As per the draft circular, the boards of payment system operators will be responsible for ensuring adequate oversight over information security risks, including cyber risk and cyber resilience. However, the primary oversight can be delegated to a sub-committee of the board that will have to meet at least once every quarter.
