Nepal Rastra Bank's Cyber Resilience Guidelines (CRG) 2023 did something most cybersecurity regulation doesn't bother doing: it closed off the option to treat cyber risk as an IT-only problem. The CRG's chapter on cyber resilience strategy says the licensed institution "should establish an internal, cross-disciplinary steering committee comprised of senior management and appropriate staff … from multiple business units." Its examples include business, finance, risk management, internal audit, operations, cybersecurity, IT, communications, legal and human resources. The committee's job is to "collectively develop a cyber resilience strategy and framework" that covers people, processes and technology — not just the CISO and a compliance officer nodding along.
The CRG also places ultimate responsibility with the board, which "is ultimately responsible for making sure that cyber risk is properly managed" and should set the institution's cyber risk tolerance.
A BFI can technically satisfy this expectation and still miss its point. It has a committee. It meets. It has the right names on the attendance sheet. And it produces almost no operational value, because it was assembled to satisfy the letter of the guideline rather than its intent.
Why "paper compliance" steering committees fail
The pattern is consistent: a committee convenes quarterly, IT presents a slide of vulnerability counts and patch statistics, non-technical members nod, and the meeting ends without a single decision that changes how HR handles an offboarding, how Legal handles a breach notification, or how Risk quantifies cyber exposure against the institution's overall risk appetite. The committee exists. The cross-disciplinary function does not.
This matters because the entire logic behind bringing HR and Legal into the room is that a real cyber incident is never purely technical. An employee's access needs to be revoked the moment they're terminated — that's an HR process failure if it doesn't happen, not an IT one. A data breach notification obligation has legal timelines attached — that's a Legal process, informed by but not owned by IT.
What a functional first meeting actually looks like
The steering committee's job in its inaugural session is not to review a vulnerability report. It's to translate technical risk into business and financial language that non-technical board members can act on, and to explicitly assign process ownership across departments.
A workable inaugural agenda:
- Translate one real technical risk into financial exposure. Take an actual finding — a zero-day in a third-party library, an unpatched legacy system — and quantify potential financial and reputational impact in terms the CFO and Legal counsel can act on, not in CVSS scores.
- Map HR's offboarding workflow directly against CRG incident response timelines. If a terminated employee's system access isn't revoked within a defined window, that's a control gap that shows up on the next NRB inspection — walk through your actual HR offboarding checklist against it, live, in the room.
- Map Legal's breach notification process against NRB's reporting expectations. The CRG says incidents that could be material or systemic should be reported immediately. Confirm who in Legal is authorized to approve external communications during an active incident, and whether that person has ever actually seen the notification template.
- Assign one named owner per cross-functional gap identified. Not "IT will follow up" — a specific person, in a specific department, with a specific date.
A steering committee that cannot point to a decision it made outside of IT's own domain in its first two meetings is a committee that exists to satisfy an auditor, not to reduce risk. NRB inspectors are increasingly able to tell the difference.
The uncomfortable part
Building this properly usually surfaces friction the institution has been avoiding — HR discovering their offboarding checklist has a two-day access-revocation gap, or Legal discovering nobody has actually walked through the breach notification template since it was drafted. That friction is the point. A steering committee that never produces friction in its first few sessions almost certainly isn't doing the cross-disciplinary translation work the CRG actually asks for.