Governance and policy
Cyber security policy, objectives and roles.
RMiT and NCII Code of Practice Gap Assessment
An RMiT and NCII code of practice gap assessment checks a financial institution's policies, processes and evidence against BNM's RMiT and its Appendix 12. BNM added the Cyber Security Act code of practice for designated financial institutions to RMiT as Appendix 12 on 25 September 2026. We assess your compliance clause by clause, map each gap to RMiT, and give you a plan and a compliance report for your governance committee.
RMiT and NCII Code of Practice Gap Assessment
What it is
A compliance gap assessment of your policies, processes and evidence against RMiT and Appendix 12. It is a documentation and control review, not a technical penetration test.
Why organisations need it
Appendix 12 is legally binding on financial institutions designated as NCII entities by BNM. It requires annual cyber risk assessments and audits at least every two years by a NACSA-approved auditor, each reported to NACSA within 30 days, notice of material NCII changes within 30 days, incident notification immediately and within 6 hours, and an annual review of code compliance. It prevails over the rest of RMiT where they differ.
What the engagement covers
Resources and awareness
CISO, budget and training.
Audit and risk assessment
Plans, cycles and NACSA reporting.
Assets and changes
Inventory and material change notice.
Incidents and continuity
Notification timelines, CSIRT and testing.
Controls evidence
Data, access, network and vulnerability management records.
What the business gets out of it
Clear position
Know where you stand on Appendix 12.
Mapped to RMiT
No duplicate effort.
Deadlines met
30-day and 6-hour duties covered.
Committee-ready
Annual compliance report drafted.
Independent
Objective view for the board.
How it works
How the engagement runs
01
Scoping
Entities and NCII systems.
02
Evidence collection
Policies, records and reports.
03
Assessment
Clause by clause.
04
Validation
Interviews and walkthroughs.
05
Report
Gaps, plan and compliance report.
Deliverables
What you receive
Gap assessment report
Every clause.
RMiT mapping
Appendix 12 to main body.
Remediation plan
Owners and dates.
Compliance report draft
For the governance committee.
Board summary
Position and risks.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
BNM states that the code of practice requirements were endorsed by NACSA and included in RMiT as Appendix 12 on 25 September 2026. It is legally binding on financial institutions designated as NCII entities, and prevails over the rest of RMiT where they differ.
No. The mandatory audit, due at least every two years, must be performed by a NACSA-approved auditor and reported to NACSA within 30 days. This assessment prepares you for it by finding and closing the gaps first.
No. This is a compliance and evidence review of policies, processes and records against RMiT and Appendix 12. Technical testing, such as penetration testing, is performed separately by specialist providers, and we check whether its results are evidenced.
Yes, if designation as an NCII entity is possible for your institution, since the requirements apply quickly once designated. Institutions that are not designated also use it as a benchmark against RMiT, which applies to them regardless.
Typically four to eight weeks, depending on the size of the institution and how much evidence is already organised. The assessment ends with a clause-by-clause gap list mapped to RMiT, a remediation plan and a compliance report for your governance committee.