Policy Watch
SEBI Launches Cyber Capability Index to Boost Market Security!
SEBI has launched a new cybersecurity framework to strengthen the security of regulated entities, mandating the adoption of SOCs and introducing a Cyber Capability Index for continuous monitoring. The framework, set to be fully implemented by April 2025, will ensure robust cybersecurity across India’s financial markets.
Mumbai: The Securities and Exchange Board of India (SEBI) has unveiled a comprehensive cybersecurity framework aimed at enhancing the security resilience of all regulated entities. This new initiative requires market infrastructure institutions and qualified regulated entities to adopt stringent security monitoring mechanisms. These fresh norms will be implemented gradually, with full compliance expected by January 2025.
Cyber Capability Index (CCI) for Continuous Monitoring
In a significant move, SEBI will introduce a Cyber Capability Index (CCI) to monitor and assess the cybersecurity maturity and resilience of these entities regularly. This index is designed to ensure that all entities maintain high cybersecurity standards, reducing the risk of cyber threats and enhancing the overall security landscape in the financial markets.
Transition to the New Framework
The newly introduced Cybersecurity and Cyber Resilience Framework (CSCRF) will replace the existing guidelines, providing a more structured approach to managing cybersecurity risks. SEBI has emphasized the need for regulated entities to establish Security Operation Centres (SOCs) to monitor security events continuously and detect any anomalous activities.
For smaller entities, SEBI has mandated the creation of market SOCs by leading stock exchanges like NSE and BSE. These centers will offer tailored cybersecurity solutions, helping smaller players achieve resilience despite limited resources.
Starting September: TRAI’s New Rules to Curb Spam Messages!
Implementation in Phases
The framework will be implemented in two phases. The first set of entities is required to comply by January 1, 2025, while the second set must comply by April 1, 2025. Post-compliance, entities must conduct regular cybersecurity audits as per the CSCRF and submit their reports to the appropriate authorities.
Scope of the Framework
The CSCRF covers various aspects of IT services, including Software as a Service (SaaS) solutions, hosted services, data classification, and audit requirements for software applications used by regulated entities. By enforcing these measures, SEBI aims to create a robust cybersecurity environment across the financial markets, ensuring that all entities are well-prepared to tackle potential cyber threats.
Follow The420.in on
Telegram, Facebook, Twitter, LinkedIn, Instagram and YouTube