1. Objectives & Regulatory Framework
On April 10, 2023, the Reserve Bank of India (‘RBI’) issued the final Master Direction on Outsourcing of Information Technology Services (‘the Direction’) which has been finalized based on the feedback received on the draft Master Direction on Outsourcing of Information Technology (IT) Services released on 23 June 2022. The Directions have been formulated in an effort to regulate various risks arising from Regulated Entities leveraging on Information Technology (IT) and IT-enabled services (ITeS) in their business, products and services with increasing dependence on third parties.

Along with other Regulated Entities (ORE) specifically referred to in the Direction, this Direction is also applicable, inter alia, to Non-Banking Financial Companies as defined under clause (f) of Section 45I of the Reserve Bank of India Act, 1934 and included in the ‘Top Layer’, ‘Upper Layer’ and ‘Middle Layer’ and ‘Base Layer’ as set out in the Scale Based Regulation (SBR): A Revised Regulatory Framework for NBFCs.

The underlying principle of these Directions is to ensure that outsourcing arrangements neither diminish the company’s ability to fulfil its obligations to customers nor impede effective supervision by the RBI. The Directions shall apply to Material Outsourcing of Information Technology (‘IT’) services arrangements and shall come into effect from 15th February 2025.

2. Definitions
i) Material Outsourcing of IT Services: include those activities which
a) if disrupted or compromised shall have the potential to significantly impact the Company’s business operations; or
b) may have material impact on the Company’s customers in the event of any unauthorized access, loss or theft of customer information.
ii) Outsourcing of Information Technology (“IT”) Services: shall include outsourcing of the following activities:
• IT infrastructure management, maintenance and support (hardware, software or firmware);
• Network and security solutions, maintenance (hardware, software or firmware);
• Application Development, Maintenance and Testing; Application Service Providers (ASPs) including ATM Switch ASPs;
• Services and operations related to Data Centres;
• Cloud Computing Services;
• Managed Security Services; and
• Management of IT infrastructure and technology services associated with payment system ecosystem.

iii) Service Provider: The term “Service Provider” means the provider of IT or IT enabled services. Service Provider includes, but is not limited to, the vendors, agencies, consultants and / or representatives of the third parties. It also includes subcontractors to whom the third-party service providers may further outsource some activity.

3. Role of the Regulated Entity- TCPL
A) Regulatory and Supervisory requirements:
• The outsourcing of any activity shall not diminish TCPL’s obligations as also of its Board and Senior Management, who shall be ultimately responsible for the outsourced activity. The Company shall take steps to ensure that the service provider employs the same high standard of care in performing the services as would have been employed by the Company if the same activity was not outsourced. The Company shall not engage an IT service provider that would result in reputation of TCPL being compromised or weakened.
• Notwithstanding whether the service provider is located in India or abroad, the Company shall ensure that the outsourcing should neither impede nor interfere with the ability of the Company to effectively oversee and manage its activities. Further, the Company shall ensure that the outsourcing does not impede the RBI in carrying out its supervisory functions and objectives. TCPL shall ensure that the service provider, if not a group company, shall not be owned or controlled by any director, or key managerial personnel, or approver of the outsourcing arrangement of the Company, or their relatives. The terms ‘control’, ‘director’, ‘key managerial personnel’, and ‘relative’ have the same meaning as assigned under the Companies Act, 2013 and the Rules 6 framed thereunder from time to time. However, an exception to this requirement may be made with the approval of Board/ Board level Committee, followed by appropriate disclosure, oversight and monitoring of such arrangements. The Board shall inter-alia ensure that there is no conflict of interest arising out of third-party engagements.
• Additional requirements pertaining to usage of cloud computing services and outsourcing of Security Operations Center (SOC) services are outlined in Paragraph 13 and 14 of the Part B, respectively.
B) Comprehensive assessment of need for outsourcing and attendant risks :
The Company shall evaluate the need for Outsourcing of IT Services based on comprehensive assessment of attendant benefits, risks and availability of commensurate processes to manage those risks. TCPL shall consider important aspects, such as;
• Determining the need for outsourcing based on criticality of activity to be outsourced;
• Determining expectations and outcome from outsourcing;
• Determining success factors and cost-benefit analysis; and
• Deciding the model for outsourcing.

C) Compliance with all applicable statutory and regulatory requirements :
The Company shall consider all relevant laws, regulations, rules, guidelines and conditions of approval, licensing or registration, when performing its due diligence in relation to outsourcing of IT services.
D) Grievance Redressal Mechanism :
• The Company shall have a robust grievance redressal mechanism that shall not be compromised in any manner on account of outsourcing, i.e., responsibility for redressal of

customers’ grievances related to outsourced services shall rest with the Company.
• Outsourcing arrangements shall not affect the rights of a customer against the Company, including the ability of the customer to obtain redressal as applicable under relevant laws.

E) Inventory of Outsourced Services :
TCPL shall create an inventory of services provided by the service. Further, the Company shall map their dependency on third parties and periodically evaluate the information received from the service providers.

4. Governance Framework
The Company, intending to outsource any of its IT activities, shall put in place a comprehensive Board approved IT outsourcing policy. The policy shall incorporate, inter alia, the roles and responsibilities of the Board, Committees of the Board (if any) and Senior Management, IT function, business function as well as oversight and assurance functions in respect of outsourcing of IT services.

A) Role of the Board
The Board of the Company shall be responsible, inter alia, for:

• putting in place a framework for approval of IT outsourcing activities depending on risks and materiality;
• approving policies to evaluate the risks and materiality of all existing and prospective IT outsourcing arrangements; and
• setting up suitable administrative framework of Senior Management for the purpose of these Directions.

Further the Board may delegate the above responsibilities to IT Strategy Committee of the Company, as it may deem fit.
B) Role of the Senior Management
The Senior Management of the Company shall, inter alia, be responsible for:

• formulating IT outsourcing policies and procedures, evaluating the risks and materiality of all existing and prospective IT outsourcing arrangements based on the framework commensurate with the complexity, nature and scope, in line with the enterprise-wide risk management of the organisation approved by the Board and its implementation;

• prior evaluation of prospective IT outsourcing arrangements and periodic evaluation of the existing outsourcing arrangements covering the performance review, criticality and associated risks of all such arrangements based on the policy approved by the Board;
• identifying IT outsourcing risks as they arise, monitoring, mitigating, managing and reporting of such risks to the Board/ Board Committee in a timely manner;
• ensuring that suitable business continuity plans based on realistic and probable disruptive

scenarios, including exit of any third-party service provider, are in place and tested periodically;
• ensuring (i) effective oversight over third party for data confidentiality and (ii) appropriate redressal of customer grievances in a timely manner;
• ensuring an independent review and audit on a periodic basis for compliance with the legislations, regulations, Board-approved policy and performance standards and reporting the same to Board/ Board Committee; and
• creating essential capacity with required skillsets within the organization for proper oversight of outsourced activities.

C) Role of the IT Function
The responsibilities of the IT Function of the Company shall, inter alia, include:

• assisting the Senior Management in identifying, measuring, monitoring, mitigating and managing the level of IT outsourcing risk in the organisation;

• ensuring that a central database of all IT outsourcing arrangements is maintained and is accessible for review by Board, Senior Management, Auditors and Supervisors;

• effectively monitor and supervise the outsourced activity to ensure that the service providers meet the laid down performance standards and provide uninterrupted services, report to the Senior Management; co-ordinate periodic due diligence and highlight concerns, if any; and

• putting in place necessary documentation required for contractual agreements including service level management, monitoring of vendor operations, key risk indicators and classifying the vendors as per the determined risk.

5. Evaluation and Engagement of Service Providers
• In considering or renewing an Outsourced IT Services arrangement, appropriate due diligence shall be performed to assess the capability of the service provider to comply with obligations in the outsourcing agreement on an ongoing basis. Due diligence shall take into consideration qualitative, quantitative, financial, operational, legal and reputational factors. The Company shall also consider, while evaluating the capability of the service provider, risks arising from the concentration of outsourcing arrangements with a single/ few service provider/s. Where possible, the Company shall obtain independent reviews and market feedback on the service provider to supplement its own assessment.

• A risk-based approach shall be adopted in conducting such due diligence activities.

• Due diligence shall involve an evaluation of all available information, as applicable, about the service provider, including but not limited to:

a. past experience and demonstrated competence to implement and support the proposed IT activity over the contract period;

b. financial soundness and ability to service commitments even under adverse conditions;

c. business reputation and culture, compliance, complaints and outstanding or potential litigations;
d. conflict of interest, if any;

e. external factors like political, economic, social and legal environment of the jurisdiction in which the service provider operates and other events that may impact data security and service performance;

f. details of the technology, infrastructure stability, security and internal control, audit coverage, reporting and monitoring procedures, data backup arrangements, business continuity management and disaster recovery plan;

g. capability to identify and segregate the Company’s data;

h. quality of due diligence exercised by the service provider with respect to its employees and sub- contractors;

i. capability to comply with the regulatory and legal requirements of the Outsourcing of IT Services arrangement;
j. information/ cyber security risk assessment;

k. ensuring that appropriate controls, assurance requirements and possible contractual arrangements are in place to ensure data protection and the Company’s access to the data which is processed, managed or stored by the service provider;

l. ability to effectively service all the customers while maintaining confidentiality, especially where a service provider has exposure to multiple entities; and

m. ability to enforce agreements and the rights available thereunder including those relating to aspects such as data storage, data protection and confidentiality.

6. Outsourcing Agreement
• The Company shall ensure that its rights and obligations and those of each of its service providers are clearly defined and set out in a legally binding written agreement. In principle, the provisions of the agreement should appropriately reckon the criticality of the outsourced task to the business of the Company, the associated risks and the strategies for mitigating or managing them.

• The terms and conditions governing the contract shall be carefully defined and vetted by the Company’s legal counsel for their legal effect and enforceability. The agreement shall be sufficiently flexible to allow the Company to retain adequate control over the outsourced activity and the right to intervene with appropriate measures to meet legal and regulatory obligations.

• The agreement shall also bring out the nature of legal relationship between the parties, i.e., whether agent, principal or otherwise.

• Some key areas that should be covered by the agreement (as applicable to the scope of Outsourcing of IT Services) are as follows :

a. details of the activity being outsourced, including appropriate service and performance

standards including for the sub-contractors, if any;

b. effective access by the Company to all data, books, records, information, logs, alerts and business premises relevant to the outsourced activity, available with the service provider;

c. regular monitoring and assessment of the service provider by the Company for continuous management of the risks holistically, so that any necessary corrective measure can be taken immediately; including termination clause and minimum period to execute such provision, if deemed necessary;

d. type of material adverse events (e.g., data breaches, denial of service, service unavailability, etc.) and the incidents required to be reported to the Company to enable the Company to take prompt risk mitigation measures and ensure compliance with statutory and regulatory guidelines;

e. compliance with the provisions of Information Technology Act, 2000, other applicable legal requirements and standards to protect the customer data;

f. the deliverables, including Service-Level Agreements (SLAs) formalizing performance criteria to measure the quality and quantity of service levels;

g. storage of data only in India as per extant regulatory requirements;
h. clauses requiring the service provider to provide details of data (related to the Company and its customers) captured, processed and stored;

i. controls for maintaining confidentiality of data of the Company and its customers’, and incorporating service provider’s liability to the Company in the event of security breach and leakage of such information;

j. types of data/ information that the service provider (vendor) is permitted to share with the Company’s customer and / or any other party;

k. specifying the resolution process, events of default, indemnities, remedies, and recourse available to the respective parties;

l. contingency plan(s) to ensure business continuity and testing requirements;
m. right to conduct audit of the service provider (including its sub-contractors) by the Company, whether by its internal or external auditors, or by agents appointed to act on its behalf, and to obtain copies of any audit or review reports and findings made about the service provider in conjunction with the services performed for the Company;

n. right to seek information from the service provider about the third parties (in the supply chain) engaged by the former;

o. recognizing the authority of regulators to perform inspection of the service provider and any of its sub-contractors. Adding clauses to allow RBI or person(s) authorized by it to access the Company’s IT infrastructure, applications, data, documents, and other necessary information given to, stored or processed by the service provider and/ or its sub-contractors in relation and as applicable to the scope of the outsourcing arrangement;
p. including clauses making the service provider contractually liable for the performance and risk management practices of its sub-contractors;

q. obligation of the service provider to comply with directions issued by the RBI in relation to the activities outsourced to the service provider, through specific contractual terms and conditions specified by the Company;

r. clauses requiring prior approval/ consent of the Company for use of sub-contractors by the service provider for all or part of an outsourced activity;

s. termination rights of the company, including the ability to orderly transfer the proposed IT- outsourcing arrangement to another service provider, if necessary or desirable;

t. obligation of the service provider to co-operate with the relevant authorities in case of insolvency/ resolution of the Company;

u. provision to consider skilled resources of service provider who provide core services as “essential personnel” so that a limited number of staff with back-up arrangements necessary to operate critical functions can work on-site during exigencies (including pandemic situations);

v. clause requiring suitable back-to-back arrangements between service providers and the OEMs; and

w. clause requiring non-disclosure agreement with respect to information retained by the service provider.

x. The Company has the right to extend the above clauses of the agreement to any agencies to which the service provider sub-contracts any activity related to IT services outsourced by the Company.

7. Risk Management
• TCPL shall put in place a Risk Management framework for Outsourcing of IT Services that shall comprehensively deal with the processes and responsibilities for identification, measurement, mitigation, management, and reporting of risks associated with Outsourcing of IT Services arrangements.

• The risk assessments carried out by the Company shall be suitably documented with necessary approvals in line with the roles and responsibilities for the Board of Directors, Senior Management and IT Function. Such risk assessments shall be subject to internal and external quality assurance on a periodic basis as determined by the Board-approved policy.

• TCPL shall be responsible for the confidentiality and integrity of data and information pertaining to the customers that is available to the service provider.

• Access to data at the Company’s location / data centre by service providers shall be on need-to- know basis, with appropriate controls to prevent security breaches and/or data misuse.

• Public confidence and customer trust in the Company is a prerequisite for their stability and reputation. Hence, the Company shall seek to ensure the preservation and protection of the security and confidentiality of customer information in the custody or possession of the service provider. Access to customer information by staff of the service provider shall be on need-to-know basis.

• In the event of multiple service provider relationships where two or more service providers collaborate to deliver an end-to-end solution, the Company remains responsible for understanding and monitoring the control environment of all service providers that have access to the Company’s data, systems, records or resources.

• In instances where service provider acts as an outsourcing agent for multiple Company, care shall be taken to build adequate safeguards so that there is no combining of information, documents, records and assets. The Company shall ensure that a Non-Disclosure Agreement (“NDA”) is in place even after the contract expires/is terminated.

• The Company shall ensure that cyber incidents are reported to the Company by the service provider without undue delay, so that the incident is reported by the Company to the RBI within 6 hours of detection by the service provider.

• TCPL shall review and monitor the control processes and security practices of the service provider to disclose security breaches. The Company shall immediately notify RBI in the event of breach of security and leakage of confidential customer-related information. In these eventualities, the Company shall adhere to the extant instructions issued by RBI from time to time on Incident Response and Recovery Management.

• The Company shall effectively assess the impact of concentration risk posed by multiple outsourcings to the same service provider and/or the concentration risk posed by outsourcing critical or material functions to a limited number of service providers.

8. Business Continuity Plan and Disaster Recovery Plan
• The Company shall require their service providers to develop and establish a robust framework for documenting, maintaining and testing Business Continuity Plan (“BCP”) and Disaster Recovery Plan (“DRP”) commensurate with the nature and scope of the outsourced activity as per extant BCP/ DR requirements.

• In establishing a viable contingency plan, the Company shall consider the availability of alternative service providers or the possibility of bringing the outsourced activity back in-house in an emergency, and the costs, time and resources that would be involved.

• In order to mitigate the risk of unexpected termination of the outsourcing agreement or insolvency/ liquidation of the service provider, the Company shall retain an appropriate level of control over its IT-outsourcing arrangement along with right to intervene, with appropriate measures to continue its business operations.

• The Company shall ensure that service providers are able to isolate the Company’s information, documents and records and other assets. This is to ensure that in adverse conditions and/or termination of the contract, all documents, record of transactions and information with the service provider and assets of the Company can be removed from the possession of the service provider in order to continue its business operations, or deleted, destroyed or rendered unusable.

9. Monitoring and Control of Outsourced Activities
• TCPL shall have in place a management structure to monitor and control its Outsourced IT activities. This shall include (as applicable to the scope of Outsourcing of IT Services) but not limited to monitoring the performance, uptime of the systems and resources, service availability,

adherence to SLA requirements, incident response mechanism, etc.
• The Company shall conduct regular audits (as applicable to the scope of Outsourcing of IT Services) of service providers (including sub-contractors) with regard to the activity outsourced by it. Such audits may be conducted either by the Company’s internal auditors or external auditors appointed to act on the Company’s behalf.
• While outsourcing various IT services, more than one Regulated Entity (RE) may be availing services from the same third-party service provider. In such scenarios, in lieu of conducting separate audits by individual REs of the common service provider, they may adopt pooled (shared) audit. This allows the relevant Companies to either pool their audit resources or engage an independent third-party auditor to jointly audit a common service provider. However, in doing so, it shall be the responsibility of the Company in ensuring that the audit requirements related to their respective contract with the service provider are met effectively.

• The audit shall assess the performance of the service provider, adequacy of the risk management practices adopted by the service provider, compliance with laws and regulation, etc. The frequency of the audit shall be determined based on the nature and extent of risk and impact to the Company from the outsourcing arrangements. Reports on the monitoring and control activities shall be reviewed periodically by the Senior Management and in case of any adverse development, the same shall be put up to the Board for information.

• The Company, depending upon the risk assessment, may also rely upon globally recognized third- party certifications made available by the service provider in lieu of conducting independent audits. However, this shall not absolve the Company of their responsibility in ensuring assurance on the controls and procedures required to safeguard data security (including availability of systems) at the service provider’s end.

• The Company shall periodically review the financial and operational condition of the service provider to assess its ability to continue to meet its Outsourcing of IT Services obligations. The Company shall adopt risk-based approach in defining the periodicity. Such due diligence reviews shall highlight any deterioration or breach in performance standards, confidentiality, and security, and in operational resilience preparedness.

• In the event of termination of the outsourcing agreement for any reason in cases where the service provider deals with the customers of the Company, the same shall be given due publicity by the Company so as to ensure that the customers stop dealing with the concerned service provider.

• The Company shall ensure that the service provider grants unrestricted and effective access to
a) data related to the outsourced activities; b) the relevant business premises of the service provider; subject to appropriate security protocols, for the purpose of effective oversight use by the Company, their auditors, regulators and other relevant Competent Authorities, as authorized under law.

10. Outsourced within a Group /Conglomerate
• TCPL may outsource any IT activity/ IT enabled service within its business group/ conglomerate, provided that such an arrangement is backed by the Board-approved policy and appropriate service level arrangements/ agreements with its group entities are in place.

• The selection of a group entity shall be based on objective reasons that are similar to selection of a third-party, and any conflicts of interest that such an outsourcing arrangement may entail shall be appropriately dealt with.
• The Company, at all times, shall maintain an arm’s length relationship in dealings with their group entities. Risk management practices being adopted by the Company while outsourcing to a group entity shall be identical to those specified for a non-related party.

11. Additional requirements for Cross- Border Outsourcing
• The engagement of a service provider based in a different jurisdiction exposes the Company to country risk. To manage such a risk, the Company shall closely monitor government policies of the jurisdiction in which the service provider is based and the political, social, economic and legal conditions on a continuous basis, as well as establish sound procedures for mitigating the country risk. This includes, inter alia, having appropriate contingency and exit strategies. Further, it shall be ensured that availability of records to the Company and the RBI will not be affected even in case of liquidation of the service provider.

• The governing law of the arrangement shall also be clearly specified. In principle, arrangements shall only be entered into with parties operating in jurisdictions upholding confidentiality clauses and agreements.

• The right of the Company and the RBI to direct and conduct audit or inspection of the service provider based in a foreign jurisdiction shall be ensured.

• The arrangement shall comply with all statutory requirements as well as regulations issued by the RBI from time to time.

12. Exit Strategy
• The Outsourcing of IT Services policy shall contain a clear exit strategy with regard to outsourced IT activities/ IT enabled services, while ensuring business continuity during and after exit. The strategy should include exit strategy for different scenarios of exit or termination of services with stipulation of minimum period to execute such plans, as necessary. In documenting an exit strategy, the Company shall, inter alia, identify alternative arrangements, which may include performing the activity by a different service provider or the Company itself.
• The Company shall ensure that the agreement has necessary clauses on safe removal/ destruction of data, hardware and all records (digital and physical), as applicable. However, service provider shall be legally obliged to cooperate fully with both the Company and new service provider(s) to ensure there is a smooth transition. Further, agreement shall ensure that the service provider is prohibited from erasing, purging, revoking, altering or changing any data during the transition period, unless specifically advised by the regulator/ concerned Company.

13. Storage, Computing and Movement of Data in Cloud Environments- Usage of Cloud Computing Services
The Company shall adopt the following requirements for storage, computing and movement of data in cloud environments:

• While considering adoption of cloud solution, it is imperative to analyze the business strategy and goals adopted to the current IT applications footprint and associated costs. Cloud adoption ranges from moving only non-business critical workloads to the cloud to moving critical business applications such as SaaS adoption and the several combinations in-between, which should be based on a business technology risk assessment.

• In engaging cloud services, the Company shall ensure, inter alia, that the Outsourcing of IT Services policy addresses the entire lifecycle of data, i.e., covering the entire span of time from generation of the data, its entry into the cloud, till the data is permanently erased/ deleted. The Company shall ensure that the procedures specified are consistent with business needs and legal and regulatory requirements.

• In adoption of cloud services, the Company shall take into account the cloud service specific factors, viz., multi-tenancy, multi-location storing/ processing of data, etc., and attendant risks, while establishing appropriate risk management framework. Cloud security is a shared responsibility between the Company and the Cloud Service Provider (CSP). The Company may refer to some of the cloud security best practices, for implementing necessary controls, as per applicability of the shared responsibility model in the adoption of cloud services.

• Cloud Governance: TCPL shall adopt and demonstrate a well-established and documented cloud adoption policy. Such a policy should, inter alia, identify the activities that can be moved to the cloud, enable and support protection of various stakeholder interests, ensure compliance with regulatory requirements, including those on privacy, security, data sovereignty, recoverability and data storage requirements, aligned with data classification. The policy should provide for appropriate due diligence to manage and continually monitor the risks associated with CSPs.
• Cloud Service Providers (CSP)
Considerations for selection of CSP: The Company shall ensure that the selection of the CSP is based on a comprehensive risk assessment of the CSP. TCPL shall enter into a contract only with CSPs subject to jurisdictions that uphold enforceability of agreements and the rights available thereunder to the Company, including those relating to aspects such as data storage, data protection and confidentiality.

• Cloud Services Management and Security Considerations

a. Service and Technology Architecture: TCPL shall ensure that the service and technology architecture supporting cloud-based applications is built in adherence to globally recognized architecture principles and standards. The Company shall prefer a technology architecture that provides for secure container-based data management, where encryption keys and Hardware Security Modules are under the control of the Company. The architecture should provide for a standard set of tools and processes to manage containers, images and releases. Multi- tenancy environments should be protected against data integrity and confidentiality risks, and against co-mingling of data. The architecture should be resilient and enable smooth recovery in case of failure of any one or combination of components across the cloud architecture with minimal impact on data/ information security.

b. Identity and Access Management (IAM): IAM shall be agreed upon with the CSP and ensured for providing role-based access to the cloud hosted applications, in respect of user- access and privileged-access. Stringent access controls, as applicable for an on-premise application, may be established for identity and access management to cloud-based applications. Segregation of duties and role conflict matrix should be implemented for all kinds of user- access and privileged-access roles in the cloud-hosted application irrespective of the cloud service model. Access provisioning should be governed by principles of ‘need to know’ and ‘least privileges’. In addition, multi-factor authentication should be implemented for access to cloud applications.

c. Security Controls: TCPL shall ensure that the implementation of security controls in the cloud-based application achieves similar or higher degree of control objectives than those achieved in/ by an on-premise application. This includes ensuring – secure connection through appropriate deployment of network security resources and their configurations; appropriate and secure configurations, monitoring of the cloud assets utilized by the Company and necessary procedures to authorize changes to cloud applications and related resources.

d. Robust Monitoring and Surveillance: TCPL shall accurately define minimum monitoring requirements in the cloud environment. The Company should ensure to assess the information/ cyber security capability of the cloud service provider, such that, the

i. CSP maintains an information security policy framework commensurate with its exposures to vulnerabilities and threats;
ii. CSP is able to maintain its information/ cyber security capability with respect to changes in vulnerabilities and threats, including those resulting from changes to information assets or its business environment;
iii. nature and frequency of testing of controls by the CSP in respect of the outsourced services is commensurate with the materiality of the services being outsourced by the Company and the threat environment; and
iv. CSP has mechanisms in place to assess the sub-contractors with regards to confidentiality, integrity and availability of the data being shared with the sub- contractors, where applicable.

e. Appropriate integration of logs, events from the CSP into the Company’s SOC (Security Operations Center), wherever applicable and/ or retention of relevant logs in cloud shall be ensured for incident reporting and handling of incidents relating to services deployed on the cloud.

f. The Company’s own efforts in securing its application shall be complemented by the CSP’s cyber resilience controls. The CSP and the Company shall ensure continuous and regular updates of security-related software including upgrades, fixes, patches and service packs for protecting the application from advanced threats/ malware.

g. Vulnerability Management: TCPL shall ensure that CSPs have a well-governed and structured approach to manage threats and vulnerabilities supported by requisite industry-specific threat intelligence capabilities.

• Disaster Recovery & Cyber Resilience

a. The Company’s business continuity framework shall ensure that, in the event of a disaster affecting its cloud services or failure of the CSP, the Company can continue its critical operations with minimal disruption of services while ensuring integrity and security.

b. TCPL shall ensure that the CSP puts in place demonstrative capabilities for preparedness and readiness for cyber resilience as regards cloud services in use by them. This should be systematically ensured, inter alia, through robust incident response and recovery practices including conduct of Disaster Recovery (DR) drills at various levels of cloud services including necessary stakeholders.

• The following points may be evaluated while developing an exit strategy

a. the exit strategy and service level stipulations in the SLA shall factor in, inter alia,
i) agreed processes and turnaround times for returning the Company’s service collaterals and data held by the CSP;
ii) data completeness and portability;
iii) secure purge of the Company’s information from the CSP’s environment;
iv) smooth transition of services; and
v) unambiguous definition of liabilities, damages, penalties and indemnities.
b. monitoring the ongoing design of applications and service delivery technology stack that the exit plans should align with.
c. contractually agreed exit / termination plans should specify how the cloud- hosted service(s) and data will be moved out from the cloud with minimal impact on continuity of the Company’s business, while maintaining integrity and security.

d. All records of transactions, customer and operational information, configuration data should be promptly taken over in a systematic manner from the CSP and purged at the CSP-end and independent assurance sought before signing off from the CSP.
• Audit and Assurance
The audit/ periodic review/ third-party certifications should cover, as per applicability and cloud usage, inter alia, aspects such as roles and responsibilities of both TCPL and CSP in cloud governance, access and network controls, configurations, monitoring mechanism, data encryption, log review, change management, incident response, and resilience preparedness and testing, etc.

14. Outsourcing of Security Operations Centre (SOC)
Outsourcing of SOC operations has the risk of data being stored and processed at an external location and managed by a third party (Managed Security Service Provider -MSSP) to which the Company have lesser visibility. To mitigate the risks, in addition to the controls prescribed in these Directions, the Company shall adopt the following requirements in the case of outsourcing of SOC operations:

a. unambiguously identify the owner of assets used in providing the services (systems, software, source code, processes, concepts, etc.);
b. ensure that the Company has adequate oversight and ownership over the rule definition, customisation and related data/ logs, meta-data and analytics (specific to the Company);
c. assess SOC functioning, including all physical facilities involved in service delivery, such as

the SOC and areas where client data is stored / processed periodically;
d. integrate the outsourced SOC reporting and escalation process with the Company’s incident response process; and
e. review the process of handling of the alerts / events.

15. Services not considered under Outsourcing of IT Services
a. Corporate Internet Banking services obtained by the Company as corporate customers/ sub members of another regulated entity
b. External audit such as Vulnerability Assessment/ Penetration Testing (VA/PT),
c. Information Systems Audit, security review
d. SMS gateways (Bulk SMS service providers)
Procurement of IT hardware/ appliances
a. Acquisition of IT software/ product/ application (like CBS, database, security solutions, etc.,) on a licence or subscription basis and any enhancements made to such licensed third-party application by its vendor (as upgrades) or on specific change request made by the Company.
b. Any maintenance service (including security patches, bug fixes) for IT Infra or licensed products, provided by the Original Equipment Manufacturer (OEM) themselves, in order to ensure continued usage of the same by the Company.
c. Applications provided by financial sector regulators or institutions like CCIL, NSE, BSE, etc.
d. Platforms provided by entities like Reuters, Bloomberg, SWIFT, etc.
e. Any other off the shelf products (like anti-virus software, email solution, etc.,) subscribed to by the Company wherein only a license is procured with no/ minimal customization.
f. Services obtained by the Company as a sub-member of a Centralized Payment Systems (CPS) from another Company.
g. Business Correspondent (BC) services, payroll processing, statement printing
• Vendors / Entities who are not considered as Third-Party Service Provider

a. Vendors providing business services using IT. Example – BCs
b. Payment System Operators authorised by the Reserve Bank of India under the Payment and Settlement Systems Act, 2007 for setting up and operating Payment Systems in India
c. Partnership based Fintech firms such as those providing co-branded applications, service, products (would be considered under outsourcing of financial services)
d. Services of Fintech firms for data retrieval, data validation and verification services such as (list is not exhaustive):
(a). Bank statement analysis
(b). GST returns analysis
(c). Fetching of vehicle information
(d). Digital document execution
(e). Data entry and Call centre services
e. Telecom Service Providers from whom leased lines or other similar kind of infrastructure are availed and used for transmission of the data
f. Security/ Audit Consultants appointed for certification/ audit/ VA-PT related to IT infra/ IT services/ Information Security services in their role as independent third-party auditor/ consultant/ lead implementer.