4.1 Covered Entities
SEBI's cyber security framework applies to all market infrastructure institutions and intermediaries. The requirements vary based on the category and systemic importance of the entity.
Market Infrastructure Institutions (MIIs)
- Stock Exchanges: NSE, BSE, MSEI, commodity exchanges
- Clearing Corporations: NSCCL, ICCL, MCX-CCL
- Depositories: NSDL, CDSL
MIIs are designated as Critical Information Infrastructure under IT Act Section 70. This imposes additional obligations including NCIIPC compliance and enhanced security requirements.
SEBI Registered Intermediaries
| Category | Examples | CSCRF Applicability |
|---|---|---|
| Stockbrokers | Full service, discount brokers | Full CSCRF |
| Depository Participants | DP services providers | Full CSCRF |
| Mutual Funds/AMCs | Asset management companies | Full CSCRF |
| Portfolio Managers | PMS providers | Proportionate |
| Investment Advisers | Registered RIAs | Proportionate |
| Credit Rating Agencies | CRISIL, ICRA, CARE | Full CSCRF |
| Merchant Bankers | Category I, II, III | Proportionate |
| KRAs | KYC Registration Agencies | Full CSCRF |
Qualified Registered Market Intermediaries (QRMIs)
SEBI has introduced a tiered approach. Qualified RMIs based on certain thresholds face enhanced requirements:
- Stockbrokers: Based on trading volume, client base, assets handled
- DPs: Based on number of demat accounts, assets under custody
- AMCs: Based on AUM thresholds
4.2 CSCRF Framework
The Cyber Security and Cyber Resilience Framework (CSCRF) provides a comprehensive structure for managing cyber risks in capital market entities. It emphasizes both prevention and recovery capabilities.
Key Framework Components
- Governance: Board oversight, cyber security policy, risk management committee
- Identify: Asset management, risk assessment, threat intelligence
- Protect: Access control, data security, security awareness training
- Detect: Continuous monitoring, anomaly detection, security event management
- Respond: Incident response, communications, mitigation
- Recover: Recovery planning, improvements, communications
Governance Requirements
Chief Information Security Officer (CISO)
- Mandatory appointment for MIIs and Qualified RMIs
- Full-time dedicated role (not combined with other IT functions)
- Reports to MD/CEO with dotted line to Board/Audit Committee
- Responsible for policy implementation, incident management, compliance
Technical Controls
| Control Area | Requirements |
|---|---|
| Network Security | Firewalls, IDS/IPS, network segmentation, DMZ architecture |
| Endpoint Security | Anti-malware, host-based IPS, application whitelisting |
| Access Control | MFA for critical systems, privileged access management, periodic access reviews |
| Data Protection | Encryption at rest and transit, DLP, secure key management |
| Application Security | Secure SDLC, code reviews, VAPT before production deployment |
| Security Monitoring | SIEM, 24x7 SOC (for MIIs), log management, threat intelligence |
Cyber Resilience Requirements
MIIs must maintain Recovery Time Objective (RTO) of near-zero for critical systems. Business Continuity Plan must be tested at least annually with full DR drills. Secondary site must be able to handle full production load.
- BCP/DR: Documented plans, regular testing, secondary data centers
- Data Backup: Regular backups, offsite storage, encryption of backup media
- Incident Recovery: Playbooks for various scenarios, golden images for quick rebuild
- Communication: Crisis communication plans for stakeholders, regulators, public
4.3 Audit Requirements
SEBI mandates regular audits of cyber security controls. Different categories of entities have varying audit frequencies and scope requirements.
System Audit
VAPT Requirements
| Entity Type | Frequency | Scope |
|---|---|---|
| MIIs | Quarterly | All internet-facing and critical internal systems |
| Qualified RMIs | Half-yearly | All internet-facing and trading systems |
| Other Intermediaries | Annually | Internet-facing systems |
Audit Firm Requirements
- CERT-In Empanelment: System auditors must be on CERT-In empaneled list
- Independence: Auditor should not have provided implementation services
- Rotation: MIIs must rotate auditors periodically
- Qualifications: Lead auditor must have relevant certifications (CISA, CISSP, etc.)
Audit Report Submission
System Audit reports must be submitted to SEBI within 3 months of the audit period end. MIIs must also submit quarterly compliance reports and immediate notification of critical findings.
4.4 Reporting Obligations
SEBI has established specific reporting requirements for cyber incidents, system downtime, and periodic compliance. Timely reporting is critical to avoid regulatory action.
Incident Reporting
| Incident Type | Report To | Timeline |
|---|---|---|
| Critical cyber attack (data breach, system compromise) | SEBI, CERT-In, NCIIPC (for MIIs) | Within 6 hours |
| Trading system outage > 30 minutes | SEBI, Stock Exchange | Immediate + detailed within 24 hours |
| Attempted attack (blocked) | Internal CISO, included in periodic report | Monthly summary |
| Vulnerability discovered | CISO, action plan within defined timeline | As per severity |
Periodic Reporting
- Quarterly Reports: Cyber security status, incidents summary, audit findings status
- Half-Yearly Reports: VAPT summary, access review reports, training completion
- Annual Reports: System Audit report, BCP/DR drill results, policy review completion
NCIIPC Reporting (For MIIs)
Market Infrastructure Institutions designated as Critical Information Infrastructure must additionally report to NCIIPC (National Critical Information Infrastructure Protection Centre). This includes threat intelligence sharing, vulnerability disclosure, and incident coordination.
Non-Compliance Consequences
- Warning Letters: For minor or first-time violations
- Monetary Penalties: For repeated or significant non-compliance
- Business Restrictions: Suspension of specific activities
- Registration Action: Cancellation in severe cases
- Personal Liability: Action against Key Management Personnel
Key Takeaways
- SEBI CSCRF applies to all MIIs and registered intermediaries with tiered requirements
- MIIs (exchanges, clearing corps, depositories) are designated Critical Information Infrastructure
- CISO appointment is mandatory for MIIs and Qualified RMIs
- Annual System Audit by CERT-In empaneled auditor is mandatory
- VAPT frequency varies: quarterly for MIIs, half-yearly for QRMIs, annually for others
- Critical incidents must be reported within 6 hours to SEBI and CERT-In
- MIIs must also comply with NCIIPC reporting requirements
Part 4 Assessment Quiz
Test Your Knowledge
10 questions on SEBI Cyber Security requirements