Sebi beefs up cybersecurity measures for regulated intermediaries

The Securities and Exchange Board of India (Sebi) has issued additional safeguards for regulated intermediaries such as stock exchanges, depositories, and mutual funds to enhance its cybersecurity policy.

In an advisory issued on Wednesday, the regulator has advised the regulated entities to define roles and responsibilities of chief information security officer (CISO) along with specified security policy.

These entities have been asked to prepare a detailed incident response plan, enforce data protection and recovery processes. Furthermore, they have been asked to take steps to prevent any data leak from cloud services, do security audit and vulnerability testing, and devise awareness programs against phishing or malicious emails.

Sebi has also advised the entities to encrypt sensitive and personally identifiable information (PII) data, specifically in transit, to protect its access from any attacker.

The market watchdog has also recommended independent audit of systems, risk from third parties, and multi-factor authentication among a dozen other measures.

“Given the sophistication and persistence of the threat with a high level of coordination among threat actors, it is important to recognise that many traditional approaches to risk management and governance that worked in the past may not be comprehensive or agile enough,” said Sebi.

These measures had been submitted as a report by Financial Computer Security Incident Response Team (CSIRT-Fin) to Sebi. Regulated entities will have to provide details on the compliance of this advisory along with their cyersecurity audit report.