SEBI Establishes Clear Guidelines on Cybersecurity and Cyber Resilience Framework This title succinctly communicates the intent of the article, focusing on SEBI’s efforts to provide clarity and guidelines on cybersecurity and cyber resilience frameworks

Sebi Clarifies Cybersecurity framework, Focuses on Core Operations

New Delhi – The Securities and Exchange Board of India (Sebi) issued a clarifying circular on Thursday concerning the application of its Cybersecurity and cyber Resilience Framework (CSCRF). The regulator emphasized that the framework primarily applies to systems directly involved in its regulated activities, signaling a focused approach to protecting critical financial infrastructure.

Scope of the Cybersecurity Framework

Sebi stated that infrastructure shared across different functions will be subject to audit, particularly if it isn’t already covered by existing regulations from bodies like the Reserve Bank of India (RBI). This ensures extensive coverage without creating overlapping regulatory burdens. The clarification aims to streamline compliance for regulated entities (REs) operating in the Indian financial market.

Compliance with Existing Regulations

Notably, Sebi will accept compliance with cybersecurity regulations from other regulators, such as the RBI, provided those rules are substantially equivalent to its own standards.This move acknowledges the existing efforts of many firms and avoids redundant implementation. It’s a testament to the increasing standardization of cybersecurity best practices across the Indian financial sector.

Did You Know? According to a recent report by the Data Security council of India (DSCI), cybersecurity incidents in the Indian financial services sector increased by 32% in the last fiscal year.

Defining Critical Systems and Zero-Trust Principles

Sebi provided a detailed definition of “critical systems,” encompassing all elements vital to core operations, storage and transmission of regulatory data, client applications, internet-facing systems, and interconnected networks. Regulated entities are now obligated to embrace “zero-trust” security principles like network segmentation, high availability, and elimination of single points of failure, subject to approval from thier respective IT Committees.

Mobile App Guidelines and Crisis Response

Guidelines pertaining to mobile applications are recommendatory rather than mandatory, offering flexibility to REs. However,the regulator stressed that in the event of a cyber incident,entities must strictly adhere to their established Cyber Crisis Management Plan,rather than resorting to public press releases. This prioritizes coordinated response and minimizes potential panic.

Audit and Disaster Recovery Requirements

Sebi also emphasized the importance of maintaining confidentiality and integrity when handling cybersecurity audit reports. Stock exchanges and depositories are expected to implement robust safeguards. Moreover, entities must demonstrate the ability to restore critical operations within two hours (RTO) and maintain a Recovery Point objective (RPO) of just 15 minutes. Contingency plans for scenarios exceeding these timelines are also required.

Categorization of Regulated Entities

Sebi has updated its categorization of regulated entities based on Assets Under Management (AUM). The revised thresholds are outlined below:

Entity Type	AUM Threshold	Category
Portfolio Managers	₹10,000 crore and above	Qualified RE
Portfolio Managers	₹3,000 crore – ₹10,000 crore	Mid-size RE
Portfolio Managers	₹3,000 crore or below	small-size RE
Portfolio Managers	Below minimum Threshold	Self-certification RE
Merchant Bankers (Active)	Any	Small-size RE
Merchant Bankers (Inactive)	Any	Exempt

Pro tip: Regularly review and update your firm’s cybersecurity policies and procedures to align with evolving regulatory requirements and emerging threat landscapes.

Looking Ahead

These changes represent Sebi’s commitment to strengthening the cybersecurity posture of the Indian financial markets.By clarifying the scope of the framework, acknowledging existing compliance efforts, and outlining clear expectations, Sebi is taking proactive steps to safeguard the integrity of the financial system and protect investors.

The Growing Importance of Cyber Resilience

Cyber resilience has become paramount for financial institutions globally. The increasing sophistication of cyberattacks, coupled with the growing reliance on digital infrastructure, necessitates a proactive and adaptable approach to cybersecurity. This includes not only preventing attacks but also rapidly detecting, responding to, and recovering from incidents. Investing in robust cybersecurity measures is no longer optional; it’s a business imperative.

Frequently Asked questions About Sebi’s Cybersecurity Framework

What are your biggest cybersecurity concerns as a financial professional? Share your thoughts in the comments below!

Don’t forget to share this article with your network!

What are the key areas covered by SEBI’s information security policies?

SEBI Establishes Clear Guidelines on Cybersecurity and Cyber Resilience Framework

Understanding the Regulatory Landscape for Cybersecurity in Indian Financial Markets

The Securities and exchange Board of India (SEBI) has taken a critically important step towards bolstering the cybersecurity posture of market intermediaries with the release of extensive guidelines on a cybersecurity framework and cyber resilience. These regulations, aimed at protecting the integrity of the Indian financial markets, are crucial for entities handling sensitive investor data and critical financial infrastructure.This article details the key aspects of SEBI’s directives, outlining requirements for cyber risk management, incident response, and ongoing cybersecurity compliance.

Key Components of the SEBI Cybersecurity Framework

SEBI’s guidelines aren’t a one-size-fits-all solution. They are tiered, recognizing the varying risk profiles and capabilities of different market participants.The framework broadly encompasses:

Governance Structure: Establishing a robust cybersecurity governance structure with clear roles and responsibilities, including a designated Chief Information Security Officer (CISO) or equivalent.

Cyber Risk Assessment: Conducting regular and comprehensive cyber risk assessments to identify vulnerabilities and threats specific to the institution’s operations. This includes vulnerability assessments and penetration testing.

Information Security Policies: Developing and implementing comprehensive information security policies covering areas like access control,data protection,and acceptable use.

Incident Response Plan (IRP): Creating and regularly testing a detailed incident response plan to effectively manage and mitigate cybersecurity incidents.

Cyber Resilience: Building cyber resilience capabilities to ensure business continuity even in the face of prosperous cyberattacks.

Third-Party Risk Management: Implementing robust controls to manage cybersecurity risks associated with third-party vendors and service providers.

Awareness and Training: Providing regular cybersecurity awareness training to all employees and stakeholders.

Categorization of Market Intermediaries & Corresponding Requirements

SEBI has categorized market intermediaries based on their systemic importance and the criticality of the services they provide. This categorization dictates the stringency of the cybersecurity requirements.

1. Category I: Includes entities like Stock Exchanges, clearing Corporations, and Depositories. These face the most stringent requirements, including:

Independent cybersecurity audits.

Real-time threat intelligence sharing.

Advanced threat detection and prevention systems.

1. Category II: Comprises entities like Brokers,merchant Bankers,and Registrars. They are subject to moderate requirements, including:

Annual cybersecurity audits.

Regular vulnerability assessments.

Implementation of basic security controls.

1. category III: Includes entities like Rating Agencies and Research Analysts. They face the least stringent requirements, focusing on foundational cybersecurity practices.

Deep Dive: incident Response Planning & Reporting

A critical element of the SEBI framework is the emphasis on a well-defined incident response plan. this plan should detail:

Detection & Analysis: Procedures for detecting and analyzing cybersecurity incidents.

Containment: Steps to contain the incident and prevent further damage.

Eradication: Methods for removing the threat and restoring systems.

Recovery: Processes for recovering data and restoring normal operations.

Post-Incident Activity: Conducting a post-incident review to identify lessons learned and improve security controls.

Reporting requirements: SEBI mandates the reporting of significant cybersecurity incidents within a specified timeframe. This includes incidents that could perhaps impact market integrity, investor confidence, or financial stability. The reporting format and channels are clearly defined in the guidelines. Failure to report incidents promptly can result in penalties.

The Role of Technology in Enhancing Cybersecurity

Implementing the SEBI framework necessitates leveraging appropriate technologies. Key technologies include:

Security Information and Event management (SIEM) systems: For centralized log management and security monitoring.

Intrusion Detection and Prevention Systems (IDPS): To detect and block malicious activity.

Endpoint Detection and Response (EDR) solutions: For advanced threat detection on endpoints.

Data Loss Prevention (DLP) tools: To prevent sensitive data from leaving the organization.

Multi-Factor Authentication (MFA): To enhance access control security.

Threat Intelligence Platforms (TIP): To stay informed about emerging threats.

Benefits of a Strong Cybersecurity Posture

Adhering to SEBI’s guidelines offers numerous benefits:

Enhanced Investor Confidence: demonstrates a commitment to protecting investor data and maintaining market integrity.

Reduced Financial Losses: minimizes the risk of financial losses resulting from cyberattacks.

* Improved Regulatory Compliance: Ensures compliance with SEBI regulations