Meeting Bank Negara Malaysia's RMiT Rules Without Disrupting Operations

In mid-2020, a few months into the pandemic, IBM ran a webinar to help Malaysian banks and other financial service institutions (FSIs) interpret Bank Negara Malaysia's Risk Management in Technology (RMiT) policy and pick tools that satisfy it. RMiT requires them to show that their risk practices and controls match the technology risk they carry, meaning any failure or breach of IT systems, applications, platforms or infrastructure.

Andrew Martin, group publisher at AOPG, moderated a panel of four IBM speakers. The audience included C-level executives, department heads and IT managers from banks, insurers and other firms in the sector.

Getting the frameworks right

Patrick KL Wang, a governance, risk and compliance (GRC) solution expert, said the timing of RMiT was close to ideal. It gave FSIs a chance to get organised before COVID-19 arrived.

Once the pandemic hit, he noted, financial institutions had to digitise their services at once. They already faced a long list of regulatory hurdles, and RMiT helped by handing them one shared target, so specific requirements spread across many different regulations could be tackled together.

Because each regulation still comes with its own framework, Patrick argued, FSIs need automated tools that show all their risks in one place and can run analytics on top.

"Today, we are seeing more FSIs leveraging on AI such as to read regulations and suggest obligations and automatically map controls within a financial institution. If your organisation has not modernised and is still relying on Excel spreadsheets, it would not be a sustainable operation. In order to survive in this situation, you have to reinvent and accelerate some of your technology acquisition programs and business processes to automate and ensure compliance across the board," Patrick said during the session.

Technology operations management

Turning to operations, Eddy YC Liew, country technical leader for cloud and cognitive solutions at IBM Malaysia, explained that RMiT asks FSIs to examine a wide range of technology capabilities and platforms.

"Having a strong application deployment to ensure customer experience is not affected is important," Eddy said. "We have been helping banks have the right approach when it comes to online services. Be it data centre operations or cloud services; we have been helping banks look at areas where they have had increased transactions in the last couple of months."

Merchant transactions had climbed over those months, he said, and banks had been busy making sure every payment went through. In his view, that's where data resiliency counts, because a bank has to stay available when volumes spike.

According to Eddy, the challenges FSIs most want to work on are:

• Service level agreements (SLAs), such as RMiT's cap on unplanned downtime for critical customer-facing systems, which the June 2023 version of the policy sets at four hours over a rolling 12 months and 120 minutes per incident (paragraph 10.32);
• SDLC governance (the software development life cycle), meaning automated development, testing, deployment, change management, code scanning and version control;
• Data centre resiliency, covering active-active data centre projects, design that avoids any single point of failure (SPOF), real-time pre-emptive monitoring and centralised log management;
• Cloud service security and protection; and
• Access control management alongside proper performance testing.

Risk management and cyber resiliency

Glen McFarlane, threat management leader at IBM, said people are bad at managing risk, so technology has to carry the load. He urged organisations to use the present moment to get ready for the next crisis, and to direct crisis-time spending towards widening or speeding up specific projects. His suggestion was to tie RMiT work to the business's COVID-19 response.

Anurag Kuthiala, executive solutions leader for Europe, Asia Pacific, Japan and Greater China at IBM Resiliency Orchestration, pitched IBM's Cyber Incident Recovery service, which he said cuts detection and exposure time and lowers recovery point and recovery time objectives. His wider point was that firms have to build cyber resilience in advance. Muddling through with existing tools each time an incident strikes isn't enough.

What the audience said

A poll after the presentations asked attendees which of the webinar's themes their organisations were concentrating on. Cybersecurity management came first, technology risk framework management second, and nobody chose cyber resiliency framework management.

The biggest barrier to RMiT compliance, by their answers, was upgrading infrastructure, ahead of understanding the framework and keeping up compliance monitoring over time.

The panel's closing points

Glen added: "Some organisations let the government tell them what's the next thing they should do, but there are not a lot of governments on the forefront of policy development in security. Organisations need to understand their risk and how the management can manage risk and apply that to cybersecurity."

Patrick put it this way: "Compliance and regulations will drive the security strategies for FSIs. The key thing for FSIs is to understand what is important for them and how to assure regulators they are complying."