Challenge: Meeting RBI’s Master Direction for IT – Disaster Recovery (DR) Compliance
In response to the RBI’s Master Direction on Information Technology (IT) Framework, the NBFC was mandated to implement a robust, tested, and cost-effective Disaster Recovery (DR) strategy. Key regulatory requirements included:
- Defined RTO (Recovery Time Objective) and RPO (Recovery Point Objective) based on asset criticality.
- Failover of critical systems such as LOS (Loan Origination System), LMS (Loan Management System), and peripheral fintech applications.
- 24×7 DR availability with an End-of-Day failback mechanism.
- Secure data handling in both transit and at rest.
- Periodic DR drills and audit-ready reports.
What is Expected for DR Strategy from RBI Master Direction for IT Perspective
Based on RBI’s Master Direction and applicable guidance:
- Regulated Entities (REs) must have Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP) in place and tested periodically.
- These requirements extend to service providers, who must also maintain and test BCPs and DRPs proportional to the outsourced activity, with testing aligned to RBI’s extant instructions Section 61a.
- For cloud computing services, REs must ensure that their Cloud Service Providers (CSPs) demonstrate cyber resilience through:
- Robust incident response practices.
- Active disaster recovery capabilities.
- DR drills at multiple levels, especially for critical systems, section 90b.
- While RBI clearly mandates regular DR testing and drills, it does not specify detailed technical steps such as:
- Mandatory 24-hour execution of systems in DR.
- The requirement to run end-of-day (EOD) processes during drills.
- Explicit instructions for failback procedures.
Solution: CyberNX’s “Manager Backup and DR”
CyberNX, through its Managed Cloud-Agnostic Platform MSP-247.net, partnered with the NBFC to architect and operationalize a comprehensive and RBI-compliant Disaster Recovery framework. The key aspects of the solution included:
1. Strategic Asset Classification & Risk Prioritization
- Conducted Business Impact Analysis (BIA) to classify applications and data by criticality.
- Mapped RTO/RPO thresholds per asset, streamlining recovery priorities and backup policies.
2. Hybrid DR Architecture with AWS Dual-Region Strategy
- Primary region hosted in Mumbai, DR region in Hyderabad.
- Implemented cross-account isolation, replicating infrastructure and data for DR simulation and high availability.
- Having Encryption key Managed in both Production and DR accounts without compromising the Cryptography control mandates from RBI.
3. Secure Data Handling – End-to-End Encryption
- AES-256 encryption at rest and TLS 1.2+ for transit.
- Cloud-native KMS integration (AWS CMK) to manage encryption keys and regulatory compliance.
4. Anytime Restore & Continuous Simulation
- Enabled automated DR drills, point-in-time restores, and instant failover for mission-critical services.
- Ability to run Production and DR simultaneously with interconnectivity with proper DNS mapping.
5. API and Fintech Ecosystem Resilience
- Ensured continuous uptime for APIs and fintech integrations by ensuring whitelisting of DR with external service providers.
6. Cost Optimized Solution
- Adopted Pilot Light Strategy by enabling VM form volumes as an when required.
- Reduce the cost by using S3 Bucket and deep archive to store historical data.
7. Failover & Failback Orchestration
- Seamless 24-hour operation in DR during simulations.
- End-of-Day (EOD) failback to Mumbai, ensuring data consistency, transactional integrity, and compliance validation.
Benefits
- 97.5% audit success during RBI reviews.
- Zero disruption to APIs and fintech apps during drills.
- ~57% cost savings compared to traditional DR methods.
- Quarterly DR drills made audit-readiness a continuous process.
- Future-ready cloud-native architecture with no license dependency.
Conclusion
This case study illustrates how CyberNX, through its MSP-247.net Team, helped the NBFC not just achieve RBI DR compliance, but also built a resilient, secure, and cost-efficient disaster recovery framework. By integrating regulatory mandates with smart architecture, the NBFC ensured operational continuity and cyber resilience in a scalable, cloud-native way without spending and owning any third-party license and ability to restore data after the termination of the service agreement with CyberNX.
