Sebi issues cybersecurity framework for KYC Registration Agencies

Amid concerns over possible data breaches, markets regulator Sebi on Tuesday put in place a detailed cybersecurity framework for KYC registration agencies, requiring them to define responsibilities of employees, including outsourced staff, who have privileged access to networks.

Besides, the watchdog said that no person should have any intrinsic right to access confidential data by virtue of their rank or position.

With the new norms, to be effective from January 1, 2020, KYC registration agencies or KRAs would be required to define the responsibilities of its employees, including outsourced staff, who have privileged access to the networks, the Securities and Exchange Board of India (Sebi) said in a circular.

Sebi said that rapid technological developments in securities market have highlighted the need for maintaining robust cyber security and cyber resilience framework to protect the integrity of data and guard against breaches of privacy.

Cybersecurity framework includes measures, tools and processes that are intended to prevent cyber-attacks and improve cyber resilience.

"Since KRAs perform important function of maintaining KYC records of the clients in the securities market, it is desirable that KRAs have robust Cyber Security and Cyber Resilience framework in order to provide essential facilities and perform systemically critical functions relating to securities market," Sebi noted.

Accordingly, Sebi has asked KRAs to formulate a comprehensive cybersecurity and cyber resilience policy document encompassing the framework.

The policy document should be approved by the board of KRAs and in case of deviations from the suggested framework, reasons for such deviations, technical or otherwise, should be provided in the policy document. The document should be reviewed by the board of KRAs at least annually.

KRAs will have to define responsibilities of its employees, outsourced staff, and employees of vendors, members and other entities, who may have privileged access to the networks. Further, such staff should also be subject to stringent supervision, monitoring and access restrictions.

They need to establish a reporting procedure to facilitate communication of unusual activities and events to the designated officer in a timely manner.

KRAs should establish appropriate security monitoring systems and processes to facilitate continuous monitoring of security events and timely detection of unauthorised or malicious activities, held in contractual or fiduciary capacity, by internal and external parties.

Sebi said that alerts generated from monitoring and detection systems need to be suitably investigated in order to determine activities that are to be performed to prevent expansion of such incident of cyber attack or breach, mitigate its effect and eradicate the incident.