Cyber Readiness Check for Banks and Microfinance

Has management approved a written information security policy that is reviewed at least once a year?

Is a named person responsible for information security, with the time and authority to act?

Do you keep an up-to-date inventory of your servers, computers, network equipment and software, including branches and agents?

Has an independent information security audit of your systems been carried out in the last 12 months?

Does every staff member use a personal account (no shared logins) on the core banking system and other applications?

Do you enforce a password policy on all systems (long passwords, default passwords changed, no reuse)?

Is multi-factor authentication required for remote access, email and administrator accounts?

Are administrator rights, including direct access to the core banking database, limited to a few named people using separate admin accounts?

Are user access rights reviewed at least twice a year, and removed on the day someone leaves?

Do transactions above set limits, reversals and changes to customer or account data require a second person's approval in the system?

Are the connections between your core banking system and mobile money or payment partners protected (encryption, verified callbacks, IP restrictions, keys kept out of code)?

Are core banking balances reconciled every day with mobile money and payment partner statements, with every difference investigated?

Are core banking and accounting data backed up automatically at least once a day, with failures noticed?

Is at least one backup copy kept offline or isolated, out of reach of ransomware and of a compromised admin account?

Have you restored your systems from backup as a test in the last 6 months, and does your continuity plan include cyberattack scenarios?

Are security logs (logins, admin actions, transaction overrides) collected in one protected place and kept for at least 12 months?

Does someone review alerts for suspicious activity (failed logins, logins at unusual hours, new admin accounts) every working day?

Are security updates for servers, computers and network equipment applied within a set time (for example 30 days, faster for critical flaws)?

Is anti-malware protection installed and kept up to date on every server and computer?

Has an authorized, independent penetration test of your internet-facing systems and mobile or web channels been done in the last 12 months?

Do you keep a list of IT suppliers and service providers (core banking vendor, hosting, mobile money aggregators) and the access each one has?

Do supplier contracts include security obligations (confidentiality, incident notification, access rules, right to audit)?

Is vendor remote access to your systems switched on only when needed, protected by MFA and supervised?

Do you have a written incident response procedure naming who decides, who investigates and who informs the supervisor, customers and partners, and has it been rehearsed in the last 12 months?

Can staff easily report a suspected incident or phishing message, and do they know how?

Do all staff, including branch staff and agents, receive security awareness training at least once a year?

Do you run simulated phishing exercises and follow up with staff who fall for them?