PHYSICAL AND ENVIRONMENTAL SECURITY IT SECURITY EXAM

PHYSICAL AND ENVIRONMENTAL SECURITY



It is generally accepted that, when it comes to protecting information resources from a physical perspective (i.e. where we are protecting tangible assets that one can touch, kick, steal, drop, etc.,), the name of the game has to be about convincing a perpetrator that the cost, time and risk of discovery involved in attempting unauthorised access to information or equipment exceeds the value of the gains thus made.



Physical security is not a modern phenomenon - it exists to deter or prevent unauthorised persons from entering a physical facility or stealing something of perceived value. The safety of personnel should not be overlooked in this respect.



Little has changed over the centuries when it comes to protecting property, with locked doors/chests, armed security guards, booby-traps, etc.

IS Governance

Information Security Committee

The role of the Information Security committee is to devise strategies and policies for the protection of

all assets of the bank (including information, applications, infrastructure and people). The committee

will also provide guidance and direction on the Security Implications of the business continuity and

disaster recovery plans.

Develop and facilitate implementation of information

security policies, standards and procedures to

ensure that all identified risks are managed within

the bank's risk appetite.

Create an information security and risk management

structure covering the entire bank, with clearly

defined roles and responsibilities.

Create and follow a risk assessment process that is

consistent across the bank to identify, evaluate key

risks and approve control measures and mitigation

strategies.

Regularly monitor the information security and risk

management processes and corrective actions to

ensure compliance with regulatory requirements.

Ensure that the Information Security Team is

appropriately skilled and adequately staffed.

Regularly present reports to the Board and invite feedback on the information security

management processes.

Corporate IT Security Policy

Corporate IT Security Policy Significant technological advances have changed the way we do business. That is, the internet, email, and text messages have virtually replaced faxes, letters and telexes in the corporate world. The internet to used to obtain information and efficiently communicate with clients, business associates, and partners. While internet usage comes with numerous advantages such as the speed of communication and an increase in the bottom line, it also contains several drawbacks that can seriously hinder business productivity and growth. For example, personnel can use the internet as a distraction to peruse their Facebook, Twitter, and Instagram accounts, shop on Amazon or eBay, check the latest sports statistics, exchange personal emails with colleagues, friends, and so on. These activities not only heighten the risk of incoming malware, but also lower employee productivity and revenue. Therefore, devising a corporate IT security policy will help to mitigate the negative consequences associated with internet use – and email specifically. The “nuts and bolts” of an IT security policy

MSME Very important MCQs

 MSME Very important  MCQs
1. Which sector TUF applies to? a)Textile* b)Shoe manufacture, c)Food processing,
d)Glass manufacture
2. Which one of the following institution has initiated Project uptech scheme?
a)SIDBI, b)SBI*, c) IDBI, d)TIFAC
3. Market failure refers to : a) Imperfect markets, b)Perfect markets*, c)Traditional
markets
d)Both (a) and (b) above

4. Which one of the following factors is not included in the Market Gap?
a)Innovations, b)Lack of capital, c)Lack of premises, d)Technology*
5. BDS Supervisor is known as : a) Facilitator, b)Team Leader, *c) Correspondent ,
d)Group leader
6.Under the Revised RBI Guidelines on Priority Sector Lending, loans to food and agro
processing units are classified under a) Agriculture *b) MSME c) Others d) None
7. Under the Revised RBI Guidel ines on Priority Sector Lending, loans to
medium enterprises are not included for the purpose of reckoning of advances
under the priority sector. a) True b) False*
8. Bank loans up to per unit to Micro and Small Enterprises and to Medium
Enterprises under services sector are classified under priority sector. a) Rs 5 and 10
crore* b) Rs 10 and 15 crore c) Rs 10 and 5 crore d) Rs 15 and 10 crore
9. The quantum of loan limit under the revised General Credit Card (GCC) Scheme is
a) 1 lakh b) 2 lakh c) 5 lakh d) no ceiling on the loan amount*
10.The maximum claim settlement under Credit Guarantee Trust Scheme for Micro and
Small Enterprises (CGTMSE) is at Rs lakhs. a) 50 b) 62.5 c) 75 d) 200*
11. MSME loans covered under Guarantee Fund Trust for Micro and Small Enterprises
(CGTMSE) attracts risk weight for capital adequacy purpose: a) Five b) Fifty c)
Hundred d) Zero*
12. Provisioning requirements in respect of Standard Assets under Direct Advances to
agriculture and SME Sectors : a) A general provision of 0.1% of total outstanding
b) A general provision of 0.25% of total outstanding,* c) A general provision of
0.4% of total outstanding d) No provision is required to be made
13. The rate of subsidy under PMEGP scheme ranges from ___% to ___% : a) 10&
15 b) 15 & 20 c) 15 & 35* d) 20& 40
14. Advances to MSMEs up to Rs crore may be done on the basis of credit scoring
model.
a) 1 b) 2* c) 3 d) 4
15. The Chairman of Committee on Financial Architecture for Micro, Small and
Medium Enterprises (MSME) sector set up by Government of India is
a) M V Nair b) K C Chakrabarty c) UshaThorat d) K V Kamath*
16. The small finance bank shall primarily undertake finance to the following entities
a) unserved and underserved sections ,b)small business units, c) unorganized
sector ,d) micro and small industries, e) all the above*
17. MUDRA stands for : a)Metropolitan and Urban Development Regulatory Authority
b)A scheme under Ministry of AYUSH
c)Micro Units Development and Refinance Agency* ,d)None of the above
18. As per RBI guidelines, a MSME unit is treated as sick when
a) any of the borrowal account of the enterprise remains NPA for three months or
more
b) There is erosion in the net worth due to accumulated losses to the extent of 50% of its net
worth, c) Any of the borrowal account of the enterprise remains NPA for 6 months or more. d) a and b*
19. Micro (manufacturing) enterprises are defined as those whose original investment in Plant and
machinery do not exceed Rs. ... a) 5 lakhs b) 10 lakhs c) 25 lakhs *d) 50 lakhs
20. Under the proposed MSMED Amendment Bill, 2014, the revised investment limit in plant and
machinery for micro (manufacturing) enterprises is at Rs
a) 25 lakhs b) 50 lakhs *c)75 lakhs d)100 lakhs


21. Under the Debt Restructuring Mechanism for MSMEs, the following entities will be considered.
a) All non-corporate MSMEs irrespective of the level of dues to banks.
b) All corporate MSMEs, which are enjoying banking facilities from a single bank, irrespective of the
level of dues to the bank.
c) All corporate MSMEs, which have funded and non-funded outstanding up to Rs.10 crore under
multiple/ consortium banking arrangement, d)All the above*
22. The Code of Bank's Commitment to MSE's which set minimum standards of banking and practices
for banks to follow when they are dealing with MSEs has been formulated by a)BCSBI* b) SIDBI c)
RBI d) GOI
23. Which agency provides subsidy for credit rating of SMEs
(a) SIDBI (b) DIC (c) NSIC *d) SMERA
24. Banks are mandated not to accept collateral security in the case of loans upto Rs. extended to units
in the MSE sector. a) 25 lakh b) 10 lakh* c) 5 lakh d) 1 lakh

25. The quantum of loan limit under the revised General Credit Card (GCC) Scheme is
a) 1 lakh b) 2 lakh c) 5 lakh d)no ceiling on the loan amount*
26. The concept of teaching adults is called : a) Anagogy, b) Andragogy*, c) Pedagogy, d) Mystagogy
27. An individual needs the following to perform a task (i)
Knowledge (ii) Skill (iii) Attitude iv) All of these*
28. The first step in training design is the identification of a) Trainee b) Training Needs*
c) Training Institution d) Training Materials
29. Active Methods of Training are, a)Lecture, b)Group Discussion, c) Demonstration, d)Case Study
i) a,b,c ii) b,c,d iii) b,d* iv) a,b,c,d
30. Training can solve all performance problems : a) True b)False*
31. Make in India programme aims : a) To increase GDP growth b) To increase tax revenue.
c) Aims at high quality standards, d) Minimizethe impact on the environment, e) All of these*
32. Governing Council of Skill India Mission is Chaired by a) MSME Minister b) Finance Minister
c) Prime Minister* d) Deputy Chairman of NITI Ayog
33. What is eBiz?
a) A single window IT platform for services of all Central GovtDepts and Ministries**
b) A single window IT platform for services of all State GovtDepts and Ministries
c) A single window IT platform for services of all International Agencies ,d) None of these
34. What is NICDA?
a) National Institute for Coal Development Authority
b) National Industrial Corridor Development Authority**
c) National Information Centre for Data Administration , d) None of these
35. TReDS stands for
a) Treasury Rupee Dealing System
b) Trade Remittance and Discounting System
c) Trade Receivables Discounting System, **d) None of these
36.The total loans and advances extended by commercial banks to Micro
and Small Enterprises for 2014-15 is:a) Rs.8,461 bn, b)Rs.6,872 bn, c) Rs.25,229bn, d)Rs.9,645bn**
37.Small Finance Banks can lend to :
a)Small business units b) MSEs c)Unorganized Sector d)All of these**
38.Ministries/ Govt departments/PSUs to source % of their requirements from MSE units.
a) 10 b)15 c)20** d)5
39.The implementing agencies of CLCSS are : a)SIDBI, b)NABARD c)SIDBI & NABARD d)RBI &**
SIDBI
40.UNIDO has identified industrial clusters for development
a)450 b)288 c)388 **d)121
41.As per MSMED Act, time limit for buyer to make payment to MSMEs is,
a) 60 days b)180 days c)90 days d)45 days**
42.Maximum claim amount settled for micro enterprises with loan upto
Rs.5.00 lakh under CGTMSE is: a)85% *b)80% c)75% d)50%
43.Application for guarantee cover should be lodged with CGTMSE within of loan sanctioned.
A )Next months b) next quarter** c) within six months d) no time limit
44.Pre-requisites for lodging claims with CGTMSE are,
a) Guarantee Cover is in force , b) Account classified as NPA ,c) Recall Notice issued
d) Lock-in period expired**, e) Recovery proceedings initiated : i) a&b, ii)a,b,c iii) a,b,c,d iv)All
45. Debt equity ratio is:

a) Total outside liability/ Tangible Net Worth**
b) Long Term Liabilities/Tangible Net Worth ,c) Both the above , d) None of the above
46. A very high debt equity ratio means the unit is :
a) Having more own funds than outside liabilities**
b) Having more outside liabilities than own funds
c) Having funds surplus ,d) Having no equity at all
47. The debt-equity ratio of a firm has increased (increase in long term sources) along with its current
ratio. Which of the following is certainly true?
a) Sources of funds have been utilised for purchase of fixed assets
b) Sources of funds have been used for payment of current liabilities
c) Sources of funds have been used for payment of current assets ,d) (b) & (c) both**
48. Debt service coverage ratio is (DSCR) :
a) Profit after tax + depreciation - interest on term loan/annual term loan instalment + interest on
term loan
b) Profit before depreciation and Interest / Interest and annual instalment of Term Loan***
c) Profit/debt, d) None of the above
49.Desirable current ratio for a borrower is: a) 1:1 b) 1.33:1 **c) 2:1 d) None of the above
50. If current ratio is above 2:1, it generally means that the firm :
a) Has very high investment in current assets
b) Does not require working capital from the Bank
c) Liquidity is very high , d) All the above**
51. Quick Ratio is:
a) Other name of acid test ratio**
b) Equal to quick assets: quick liabilities
c) Both the above ,d) None of the above
52. Assets turnover ratio of a company is increasing, which indicates:
a) Low capacity utilisation
b) Better capacity utilisation**
c) Increase in liquidity d) None of the above
53. The term Quasi Equity refers toa)
unsecured loans from friends and relatives**
b) unpaid share capital c) capital reserve, d) all of the above
54. An overdraft/cash credit account is considered as NPA if t remains
a) Out of order for more than 90 days **, b)Out of order for more than 180 days
c) Out of order for more than 270 days, d) Out of order for more than 360 days
55. The Standard Provision for MSME loans prescribed by RBI is: a)0.40% b)0.25%**, c)1.00%
d)0.75%
56. SMEs are important for the nation's economy because they significantly contribute to:-
industrial production ,b )exports, c) employment, d) innovation, e) all above**
57. The minimum and maximum members that can exist in a partnership firm are
___________ & _________ : a)2 & 10, b) 2 & 100,** c)2 & 30, d) 2 & 50, e)No restriction
58. Public Ltd Company has minimum shareholders :a)50, b)20, c)100, d)7**
59. MSMED Act was enacted in ________ :a) 2005, b)2008, c)2006**, d)2010
60.Which one of the following activities is not included in Micro & Small (Service)
Enterprises? : a)Professional persons, b)Small business, c)Dairy***, d) Self employed persons
61.PPP denotes ________ :a) Private Public Participation, b) Promoter Partner Participation
c) Public Private Participation,*** d) Partner Private Public

62. Which one of the following stages of development of SMEs regulations are not required?
a)Entry stage, b) Operational stage, c) Manufacturing stage,*** d)Implementation stage
63. LLP stands for _________: a)Long term Liability Participation, b) Limited Liability Partnership**
c) Legitimate Liability Partnership, d)Liability Limited Partnership

64. Composite Loan limit for SSI that can be sanctioned without security is Rs.__: a)1 Mn. , b)2.5 **Mn.
c) 50,000/-, d) Any limit
65. What is the minimum and maximum number of participants in LLP? :a)2, 50, b) 2, 20
c) 2, 100, d)2, unspecified*
66. The organizational set up of SSI came into being in : a)1950 **, b)1954, c) 1969 , d)1975
67. Which one of the following support services are not provided by MSME DO?
a)Training for entrepreneurship development, b)Financial assistance,** c)Tool making
d) Preparation of project and product profiles
68. EDIs stands for ________: a)Export Development Institute, b)Entrepreneurship
Development Institute, **c)Entrepreneurship Development of India, d)Entrepreneurship Design
Instruments
69. Which one of the following organizations is not under the control of the State Government?
a) Directorate of Industries, b)District Industries Centre, c) Technical Consultancy Organization
d)EDII*
70. What is the maximum amount of guarantee available for Micro Enterprise upto credit limit of
Rs. 5.00 Lakh? : a) Rs. 5.00 Lakh**, b)Rs. 3.75 Lakh, c)Rs. 2.50 Lakh, d) Rs. 4.25 Lakh
71. What is 'hurt money'? :a) Equity (***b)Loan, c) Debt d) Venture Capital
72. Hybrid Capital means: a) Equity+ debt,** b)Debt+ loan,
c)Equity+ Venture capital, d)Insurance+ credit card
73. Venture Capital means: a)High Risk Fund, b)Private equity,
c) Dedicated pools of capital privately held,*** d)Share capital
74. Pre-shipment credit refers to : a)Financing ships for export ,b)Payment to supplier before shipment
of goods, c)Working capital finance to enable the exporter to procure material for export,***
d)Financing for repairs to ships
75. Post Shipment Credit refers to: a) Financing the shipping companies, b)Credit posted after shipping
the goods, c)Working capital finance from the time of export to the time of actual***
realization of dues , d) Loans and Advances against documents covering shipment of goods.
76.The objective of Make in India programme is,
a) to encourage companies to manufacture their products in India**
b) to encourage foreign companies to manufacture their products in India
c) to encourage companies to manufacture their products in India and export abroad
d) to encourage companies to manufacture their products in India for domestic markets
77. The Make in India Programme is focusing on sectors of the economy for job creation and skill
enhancement : a) 10 sectors b) 17 sectors c) 22 sectors d) 25 sectors**
78. MSE credit by scheduled commercial banks as per cent of ANBC as at the end of March 2014 stood
approximately at a) 15.0 **b) 30.5 c) 50.5d) 75.5
79. As per 4th NSSO survey, extent of financial exclusion in MSME sector is around
a) 25% b) 50% c)75% d) 93%**

80. Under the Revised RBI Guidelines on Priority Sector Lending,the sub-target for lending to micro
enterprises is fixed at a) 8% b) 9% c)7.5%** d) 7.0%
81. Which one of the following is not a characteristic of a successful cluster? : a) Inter-firm cooperation
b)Cooperation blended with competition , c) Sectoral specialization d)Sharing of capital resources*
82. Which one of the following approaches is not applicable in respect of MSMEs? a) Work together
b)Produce together goods and services, c) Share benefits individually **d)Come together
83. Which one of the following steps is not involved for launching a Cluster Development project?
a) Identification of cluster, b)Capacity building,** c) Creation of cluster, d)Formulation of final selection
84. UNIDO Projects evolve following various steps for promoting networking and development.
i) Mapping the competitiveness, ii)Assisting the cluster's actors for efficient supply chain management
Capacity building , iii) Providing advisory services, iv) Setting special financial institutions for SMEs
a) (i), (iii), (iv), (v) is correct, b)(ii), (iii), (iv), (i) is correct**
c) (iii), (v), (iv), (ii) is correct, d) (v), (i), (ii), (iv) is correct
85. UNIDO stands for : a)United Nations Institution Development Organisation
b)United Nations Innovative Design Organisation
c) United Nations Industrial Development Organisation,** d) None of the above
86. Rehabilitation of a sick unit can be taken up if it : a)creates employment, b) is a profitable unit
c) proves viable after rehabilitation,** d)repays all outstanding dues immediately.
87. Viability should be examined and approved by: a)State level Inter-institutional Committee, b) The
concerned Bank, **Commissioner of Industries of the State Government, d)Association of Sick
Industries

88. OTS scheme refers to : a)Sanctioning of ad hoc limits to the Sick Units, b) Settlement of all
outstanding dues as on a specified date as agreed to between the Bank and the Borrower,***
c) Sanction of rehabilitation package, d)Consortium lending of banks to the sick unit.
89. What is NICDA?
a) National Institute for Coal Development Authority
b) National Industrial Corridor Development Authority**
c) National Information Centre for Data Administration , d) None of these
90.. Securitization means: (Tick appropriately) : a) Pooling of financial assets for forming into a
scrip for sale in a financial market, *b) Pooling of loans of a single borrower, c) Converting loans to
capital of banks, d)Arranging for repayment of dues
91. Which one of the following features of Microfinance is incorrect? : a) Borrowers are from low
income group, b)Long duration loans, ***c)Loans without collaterals, d) High frequency of repayment
92. Relationship banking allows several special contractual features as under:- i) Discretion
,ii)Flexibility
iii) Inclusion of collateral requirements, iv) Decision, v) Use of covenants
a) (i), (ii), (iii) (iv) is correct , b)(ii), (iii), (iv), (v) is correct
c) (v), (iii), (i), (ii) is correct, ***d) (iv), (v), (iii), (i) is correct
93. Which one of the following grey areas of concern for growth is not related to Microfinance sector?
a) Regulation, b)Pricing, c) Cluster formation, d) Technology**
94. Which one of the following factors is not related to pricing?
a) Character of the customer,** b)Elasticity of demand, c) Cost structures, d)Economic conditions
95. SMEs are facing various challenges under WTO regime as under:- i) Technology, ii) Removal of
Quantitative Restrictions, iii) Funding through FDI/JVs, iv) Infrastructure, v)Quality of goods
a) (ii), (i), (v), (iv) is correct,** b) (i), (iii), (v), (ii) is correct, c)(iii), (v), (iv), (i) is correct
d) (iv), (v),(ii), (i) is correct

96 National Bank is maintaining a current account of a Public Trust with 4 trustees. Bank receives an
information that two of them have died in a road accident while going for a pilgrimage. The remaining
trustees now want to operate the account.
a bank would permit them to operate the account as they are now the surviving trustees
b bank will refuse the operations as the power was vested with all of them
c bank will examine the trust deed to determine the future course of action
d if the trust deed allows the surviving trustees to operate the
account they will be allowed. Otherwise the bank would insist on a direction from a competent court
e c and d both***
97. The Secretary of Seth Chanan Mal Public Trust, a reputed trust having 3 Trustees, has approached
you to open a saving bank account in favour of the Trust. While going through the Trust Deed
submitted alongwith the application you find that there is no provision for operation of the bank
account. What would you do under such circumstances ?
a the account would be allowed to be opened by the Secretary
b operation in the account will be allowed jointly with the Chairman of the Trust
c operation can be allowed against the joint signatures of all the Trustees***
d account will be opened only when the trust deed is modified.
e account cannot be operated in the absence of any provision
98. Ramesh and Ashok are trustees of a trust and execute a power of attorney in favour of Tarun.
Trust deed is silent regarding the delegation of power. Tarun comes to operate the account:
a Tarun can be permitted to operate the account
b Tarun can be permitted after obtaining consent of beneficiaries.
c Tarun cannot be permitted to operate.*
d Tarun can be allowed if credit balance is there. e b and d
99. Universal Bank is having a current account of Dhara Charitable Trust which is operated by their
two trustees. In road accidents, both the trustees expire and this fact comes to the notice of the bank.
What precautions should be taken by the bank for future operations in the account?
a the beneficiaries will have to appoint another trustee and on the basis of their resolution the
next trustee would be allowed to operate the account.
b the beneficiaries will be allowed to operate the account themselves.
c the operations in the account will be stopped
d the beneficiaries will be told to approach a court for appointment of new trustee in case the
trust deed is silent about this** e b and c
100. Your branch receives from the trustees of a trust, a resolution passed by the trustees resolving that the
current account would be operated by two out the three trustees, as the Td trustee is proceeding abroad. The
account is presently operated by all the three in terms of the trust deed.
a the bank will accept the resolution and the request and permit the remaining trustee to operate the
account, strictly as per the resolution.
b the bank will not accept the resolution since the Trust Deed provides for operation of
the account by all the three***
c the bank will not accept the resolution and will suggest for power of attorney to be given by the third
trustee.
d the bank will allow operations, since they are working as agents. e none of the above
101 A partnership firm with three partners, named M/s Durani Brothers opened a current account with
Corporate Bank with the operational instruction that 151 two partners will operate the account. The firm
received a cheque in its favour and in order to meet the urgent payment requirement, on behalf of M/s
Durani Brothers, the 3Ni partner endorsed the same in favour of another firm M/s Shivani Cables, from
whom the raw material was purchased:- a Shivani Cables will become holder in due course if it
is not known to them that the 3rd partners has no authority to endorse, b Shivani Cables will not
become holder in due course if they know that only 1st and 2nd partner have authority to operate the
bank account, c Shivani Cables's title will remain doubtful in all circumstances, d a and b,
e a to c***
102 Universal Bank has granted cash credit limit of Rs:10 lac to M/s Kale Traders, a partnership
firm. The account is showing a debit balance of Rs.9.50 lac when the notice is received about the
insolvency of one of the partners. Which among the following steps should be initiated by the bank to
safeguard its interest? a account should be recalled and party be asked to adjust the
account, b operations in the account to be stopped and balance confirmation letter to be
obtained from all the partners, c operations in the account to be stopped and notice of
demand to be issued on the remaining partners, d notice about the outstanding dues
to be sent to the official assignee in whom the estate of the insolvent partner has been vested,
e c and d above**
103 Your branch maintains a current account in the name of M/s Site Ram Gita Ram & Sons. A new
partner, the younger son of Mr. Gita Ram joins the firm and bank gets information about this
development. Which among the following actions would be more appropriate to deal with this
account:- A operations in the account should be stopped failing which the rule in Clayton case can
apply, B account should be closed and new account should be opened observing all formalities
C new partner can be admitted with the approval of the bank only. Hence the firm should be advised
to obtained permission from the bank, d bank can obtain new partnership declaration
letter and allow operations as per new mandate, **e bank can insist on for new partnership
deed duly registered with Registrar of firms
104 Two partners of a partnership firm M/s Hyderabad Trading Company with three partners,
approaches you to open a current account with initial deposit of Rs.10 lac and promise that the
signatures on the account opening, form shall be obtained on the return of 3rd partner from abroad,
although the said partner is not to actively engage himself in the business and he will function as a
dormant partner. They also do not have any partnership deed in writing.
A the bank will open the account as the 3rd partner is not to operate the account
B the bank will open the account and will not permit any withdrawaltill the 3rd partner signs the account
opening form C the account will be opened but cheque book will be given when the 3rd partner returns,
D the account will not be opened unless all the partners have signed, E none of the above**
105 Capital Bank maintains a current account of M/s Bihari Lal Sham Lai with the same name
partners having operating instructions as 'any one can operate'. Mr. Sham Lai informs the bank that
due to some dispute amongst the partners, the cheques signed by Mr. Bihari Lal should not be paid
as he has acquired the whole share from Mr. Bihari Lal and is shortly introducing another partner.
Meanwhile a cheque signed by Mr. Sham Lal is presented for payment. What should the bank do?
A The operations in the account will be stopped and the mandate for operation of the
account by any one, shall become inoperative, ***B The operations in the account will be stopped
only after receipt of the notice from both of them. C The cheque signed by Mr. Sham Lal shall be
passed since he has acquired the whole share now, D The partners will be advised to sort out the issue

PMEGP MSME

MSME::

Prime Minister’s Employment Generation Programme (PMEGP) is a credit linked subsidy programme administered by the Ministry of Micro, Small and Medium Enterprises, Government of India. Khadi & Village Industries Commission (KVIC), is the nodal agency at national level for implementation of the scheme. At state level the scheme is implemented through KVIC, KVIB and District Industries center.

Eligibility
Objective
To generate employment opportunities in rural as well as urban areas through setting up of self employment ventures.
To provide continuous and sustainable employment to a large segment of traditional and prospective artisans and unemployed youth, so as to help arrest migration of rural youth to urban areas.
Scope
The scheme is applicable to all viable (technically as well as economically) projects in rural as well as urban areas, under Micro enterprises sector.
The maximum cost of the project admissible under manufacturing sector is Rs.25 lakhs and business/services sector is RS.10 lakhs.
Only one person from family is eligible for obtaining financial assistance under the scheme.
Assistance under the Scheme is available only for new projects
The assistance under the scheme will not be available to activities indicated in the negative list under the scheme.
Eligible Entrepreneurs / Borrowers
Any individual, above 18 years of age
The beneficiaries should have passed at least VIII standard, for setting up of project costing above Rs.10 lacs in the Manufacturing Sector and above Rs. 5 lacs in the business /Service Sector,
Self Help Groups (including those belonging to BPL provided that they have not availed benefits under any other Scheme).
Institutions registered under Societies Registration Act,1860
Production Co-operative Societies
Charitable Trusts.
Note
Existing units (Under PMRY,REGP or any other scheme of Government of India or State Government) and the units that have already availed Government Subsidy under any other scheme of Government of India or State Government are not eligible.

Selection of beneficiaries
The beneficiaries will be identified & selected at the district level by a Task Force consisting of representatives from KVIC/State KVIB/ State DICs and Banks and headed by the District Magistrate / Deputy Commissioner / Collector concerned.

Subsidy Entitlement & Bank Finance
Subsidy from KVIC and the bank finance depends on the cost of project as per details given below :

Bank finance Subsidy from KVIC Promoter's contribution
Urban area Rural area
General Category beneficiary / institution 90% 15% 25% 10%
Special category beneficiary/institution 95% 25% 35% 5%
Security
Assets created out of the bank's finance.
Personal guarantee of the proprietor / promoter.
No collateral security up to Rs. 5 lakhs.
Eligible units will be covered under Credit Guarantee Fund scheme for Micro & small Enterprises – CGMSE. (excluding Margin Money / subsidy component)

Role of MSMEs

Worldwide, micro, small and medium enterprises (MSMEs) have been accepted as the engine of economic growth and for promoting equitable development. MSMEs constitute over 90% of total enterprises in most of the economies and are credited with generating the highest rates of employment growth and account for a major share of industrial production and exports.

In India too, the MSMEs play a pivotal role in the overall industrial economy of the country. MSMEs in India account for more than 80% of the total number of industrial enterprises and produce over 8000 value-added products. It is estimated that in terms of value, the sector accounts for 45% of the manufacturing output and 40% of the total export of the country and employs over 6 crore people.

Further, in recent years the MSME sector has consistently registered higher growth rate compared to the overall industrial sector. The major advantage of the sector is its employment potential at low capital cost. As per available statistics, this sector employs an estimated 6 crore persons spread over 2.6 crore enterprises and the labour intensity in the MSME sector is estimated to be almost 4 times higher than the large enterprises.


Problems of MSMEs

Despite constituting more than 80 % of the total number of industrial enterprises and supporting industrial development, many MSMEs in India have problems such as sub-optimal scale of operation, technological obsolescence, supply chain inefficiencies, increasing domestic and global competition, fund shortages, change in manufacturing strategies and turbulent and uncertain market scenario.

Focus of the Government

The Government is planning to increase financial assistance for micro, small and medium enterprises (MSMEs) to 80 per cent of their capital requirements in the 11th Five Year Plan. This aid will go towards technology upgradation and plugging of financial gaps. It will be available for existing MSME clusters.

Focus of Banks

Of late, several banks have focused on the MSMEs; in fact, some of them have launched specific funds to meet the capital requirements of MSMEs.

Rating of MSMEs

In spite of the increasing avenues of funding for MSMEs, credit penetration in this sector is still low. The primary reasons for this are insufficient credit information on MSMEs, low market creditability of SMEs and constraints in analysis. To tackle this problem, the SME Rating Agency of India (SMERA) was launched in 2005 by SIDBI in association with Dun & Bradstreet (D&B), Credit Information Bureau (India) Ltd and leading public and private sector banks.

Cluster Initiative

The concept of cluster development offers new insights into the potential role of MSMEs. It is estimated that there are about 400 MSME clusters in the country. A cluster may be defined as a local agglomeration of enterprises (mainly MSMEs) which produce and sell a range of related and complementary products and services. An example can be a localized leather industry, including leather tanning units, leather finishing units, leather goods producers, leather garment manufacturers, designers, sub-contractors, merchant buyers and exporters.

MSMEs-Success Story

In spite of the problems, the MSME sector has grown by leaps and bounds and has caught the fancy of corporate India. In fact, MSMEs fared better than most large organizations between 2001 and 2006. For example, the net profit of companies with a turnover of Rs. 50 crore–Rs. 100 crore appreciated by over 700 % in that period, compared to an increase of over 150 % in the net profit of large corporations. During the same period, MSMEs also outperformed large corporations in net sales and operating profits.

Basic Principles of Information Security:

Basic Principles of Information Security:

For over twenty years, information security has held confidentiality, integrity and availability (known as the CIA triad) to be the core principles. There is continuous debate about extending this classic trio. Other principles such as Authenticity, Non-repudiation and accountability are also now becoming key considerations for practical security installations.

 Confidentiality: Confidentiality is the term used to prevent the disclosure of information to unauthorized individuals or systems. For example, a credit card transaction on the Internet requires the credit card number to be transmitted from the buyer to the merchant and from the merchant to a transaction processing network. The system attempts to enforce confidentiality by encrypting the card number during transmission, by limiting the places where it might appear (in databases, log files, backups, printed receipts, and so on), and by restricting access to the places where it is stored. If an unauthorized party obtains the card number in any way, a breach of confidentiality has occurred. Breaches of confidentiality take many forms like Hacking, Phishing, Vishing, Email-spoofing, SMS spoofing, and sending malicious code through email or Bot Networks, as discussed earlier.

 Integrity: In information security, integrity means that data cannot be modified without authorization. This is not the same thing as referential integrity in databases.

Integrity is violated when an employee accidentally or with malicious intent deletes important data files, when he/she is able to modify his own salary in a payroll database, when an employee uses programmes and deducts small amounts of money from all customer accounts and adds it to his/her own account (also called salami technique), when an unauthorized user vandalizes a web site, and so on.

On a larger scale, if an automated process is not written and tested correctly, bulk updates to a database could alter data in an incorrect way, leaving the integrity of the data compromised. Information security professionals are tasked with finding ways to implement controls that prevent errors of integrity.

 Availability: For any information system to serve its purpose, the information must be available when it is needed. This means that the computing systems used to store and process the information, the security controls used to protect it, and the communication channels used to access it must be functioning correctly. High availability systems aim to remain available at all times, preventing service disruptions due to power outages, hardware failures, and system upgrades. Ensuring availability also involves preventing denial-of-service (DoS) and distributed denial-of service (DDoS) attacks.

 Authenticity: In computing, e-business and information security it is necessary to ensure that the data, transactions, communications or documents (electronic or physical) are genuine. It is also important for authenticity to validate that both parties involved are who they claim they are.

 Non-repudiation: In law, non-repudiation implies one's intention to fulfill one’s obligations under a contract / transaction. It also implies that a party to a transaction cannot deny having received or having sent an electronic record. Electronic commerce uses technology such as digital signatures and encryption to establish authenticity and non-repudiation.

In addition to the above, there are other security-related concepts and principles when designing a security policy and deploying a security solution. They include identification, authorization, accountability, and auditing.

 Identification: Identification is the process by which a subject professes an identity and accountability is initiated. A subject must provide an identity to a system to start the process of authentication, authorization and accountability. Providing an identity can be typing in a username, swiping a smart card, waving a proximity device, speaking a phrase, or positioning face, hand, or finger for a camera or scanning device. Proving a process ID number also represents the identification process. Without an identity, a system has no way to correlate an authentication factor with the subject.

 Authorization: Once a subject is authenticated, access must be authorized. The process of authorization ensures that the requested activity or access to an object is possible given the rights and privileges assigned to the authenticated identity. In most cases, the system evaluates an access control matrix that compares the subject, the object, and the intended activity. If the specific action is allowed, the subject is authorized. Else, the subject is not authorized.

 Accountability and auditability: An organization’s security policy can be properly enforced only if accountability is maintained, i.e., security can be maintained only if subjects are held accountable for their actions. Effective accountability relies upon the capability to prove a subject’s identity and track their activities. Accountability is established by linking a human to the activities of an online identity through the

security services and mechanisms of auditing, authorization, authentication, and identification. Thus, human accountability is ultimately dependent on the strength of the authentication process. Without a reasonably strong authentication process, there is doubt that the correct human associated with a specific user account was the actual entity controlling that user account when an undesired action took place.

IS AUDIT ...IT SECURITY

Introduction:

In the past decade, with the increased technology adoption by Banks, the complexities within the IT environment have given rise to considerable technology related risks requiring effective management.

This led the Banks to implement an Internal Control framework, based on various standards and its own control requirements and the current RBI guidelines. As a result, Bank’s management and RBI, need an assurance on the effectiveness of internal controls implemented and expect the IS Audit to provide an independent and objective view of the extent to which the risks are managed.

As a consequence, the nature of the Internal Audit department has undergone a major transformation and IS audits are gaining importance as key processes are automated, or enabled by technology. Hence, there is a need for banks to re-assess the IS Audit processes and ensure that IS Audit objectives are effectively met.

The scope of IS Audit includes:

 Determining effectiveness of planning and oversight of IT activities

 Evaluating adequacy of operating processes and internal controls

 Determining adequacy of enterprise-wide compliance efforts, related to IT policies and internal control procedures

 Identifying areas with deficient internal controls, recommend corrective action to address deficiencies and follow-up, to ensure that the management effectively implements the required actions

Following areas have been covered under this chapter:

 IS Audit: The organisation's structure, roles and responsibilities. The chapter identifies the IS Audit stakeholders, defines their roles, responsibilities and competencies required to adequately support the IS Audit function

 Audit Charter or Policy (to be included in the IS Audit): This point addresses the need to include IS Audit as a part of the Audit Charter or Policy

 Planning an IS Audit: This point addresses planning for an IS Audit, using Risk Based Audit Approach. It begins with an understanding of IT risk assessment concepts, methodology and defines the IS Audit Universe, scoping and planning an audit execution

 Executing an IS Audit: This describes steps for executing the audit, covering activities such as understanding the business process and IT environment, refining the scope and identifying internal controls, testing for control design and control objectives, appropriate audit evidence, documentation of work papers and conclusions of tests performed

 Reporting and Follow-up: Describes the audit summary and memorandum, the requirements for discussing findings with the management, finalising and submitting reports, carrying out follow-up procedures, archiving documents and ensuring continuous auditing

 Quality Review: This addresses the quality aspects which ensures supervision and exercising due care.

Information and network security very important

Introduction:

Information and the knowledge based on it have increasingly become recognized as ‘information assets’, which are vital enablers of business operations. Hence, they require organizations to provide adequate levels of protection. For banks, as purveyors of money in physical form or in bits and bytes, reliable information is even more critical and hence information security is a vital area of concern.

Robust information is at the heart of risk management processes in a bank. Inadequate data quality is likely to induce errors in decision making. Data quality requires building processes, procedures and disciplines for managing information and ensuring its integrity, accuracy, completeness and timeliness. The fundamental attributes supporting data quality should include accuracy, integrity, consistency, completeness, validity, timeliness, accessibility, usability and auditability. The data quality provided by various applications depends on the quality and integrity of the data upon which that information is built. Entities that treat information as a critical organizational asset are in a better position to manage it proactively.

Information security not only deals with information in various channels like spoken, written, printed, electronic or any other medium but also information handling in terms of creation, viewing, transportation, storage or destruction .This is in contrast to IT security which is mainly concerned with security of information within the boundaries of the network infrastructure technology domain. From an information security perspective, the nature and type of compromise is not as material as the fact that security has been breached.

To achieve effective information security governance, bank management must establish and maintain a framework to guide the development and maintenance of a comprehensive information security programme.

Basic Principles of Information Security:

For over twenty years, information security has held confidentiality, integrity and availability (known as the CIA triad) to be the core principles. There is continuous debate about extending this classic trio. Other principles such as Authenticity, Non-repudiation and accountability are also now becoming key considerations for practical security installations.

 Confidentiality: Confidentiality is the term used to prevent the disclosure of information to unauthorized individuals or systems. For example, a credit card transaction on the Internet requires the credit card number to be transmitted from the buyer to the merchant and from the merchant to a transaction processing network. The system attempts to enforce confidentiality by encrypting the card number during transmission, by limiting the places where it might appear (in databases, log files, backups, printed receipts, and so on), and by restricting access to the places where it is stored. If an unauthorized party obtains the card number in any way, a breach of confidentiality has occurred. Breaches of confidentiality take many forms like Hacking, Phishing, Vishing, Email-spoofing, SMS spoofing, and sending malicious code through email or Bot Networks, as discussed earlier.

 Integrity: In information security, integrity means that data cannot be modified without authorization. This is not the same thing as referential integrity in databases.

Integrity is violated when an employee accidentally or with malicious intent deletes important data files, when he/she is able to modify his own salary in a payroll database, when an employee uses programmes and deducts small amounts of money from all customer accounts and adds it to his/her own account (also called salami technique), when an unauthorized user vandalizes a web site, and so on.

On a larger scale, if an automated process is not written and tested correctly, bulk updates to a database could alter data in an incorrect way, leaving the integrity of the data compromised. Information security professionals are tasked with finding ways to implement controls that prevent errors of integrity.

 Availability: For any information system to serve its purpose, the information must be available when it is needed. This means that the computing systems used to store and process the information, the security controls used to protect it, and the communication channels used to access it must be functioning correctly. High availability systems aim to remain available at all times, preventing service disruptions due to power outages, hardware failures, and system upgrades. Ensuring availability also involves preventing denial-of-service (DoS) and distributed denial-of service (DDoS) attacks.

 Authenticity: In computing, e-business and information security it is necessary to ensure that the data, transactions, communications or documents (electronic or physical) are genuine. It is also important for authenticity to validate that both parties involved are who they claim they are.

 Non-repudiation: In law, non-repudiation implies one's intention to fulfill one’s obligations under a contract / transaction. It also implies that a party to a transaction cannot deny having received or having sent an electronic record. Electronic commerce uses technology such as digital signatures and encryption to establish authenticity and non-repudiation.

In addition to the above, there are other security-related concepts and principles when designing a security policy and deploying a security solution. They include identification, authorization, accountability, and auditing.

 Identification: Identification is the process by which a subject professes an identity and accountability is initiated. A subject must provide an identity to a system to start the process of authentication, authorization and accountability. Providing an identity can be typing in a username, swiping a smart card, waving a proximity device, speaking a phrase, or positioning face, hand, or finger for a camera or scanning device. Proving a process ID number also represents the identification process. Without an identity, a system has no way to correlate an authentication factor with the subject.

 Authorization: Once a subject is authenticated, access must be authorized. The process of authorization ensures that the requested activity or access to an object is possible given the rights and privileges assigned to the authenticated identity. In most cases, the system evaluates an access control matrix that compares the subject, the object, and the intended activity. If the specific action is allowed, the subject is authorized. Else, the subject is not authorized.

 Accountability and auditability: An organization’s security policy can be properly enforced only if accountability is maintained, i.e., security can be maintained only if subjects are held accountable for their actions. Effective accountability relies upon the capability to prove a subject’s identity and track their activities. Accountability is established by linking a human to the activities of an online identity through the

security services and mechanisms of auditing, authorization, authentication, and identification. Thus, human accountability is ultimately dependent on the strength of the authentication process. Without a reasonably strong authentication process, there is doubt that the correct human associated with a specific user account was the actual entity controlling that user account when an undesired action took place.

BUSINESS CONTINUITY PLANNING ..IT SECURITY

BUSINESS CONTINUITY PLANNING

Introduction

The pivotal role that banking sector plays in the economic growth and stability, both at national and individual level, requires continuous and reliable services. Increased contribution of 24x7 electronic banking channels has increased the demand to formulate consolidated Business Continuity Planning (BCP) guidelines covering critical aspects of people, process and technology.

BCP forms a part of an organisation's overall Business Continuity Management (BCM) plan, which is the “preparedness of an organisation”, which includes policies, standards and procedures to ensure continuity, resumption and recovery of critical business processes, at an agreed level and limit the impact of the disaster on people, processes and infrastructure (includes IT); or to minimise the operational, financial, legal, reputational and other material consequences arising from such a disaster.

Effective business continuity management typically incorporates business impact analyses, recovery strategies and business continuity plans, as well as a governance programme covering a testing programme, training and awareness programme, communication and crisis management programme.

 Roles, Responsibilities and Organisational structure Board of Directors and Senior Management

A bank’s Board has the ultimate responsibility and oversight over BCP activity of a bank. The Board approves the Business Continuity Policy of a bank. Senior Management is responsible for overseeing the BCP process which includes:

 Determining how the institution will manage and control identified risks

 Allocating knowledgeable personnel and sufficient financial resources to implement the

BCP

 Prioritizing critical business functions

 Designating a BCP committee who will be responsible for the Business Continuity Management

 The top management should annually review the adequacy of the institution's business recovery, contingency plans and the test results and put up the same to the Board.

 The top management should consider evaluating the adequacy of contingency planning and their periodic testing by service providers whenever critical operations are outsourced.

 Ensuring that the BCP is independently reviewed and approved at least annually;

 Ensuring employees are trained and aware of their roles in the implementation of the

BCP

 Ensuring the BCP is regularly tested on an enterprise-wide basis

 Reviewing the BCP testing programme and test results on a regular basis and

 Ensuring the BCP is continually updated to reflect the current operating environment