Nepal Bank — Deputy Manager (Level 7): IT / MIS

Subject: Information Technology, MIS and Cyber Law

---

1. ITMIS Concept, Scope

Management Information System (MIS) is an organised combination of people, hardware, software, communication networks and data resources that collects, transforms and disseminates information in an organisation to support decision-making, coordination and control.

ITMIS = the IT infrastructure and systems that deliver management information. It is the application of information technology to management information systems.

Concept — three pillars:

Characteristics: management-oriented, integrated, need-based, exception reporting, future-oriented, uses internal + external data.

Scope / functional areas:

• Transaction Processing System (TPS) — daily deposits, withdrawals, remittances
• MIS — periodic reports to branch/department managers
• Decision Support System (DSS) — loan appraisal, credit scoring, what-if analysis
• Executive Information System (EIS) — dashboards for CEO/Board
• Accounting & Financial IS — GL, trial balance, financial statements
• HRIS, Marketing IS, Manufacturing IS
• Office Automation System — word processing, e-mail, scheduling
• Knowledge Management / Expert Systems — AML rules, fraud detection

In banking: Core Banking System (CBS), ATM/POS switch, mobile banking, internet banking, loan management, treasury, SWIFT, cheque clearing, NRB reporting (BFRS), AML/CFT screening.

---

2. System of Electronic Commerce

E-commerce = buying and selling of goods, services and information over electronic networks, mainly the Internet.

Types (systems):

E-commerce business models: e-shop, e-procurement, e-mall, e-marketplace, e-auction, virtual community, subscription, subscription-free (advertising).

Components: (i) consumer/business, (ii) public policy, (iii) technical standards, (iv) business partners, (v) support services (payment gateway, logistics, security).

Payment systems: credit/debit card, e-wallet (eSewa, Khalti, IME Pay), mobile banking, internet banking, QR code, connectIPS, RTGS.

Security requirements: authentication, authorisation, confidentiality, integrity, non-repudiation, availability. Tools — SSL/TLS, digital signature, PKI, OTP, 2FA, encryption, firewall.

Benefits: 24×7 operation, wider market, lower cost, faster settlement. Limitations in Nepal: low digital literacy, poor connectivity in rural areas, trust deficit, weak logistics, card/e-wallet fraud.

---

3. Hardware

Computer hardware = the physical, tangible components of a computer system.

Classification:

1. Input devices — keyboard, mouse, scanner, MICR, OCR, OMR, barcode reader, biometric (fingerprint, iris), ATM card reader, cheque scanner, touch screen.
2. Processing devices — CPU (ALU + Control Unit + Registers), microprocessor, GPU, motherboard, chipset.
3. Storage devices
   • Primary: RAM (volatile), ROM/PROM/EPROM/EEPROM (non-volatile), cache
   • Secondary: HDD, SSD, pen drive, CD/DVD, tape, SAN/NAS storage
4. Output devices — monitor (LCD/LED), printer (laser, dot-matrix for passbooks, thermal for ATM receipts), plotter, speaker, card embosser.
5. Communication devices — NIC, modem, router, switch, hub, repeater, gateway.

Key units: bit → byte → KB → MB → GB → TB. Clock speed in GHz; bus width in bits.

Banking-specific hardware: servers (application, database, ATM switch), ATMs, cash recyclers, cheque scanners, passbook printers, biometric attendance, UPS, generators, core switches, firewalls, encrypted PIN pads.

Selection criteria: capacity, speed, compatibility, scalability, vendor support, cost, warranty, power/backup requirement, security certification.

---

4. Operating System and Software

Software = a set of programs and related data that instructs hardware what to do.

Types of software:

Operating System (OS) = system software that acts as an interface between user and hardware and manages resources.

Functions of OS:

• Process management (scheduling, CPU allocation)
• Memory management (allocation, paging, virtual memory)
• File management (create, store, retrieve, permissions)
• Device management (drivers, I/O, spooling)
• Security & access control (user accounts, passwords, audit logs)
• User interface (CLI / GUI)
• Error detection and job accounting

Types of OS: batch, multiprogramming, multitasking, time-sharing, real-time (RTOS), distributed, network, mobile.

Common OS in banking: Windows Server, Red Hat Enterprise Linux, IBM AIX, Oracle Solaris; client side Windows 10/11; mobile Android/iOS.

Software acquisition: off-the-shelf (COTS), custom-built, open source, SaaS/cloud. Evaluation — functionality, scalability, security, TCO, vendor stability, source-code escrow.

---

5. Database Management System (DBMS)

DBMS = software that stores, retrieves, manages and controls access to a database, providing an interface between users/application programs and the data.

Examples: Oracle, MS SQL Server, MySQL, PostgreSQL, DB2, MongoDB (NoSQL).

Advantages: controlled redundancy, data consistency, data integrity, data independence, shared data, security, backup & recovery, concurrent access, standard enforcement.

Disadvantages: cost, complexity, single point of failure, DBMS overhead, need for trained DBA.

Components: DDL, DML, query processor, data dictionary, storage manager, transaction manager.

Architecture: three-level — external (views), conceptual (logical), internal (physical); provides logical and physical data independence.

Data models: hierarchical, network, relational (tables, rows, columns, keys), object-oriented, NoSQL.

Keys: primary, candidate, alternate, foreign, composite, super.

Normalisation: 1NF (atomic values), 2NF (no partial dependency), 3NF (no transitive dependency), BCNF. Purpose — remove redundancy and update/insert/delete anomalies.

ACID properties: Atomicity, Consistency, Isolation, Durability.

In banking: customer master, accounts, transactions, loans, cards, GL — all in relational databases; data warehouse for MIS reporting.

---

6. Database Recovery Method

Recovery = restoring the database to a consistent state after a failure and ensuring no committed transaction is lost.

Types of failure: transaction failure (logical error, deadlock), system crash (power/OS failure), media failure (disk crash), communication failure.

Storage types: volatile (RAM), non-volatile (disk), stable (mirrored/RAID, tape).

Recovery techniques:

1. Log-based recovery — a log records every change (TID, before-image, after-image).
   • Deferred update (NO-UNDO/REDO): updates written to DB only after commit → only REDO needed.
   • Immediate update (UNDO/REDO): updates written before commit → UNDO uncommitted, REDO committed.
2. Shadow paging — maintain current page table and shadow page table; on commit, switch pointer. No log needed but costly for large databases.
3. Checkpoint — periodically flush log and DB buffers, record a checkpoint; recovery then scans only from the last checkpoint, reducing time.
4. Backup & restore — full, incremental, differential backup; used for media failure.
5. Mirroring / RAID — RAID 1, RAID 5, RAID 10 for disk-level redundancy.
6. Replication / clustering — standby server, failover (active–passive, active–active).

Recovery algorithm (log-based, immediate update):

1. Scan log from last checkpoint.
2. Build UNDO list (transactions without COMMIT) and REDO list (with COMMIT).
3. UNDO all transactions in UNDO list using before-images.
4. REDO all transactions in REDO list using after-images.

In banking: CBS uses log-based recovery with checkpoints, plus daily full backup and transaction log backup; DR site for business continuity.

---

7. IT-Risk Analysis

IT risk = the possibility of loss or adverse impact arising from threats exploiting vulnerabilities in IT assets.

Risk formula: $\text{Risk} = \text{Threat} \times \text{Vulnerability} \times \text{Impact}$ (also expressed as Risk = Probability × Impact)

Components: asset, threat, vulnerability, likelihood, impact, control.

Types of IT risk:

• Strategic — wrong technology choice
• Operational — system downtime, human error
• Security — hacking, malware, insider fraud
• Compliance/legal — breach of NRB directives, cyber law
• Financial — fraud loss, penalty
• Reputational — loss of customer trust
• Business continuity — disaster, single point of failure
• Third-party/vendor — outsourcing failure

Risk analysis process:

1. Asset identification & classification (hardware, software, data, people, premises)
2. Threat identification (internal/external)
3. Vulnerability assessment (VA scan, penetration test, audit)
4. Risk identification
5. Risk analysis — qualitative (High/Medium/Low matrix) and quantitative (SLE, ARO, ALE)
   • $\text{SLE} = \text{Asset Value} \times \text{Exposure Factor}$
   • $\text{ALE} = \text{SLE} \times \text{ARO}$
6. Risk evaluation — compare with risk appetite
7. Risk treatment — Avoid, Reduce/Mitigate, Transfer (insurance, outsourcing), Accept
8. Monitoring & review

Controls: preventive (firewall, access control, encryption), detective (IDS, logs, audit), corrective (backup, DR, patch).

Standards/frameworks: ISO/IEC 27001/27002, ISO 31000, COBIT, ITIL, NIST.

---

8. Local Area Network and Wide Area Network

LAN (Local Area Network) — a network covering a small geographical area such as a room, building or campus.

Characteristics: high speed (100 Mbps–10 Gbps), low error rate, privately owned, low cost, short distance (up to ~1 km).

Topologies: bus, star, ring, mesh, tree, hybrid. Media: UTP/STP, coaxial, fibre. Devices: switch, hub, NIC, access point. Standards: Ethernet IEEE 802.3, Wi-Fi IEEE 802.11.

WAN (Wide Area Network) — a network covering a large geographical area such as a country, continent or the whole world.

Characteristics: lower speed relative to LAN, higher error rate, owned by telecom/ISP, long distance, higher cost. Example: the Internet; bank's branch network across Nepal.

Devices: router, modem, CSU/DSU, WAN switch. Technologies: leased line, MPLS, VPN, Frame Relay, DSL, 4G/5G, satellite.

Comparison:

In banking: branch LAN connects teller PCs, printers and ATMs; WAN connects all branches to the Data Centre for CBS, ATM and mobile banking transactions. Security via firewall, VPN, IDS/IPS.

---

9. Word, Excel, PowerPoint

MS Word — word processor for creating, editing, formatting and printing documents. Features: formatting (font, paragraph, styles), tables, mail merge, headers/footers, page setup, spell check, track changes, templates. Bank use: circulars, letters, loan agreements, board minutes, reports.

MS Excel — spreadsheet for calculation, analysis and charting. Features: cells/rows/columns, formulas and functions (SUM, IF, VLOOKUP, PMT, NPV, IRR), relative/absolute referencing, sorting & filtering, pivot tables, charts, what-if analysis, data validation. Bank use: loan EMI schedules, interest calculation, budget, branch performance MIS, reconciliation.

MS PowerPoint — presentation software. Features: slides, layouts, themes/templates, animations, transitions, charts, slide master, speaker notes. Bank use: board presentations, product launches, training, quarterly performance review.

---

10. Cyber Crime and Its Control

Cyber crime = any illegal act committed using a computer, network or the Internet as a tool, target or both.

Types:

• Against persons: e-mail harassment, cyber stalking, identity theft, cyber bullying, defamation, phishing
• Against property: hacking, malware (virus, worm, trojan, ransomware), DoS/DDoS, data theft, card fraud, ATM skimming, software piracy
• Against government/organisation: cyber terrorism, website defacement, espionage, unauthorised access to CBS

Common banking cyber crimes: phishing, vishing, SIM swap, card cloning, ATM skimming, ransomware, insider fraud, business e-mail compromise.

Control measures:

Electronic Transactions Act, 2063 (2008) — main cyber law of Nepal. Key provisions:

• Sec. 3 — authentication of electronic records
• Sec. 4 — digital signature
• Sec. 45 — unauthorised access to computer material
• Sec. 46 — damage to computer/electronic record
• Sec. 47 — unauthorised access to computer to commit offence
• Sec. 48 — publication of illegal material
• Sec. 49 — computer fraud
• Sec. 50 — deletion/alteration of source code
• Sec. 51 — misuse of electronic signature
• Sec. 52 — cyber stalking
• Sec. 53 — publication of false information
• Sec. 54 — violation of privacy
• Sec. 56 — obscene material
• Sec. 57 — offences against morality
• Sec. 58 — reporting of offences
• Sec. 59 — punishment: fine up to Rs 2,00,000 and/or imprisonment up to 3 years depending on offence; aggravated cases up to 5 years.

Also relevant: National Penal Code 2074, Privacy Act 2075, NRB IT Guidelines / IT Policy 2072, National Cyber Security Policy 2076.

---

11. IT Policy and Cyber Law in Nepal

IT Policy 2072 (2015) — "Information Technology Policy, 2072" of the Government of Nepal. Objectives:

• Develop IT as a priority sector
• Expand broadband and rural connectivity
• Promote e-governance and digital service delivery
• Develop skilled IT human resources
• Ensure cyber security and data privacy
• Encourage IT industry, outsourcing and export

Key IT-related laws and policies in Nepal:

NRB IT Directives for BFIs (key requirements):

• Board-approved IT policy and IT strategy
• IT Steering Committee and IT Security Committee
• Chief Information Officer / IT Head
• Segregation of duties; maker–checker
• Data centre with redundancy; DR site with RPO/RTO targets
• Annual IT audit, VA/PT, BCP testing
• Customer data confidentiality; reporting of cyber incidents to NRB
• Outsourcing due diligence and vendor risk management

Cyber law in Nepal — key features:

• Legal validity of electronic records and digital signatures
• Licensing of Certifying Authorities (CA) by the Controller of Certifying Authorities
• Criminal liability for unauthorised access, damage, fraud, stalking, privacy violation
• Adjudication by courts; IT Tribunal provisions
• Extraterritorial application for offences affecting Nepal

---

12. Local Area Network and Wide Area Network — Banking Application (Summary)

Security architecture: firewall at perimeter, DMZ for web servers, VLAN segmentation, IPS, encrypted VPN tunnels, endpoint protection, SIEM monitoring, 2FA for remote access.

---

13. Word, Excel, PowerPoint — Bank Use Cases (Summary)

---

14. Cyber Crime Control — Framework (Summary)

---

15. IT-Risk Analysis — Quantitative Example

Given:

• Asset value (AV) = Rs 50,00,000 (core banking server)
• Exposure factor (EF) = 40%
• Annual rate of occurrence (ARO) = 0.5

Formula: $\text{SLE} = \text{AV} \times \text{EF}, \quad \text{ALE} = \text{SLE} \times \text{ARO}$

Substitution: $\text{SLE} = 50{,}00{,}000 \times 0.40 = \text{Rs } 20{,}00{,}000$ $\text{ALE} = 20{,}00{,}000 \times 0.5 = \text{Rs } 10{,}00{,}000$

Result: Annualised Loss Expectancy = Rs 10,00,000. If a control costs less than this, it is cost-justified.

---

16. Database Recovery — Log-Based Example

Given: Transactions T1, T2, T3; checkpoint taken; T1 and T3 committed, T2 not committed at failure.

Log (simplified):

Recovery:

• UNDO list = {T2} → roll back using before-images
• REDO list = {T1, T3} → roll forward using after-images

Result: Database restored to consistent state; committed transactions preserved, uncommitted transaction undone.

---

17. Key Definitions (Quick Revision)

---

18. Important Nepali Laws — Quick Reference

---

19. Abbreviations

---

20. Model Long-Answer Question

Q. Explain the concept and scope of ITMIS in a commercial bank. Also describe the IT risk analysis process and the major cyber laws applicable to banks in Nepal.

Answer:

Concept of ITMIS: ITMIS is the integration of information technology with management information systems to collect, process, store and disseminate information for managerial decision-making. In a commercial bank, ITMIS supports transaction processing, reporting, risk management, customer service and regulatory compliance.

Scope in a bank:

1. Transaction processing — deposits, withdrawals, remittances, clearing, ATM/POS, mobile banking.
2. Management reporting — daily position, branch performance, NPL, deposit/credit mix, ALM reports.
3. Decision support — credit scoring, loan pricing, product profitability, what-if analysis.
4. Customer relationship management — 360° customer view, cross-selling, complaint handling.
5. Risk and compliance — AML/CFT screening, KYC, Basel reporting, NRB returns.
6. HR and administration — payroll, attendance, training, procurement.
7. Business continuity — backup, DR site, incident management.

IT risk analysis process:

1. Asset identification and classification.
2. Threat and vulnerability identification (VA/PT, audit).
3. Risk identification and analysis — qualitative (risk matrix) and quantitative (SLE, ARO, ALE).
4. Risk evaluation against risk appetite.
5. Risk treatment — avoid, reduce, transfer, accept.
6. Monitoring, review and reporting to the Board/IT Security Committee.

Cyber laws in Nepal:

• Electronic Transactions Act, 2063 (2008) — legal recognition of electronic records and digital signatures; offences of unauthorised access (Sec. 45), damage (Sec. 46), computer fraud (Sec. 49), cyber stalking (Sec. 52), privacy violation (Sec. 54); penalties up to Rs 2,00,000 and/or imprisonment.
• Electronic Transactions Rules, 2064 — licensing of Certifying Authorities.
• Privacy Act, 2075 — protection of personal data of customers.
• Payment and Settlement Act, 2075 — regulation of payment systems and e-wallets.
• NRB IT Directives — mandatory IT governance, audit, DR and incident reporting for BFIs.
• National Cyber Security Policy, 2076 — national strategy for cyber security.

Conclusion: A commercial bank must implement a robust ITMIS with strong IT risk management and full compliance with Nepal's cyber laws to ensure confidentiality, integrity, availability and customer trust.