A Director's Guide to BNM RMiT: Your Governance Responsibilities Explained

Bank Negara Malaysia's Risk Management in Technology (RMiT) policy is more than a technical checklist for the IT department; it is a foundational framework for corporate governance in the digital age. The document places direct, unambiguous responsibility on the board of directors and senior management to oversee technology risk, ensure cyber resilience, and maintain the trust that underpins the nation's financial system. For leaders, navigating RMiT is a core component of their fiduciary duty.

Understanding this policy does not require becoming a technical expert. It requires a strategic grasp of the key governance pillars that form the foundation of a compliant and resilient financial institution. This guide distills the extensive RMiT policy into the essential duties and strategic decisions required from the top of the house.

Governance and the Board's Direct Responsibility

The central theme of the RMiT policy is governance. The board must actively lead and oversee the institution's entire technology risk posture.

Key responsibilities for the board include:

• Establishing Risk Appetite:
  The board must establish and approve the institution's technology risk appetite, ensuring it aligns with the overall business strategy. This includes approving specific risk tolerances for technology-related events and ensuring indicators are in place to monitor this posture.

• Overseeing Strategic Plans:
  The board is required to oversee and ensure the adequacy of the institution's IT and cybersecurity strategic plans, which must cover a period of at least three years. These plans must be reviewed periodically to remain relevant to the business and risk environment.

• Approving Key Frameworks:
  The board is responsible for overseeing the effective implementation of a sound Technology Risk Management Framework (TRMF) and a Cyber Resilience Framework (CRF). These frameworks are the primary tools for safeguarding the institution's data and ensuring the continuity of financial services.

• Designating Oversight Committees:
  The policy mandates that the board designate a specific board-level committee to be responsible for providing oversight on technology-related matters. Furthermore, the board audit committee holds the responsibility for ensuring the effectiveness and competence of the internal technology audit function.

Key Areas of Strategic Oversight for Leadership

Beyond establishing frameworks, the board and senior management must exercise diligent oversight over critical operational domains that present significant technology risk.

• Third-Party and Cloud Risk:
  The board and senior management must exercise effective oversight and address the risks associated with engaging third-party service providers for critical technology functions. This is especially true for the adoption of public cloud for critical systems, which requires a comprehensive risk assessment prior to engagement and a formal consultation with BNM for the first-time adoption.

• Cyber Resilience and Preparedness:
  Leadership must ensure the institution establishes comprehensive cyber crisis management policies. A key requirement is the implementation of an annual cyber drill exercise to test the effectiveness of the Cyber Incident Response Plan (CIRP), with the involvement of key stakeholders including the board and senior management.

Building a Culture of Compliance and Awareness

The RMiT policy recognizes that technology risk management is also a cultural issue. The board has a direct role in fostering a security-conscious culture from the top down.

This includes providing adequate and regular technology and cybersecurity awareness education for all staff. Crucially, the policy also states that the financial institution must provide its board members with regular training and information on technology developments. This ensures the board can effectively discharge its significant oversight role in a complex and evolving environment.

Navigating RMiT with an Expert Partner

Achieving and maintaining compliance with BNM's RMiT policy is a continuous journey of strategic governance. It requires deep expertise in both the granular details of the regulatory requirements and the technical security controls needed to meet them.

AKATI Sekurity’s BNM RMiT Compliance Service is designed to assist financial institutions at every stage of this journey. We provide comprehensive gap analysis, framework development, policy review, and independent assessments that give your leadership team and board the clarity and assurance needed to confidently meet their governance responsibilities.

To ensure your institution's approach to technology risk is both effective and compliant, contact AKATI Sekurity for a strategic consultation.