Business Standard

Sebi releases new cyber security framework for regulated entities

Besides, a Cyber Capability Index (CCI) for market infrastructure institutions and qualified regulated entities will be introduced to monitor and assess their cybersecurity maturity

sebi market

All regulated entities are to establish appropriate security monitoring mechanisms through SOCs.

Press Trust of India New Delhi

Listen to This Article

Markets watchdog Sebi on Tuesday issued a new cyber security framework wherein all regulated entities are required to have appropriate security monitoring mechanisms, and the fresh norms will be implemented in a graded manner starting from January 2025.

Besides, a Cyber Capability Index (CCI) for market infrastructure institutions and qualified regulated entities will be introduced to monitor and assess their cybersecurity maturity and resilience on a regular basis.

Click here to connect with us on WhatsApp

The Cybersecurity and Cyber Resilience Framework (CSCRF), formulated after consultations with stakeholders, comes at a time when there are rising instances of cyber attacks.

 

The framework will supersede the existing cybersecurity circulars and guidelines for the entities regulated by Sebi, according to a circular.

For small regulated entities, Sebi said that stock exchanges NSE and BSE will establish market Security Operation Centres (SOCs) to assist them in meeting the requirements under the new framework.

These SOCs will provide cybersecurity solutions tailored to the needs of small entities, ensuring that they achieve cyber resiliency despite limited resources, the regulator said.

All regulated entities are to establish appropriate security monitoring mechanisms through SOCs.

The onboarding of SOC can be done through a regulated entity's own/ group SOC or market SOC or any other third-party managed SOC for continuous monitoring of security events and timely detection of anomalous activities, as per the circular.

With a glide path, the framework will be implemented in two phases -- one set of entities has to ensure compliance by January 1, 2025, and another set by April 1, 2025.

Post the given deadlines, the entities are expected to conduct cybersecurity audits as per the CSCRF and submit reports to the appropriate authorities within the stipulated timelines.

"CSCRF contains provisions with respect to various areas such as requirements of IT services, Software as a Service (SaaS) solutions, hosted services, classification of data, audit for software solutions/applications/products used by regulated entities etc," the circular said.


(Only the headline and picture of this report may have been reworked by the Business Standard staff; the rest of the content is auto-generated from a syndicated feed.)

Don't miss the most important news and views of the day. Get them on our Telegram channel

First Published: Aug 20 2024 | 11:09 PM IST

Explore News