity.

(2) The CISO shall be responsible for enforcing the policies that an NBFC uses to protect its information assets apart from coordinating information security / cybersecurity related issues within the NBFC as well as with relevant external agencies.

(3) The CISO shall be a permanent invitee to the ITSC and IT Steering Committee.

(4) The CISOs office shall manage and monitor Security Operations Centre (SOC) and drive cybersecurity related projects.

(5) The CISOs office shall ensure effective functioning of the security solutions deployed.

(6) The CISO shall directly report to the Executive Director or equivalent executive overseeing the risk management function.

(7) The CISO shall place a review of cybersecurity risks / arrangements / preparedness of the NBFC before the Board / Risk Management Committee of the Board (RMCB) / ITSC at least on a quarterly basis.