Risk Management in Technology Policy Document Updates

This document is a technical report detailing the revisions made to Bank Negara Malaysia’s Risk Management in Technology (RMiT) Policy Document, issued in November 2025. The updates aim to enhance accountability, broaden coverage, and strengthen resilience within organizations. The report outlines specific action points that organizations should undertake to improve proactive risk management, focusing on technology and cyber resilience. Key updates include prescriptive obligations for capacity planning, continuous vendor risk monitoring, and the establishment of a Technology Architecture Framework to integrate security throughout the system development life cycle. The document also emphasizes the importance of board-level engagement in cybersecurity and requires mandatory identification of critical technology functions. Enhanced measures for fraud detection and customer protection are introduced, along with continuous monitoring of cybersecurity threats and vulnerabilities. Overall, the revisions reflect a significant shift towards a proactive, risk-informed approach to technology management in the financial sector.