RBI IT Outsourcing

• RBI Master Direction on Outsourcing of Information Technology Services

The RBI direction was issued for regulated entities that outsource IT and IT-enabled services. The official direction should be reviewed directly for the exact regulated-entity scope, commencement, definitions, exclusions, and entity-specific obligations.

RBI recognizes that regulated entities rely heavily on IT and IT-enabled services. Outsourcing those services can create operational, cyber, data, customer, concentration, business continuity, legal, and supervisory risk. The direction is designed to make sure those risks are identified and managed before and after the outsourcing arrangement is approved.

The underlying principle is accountability. A regulated entity should not lose control over its regulated obligations because the technology is run by another company. It needs rights, evidence, visibility, continuity, and auditability.

The direction should be read around these themes:

• board and senior management governance for IT outsourcing;
• outsourcing policy and risk management framework;
• evaluation of IT outsourcing arrangements;
• due diligence on service providers;
• written agreements and required contract provisions;
• data confidentiality, security, and customer protection;
• audit, access, and RBI supervisory rights;
• sub-contracting or sub-outsourcing controls;
• cloud computing and technology service provider risk where applicable;
• business continuity, disaster recovery, cyber incidents, and exit management.

Regulated entities should maintain a technology outsourcing inventory that shows the outsourced IT service, business owner, technology owner, service provider, contract, criticality, data access, customer impact, locations, subcontractors, cloud model, control evidence, audit rights, monitoring status, incident history, and exit plan.

The institution should also be able to show why the service provider was selected, what diligence was performed, which risks remain, how those risks are monitored, and whether the provider can support regulatory, audit, incident, and continuity requirements.

• IT outsourcing policy, governance approvals, and risk management framework.
• Inventory of outsourced IT and IT-enabled services.
• Risk assessment and due diligence records for service providers.
• Contract review evidence and executed agreements.
• Security, confidentiality, data, access, audit, and supervisory-right evidence.
• Sub-outsourcing and cloud dependency records.
• Business continuity, disaster recovery, incident response, and exit evidence.
• Monitoring results, issues, remediation, and management reporting.

• IT outsourcing is tracked separately from enterprise third-party risk, so the business owner,

technology owner, and contract owner work from different records.

• Cloud and SaaS services are approved as tools without clear treatment as outsourced technology

dependencies.

• Subcontractor and hosting-location changes are not captured after onboarding.
• Contracts contain audit or access language, but teams cannot quickly produce the evidence RBI or

internal audit would expect.

• Business continuity plans do not show how the regulated entity would recover if the technology

service provider failed.

Halbarad helps regulated entities maintain a live view of IT outsourcing arrangements and the evidence behind them. It can connect the provider, service, system, data, contract, controls, subcontractors, incidents, issues, and exit posture in one record.

Halbarad can help teams:

• build an IT outsourcing inventory mapped to systems, services, data, owners, and contracts;
• use Spark Assessment to collect initial evidence from public sources, attestations, trust centers,

incident history, and framework mappings;

• use Nth-Party Discovery to identify sub-outsourcing, fourth parties, fifth parties, hosting

dependencies, and concentration exposure;

• use Continuous Monitoring to detect outages, advisories, trust-center updates, status-page

changes, cyber signals, and material provider changes;

• manage evidence requests, approvals, residual risk, issues, remediation, reporting, and audit

trail through Governance workflows.

Halbarad helps operationalize and evidence the RBI IT outsourcing process. It does not guarantee compliance or replace review of the RBI direction.