Financial institutions are not short on cybersecurity policies, frameworks, or regulatory requirements. Turning those requirements into a living risk management program can be challenging. Organizations need a program that can keep pace as technology environments expand, cloud adoption grows, third parties are added, and external exposures change. Especially as the threat landscape continues to evolve.
Bank Negara Malaysia’s current Risk Management in Technology, or RMiT, Policy Document reflects that reality. Issued and effective on 28 November 2025, it establishes minimum requirements for managing technology and cyber risk across governance, technology operations, cybersecurity, digital services, third-party service providers, cloud services, audit, assurance, and gap analysis. It also makes clear that larger, more complex, highly digitalized, or highly interconnected institutions are expected to adopt more robust controls proportionate to their exposure.
Bitsight can help financial institutions operationalize several of these expectations by providing continuous, outside-in visibility into their cybersecurity posture and the broader digital and third-party ecosystem around them. Institutions still need to enforce controls, policies, security operations, internal testing, and regulatory responsibilities. Bitsight provides an intelligence and measurement layer that can help teams identify risk, prioritize action, monitor change, and communicate progress.
Traditional technology risk programs often rely heavily on periodic reviews. An organization completes an assessment, collects documentation, records the results, and repeats the process later. Those activities remain important, but they cannot show what happens between assessments. Threats don't wait for assessment intervals. By the time the next formal assessment takes place, the organization’s actual exposure may look very different. As vendors and technology continue to evolve, it is vital to ensure your security posture evolves with those changes.
RMiT requires financial institutions to include continuous monitoring within their Technology Risk Management Framework so material risks can be detected and addressed in a timely manner. It also requires institutions to maintain an accurate, up-to-date technology risk profile. This requires more than policies and questionnaires. It requires objective information that can be monitored over time and used to determine when risk has moved outside established tolerance.
Boards and senior management need to understand what has changed, why it matters, whether the organization remains within its risk appetite, and what is being done about it. Under RMiT, the board must establish and approve the institution’s technology risk appetite and corresponding tolerances. It must also receive regular updates on technology risk and cyber threats, while senior management remains responsible for the day-to-day management of technology and cyber risk.
Bitsight’s outside-in security performance data, risk vectors, trends, benchmarks, and reporting can help translate externally observable cybersecurity risk into a view that is easier for risk committees, executives, and board members to understand.
Financial institutions can use these insights to track areas such as:
These metrics cannot set the institution’s risk appetite or make risk acceptance decisions but they are able to provide evidence that can help leadership understand where risk lies, and how to anticipate threats.
It is difficult to manage technology risk without an accurate understanding of the environment being protected. Cloud adoption, subsidiaries, mergers and acquisitions, developer infrastructure, outsourced hosting, third-party services, and shadow IT can all create assets that sit outside traditional internal inventories. RMiT requires institutions to establish controls for shadow IT and ensure that systems, including digital services, are not operating with known vulnerabilities, outdated platforms, or end-of-life technology. It also requires continuous monitoring and timely implementation of security patches. Bitsight Security Posture Management (SPM) combines external attack surface management, threat intelligence, and governance reporting to help organizations discover, prioritize, mitigate, govern, and communicate risk across their digital infrastructure. SPM can provide visibility across assets, subsidiaries, cloud environments, and third parties while applying threat and business context to support prioritization.
This outside-in perspective can help institutions:
External attack surface intelligence should complement authenticated vulnerability scanning, internal asset inventories, configuration management databases, endpoint telemetry, cloud-native tools, and system-owner validation. It does not replace them.
Financial institutions remain accountable for risks introduced by third-party service providers. RMiT specifically requires financial institutions to formulate a roadmap for continuously monitoring the cybersecurity posture of third-party service providers to obtain real-time insights for effective incident management. Annual questionnaires provide valuable information, but they represent one point in time. They are not able to represent ongoing risk if that risk was not present at the time of the assessment. Bitsight Third-Party Risk Management (TPRM) supports vendor assessment, onboarding, continuous monitoring, and response across the third-party lifecycle. Portfolio-level analytics and alerts can help institutions identify changing risks across their vendor ecosystem rather than waiting for the next scheduled reassessment.
This allows teams to focus on questions such as:
Bitsight can support an institution’s third-party monitoring roadmap through continuous outside-in intelligence and evidence-based vendor risk insights. However, institutions must combine that information with contractual assurance, control testing, incident-response processes, business continuity requirements, and their own third-party governance.
Like most industries, cloud services and customer-facing digital platforms have become inseparable from modern financial services. RMiT expects institutions to understand cloud risk, maintain an inventory of cloud-hosted critical systems, assess cloud service providers, define continuous oversight mechanisms, and account for risks introduced by subcontractors and fourth-party providers. Its cloud guidance also calls for integrated monitoring and visibility across cloud services, on-premises systems, and other service providers.
Bitsight can help identify cloud-related internet assets, externally observable exposures, vulnerable services, security configuration indicators, and changes in the posture of important technology providers. For customer-facing digital services, this can help institutions understand the external perimeter. Bitsight is continuously seeing threat actors evolve to attack the perimeter and the vendors for a larger blast radius. It is critical that organizations ensure they know which risks pertain to them, how to defend against those risks, and how the landscape is changing.
RMiT requires financial institutions to perform a gap analysis against the policy’s requirements, identify key implementation gaps, and develop an action plan with clear timelines and milestones. Institutions must also maintain an updated annual assessment of their level of compliance and make it available to BNM upon request.
Bitsight findings and reports can support these activities by providing evidence of:
Bitsight Risk Governance and Analytics helps organizations assess security performance, benchmark against peers, support reporting, and communicate cybersecurity risk to nontechnical stakeholders. Bitsight Professional Services can also support activities such as portfolio analysis, executive and board reporting, findings validation, risk hunting, vendor assessment, and regulatory alignment reporting. These outputs can provide evidence inputs for audit planning, gap analysis, risk assessments, action-plan prioritization, and remediation tracking.
Financial institutions can use Bitsight within a broader RMiT-aligned program through five connected stages.
RMiT alignment is not a one-time assessment. Technology environments, external attack surfaces, cloud dependencies, and third-party relationships change too quickly for institutions to rely only on periodic reviews or self-reported information.
Bitsight helps financial institutions create a more objective and continuous view of that changing risk. By combining Security Posture Management, Threat Intelligence, Third-Party Risk Management, Risk Governance and Analytics, and Professional Services, institutions can identify exposures earlier, prioritize the risks that matter most, and communicate progress more clearly. The financial institution remains responsible for its technology risk framework, internal controls, control testing, incident response, regulatory engagement, and final compliance decisions. Bitsight helps provide the visibility, intelligence, and evidence needed to make those decisions with greater confidence.
In GigaOm’s latest Radar report for Third-Party Risk Management, Bitsight was positioned as a Leader and Fast Mover for its externally sourced cyber risk ratings, continuous monitoring, API-first integrations, and vendor risk visibility.
