Question 1

What does the BCP/DR Maturity Diagnostic assess?

Accepted Answer

The BCP/DR Maturity Diagnostic rates your organisation across 6 domains: GP (Governance & Policy) — BCP policy, board approval, budgets; RA (Risk Assessment) — BCP-specific risk register, threat scenarios; BIA (Business Impact Analysis) — MTD, RTO, RPO per critical function; RS (Recovery Strategy) — DR site, failover procedures; TE (Testing & Exercises) — tabletop, full-failover, simulation records; AT (Awareness & Training) — staff BCP training, drill participation. Each domain is rated 1–4 (Poor to Optimised).

Question 2

What does the RBI BCP Circular require?

Accepted Answer

RBI's Master Direction on IT Governance (2021) and the BCP Circular require banks to: maintain a BCP approved by the Board; perform annual BIA identifying RTOs and RPOs for critical functions; conduct DR drills at least twice a year; maintain a secondary data centre with near-zero data loss capability; and submit a BCP certification to RBI annually.

Question 3

How does SEBI CSCRF address business continuity?

Accepted Answer

SEBI CSCRF RC (Recover) function has 4 sub-categories: RC.1 Recovery Planning — documented recovery procedures; RC.2 Improvements — lessons learned from incidents; RC.3 Communications — notification to regulators and stakeholders; RC.4 Business Continuity — BIA, BCP, DR plan with tested RTO/RPO. These map to ISO 22301 Clauses 8.2–8.7.

Question 4

What is the difference between RTO and RPO?

Accepted Answer

RTO (Recovery Time Objective) is the maximum acceptable downtime — how quickly a system must be restored. RPO (Recovery Point Objective) is the maximum acceptable data loss — how old the restored data can be. RBI requires critical systems to have RTO ≤ 2 hours and RPO ≤ 30 minutes. SEBI CSCRF requires exchanges and CCPs to have near-zero RPO for core trading systems.

Question 5

What maturity level is required for RBI/SEBI compliance?

Accepted Answer

For RBI-regulated banks, a minimum BCP/DR maturity of Level 3 (Managed) across all 6 domains is typically required to satisfy inspection requirements. SEBI CSCRF Category I entities (exchanges, CCPs, depositories) are expected to achieve Level 4 (Optimised) in RS and TE domains.

BCP/DR Maturity Diagnostic

Priority Actions