The Securities and Exchange Board of India, (SEBI) on August 24, 2023, issued a circular regarding the Modification in Cyber Security and Cyber Resilience framework of Stock Exchanges, Clearing Corporations and Depositories.
This Circular shall come into force with immediate effect.
The following has been stated namely: -
• This has a reference to SEBI vide circular Nos. SEBI/CIR/MRD/DP/13/2015 dated July 06, 2015, and SEBI/HO/MRD1/MRD1_DTCS/P/CIR/2022/68 dated May 20, 2022, that prescribed framework for Cyber Security and Cyber Resilience for stock exchanges, clearing corporations and depositories.
• It states that the MIIs are mandated to conduct comprehensive cyber audits at least 2 times in a financial year. Along with cyber audit reports.
• The MIIs are further directed to submit a declaration from the MD/CEO certifying that:
(i) Comprehensive measures and processes including suitable incentive/disincentive structures, have been put in place for identification/detection and closure of vulnerabilities in the organization’s IT systems.
(ii) Adequate resources have been hired for staffing their Security Operations Center (SOC).
(iii) There is compliance by the MII with all SEBI circulars and advisories related to cyber security
• The MIIs, whose systems have been identified as Critical Information Infrastructure (CII) by the National Critical Information Infrastructure Protection Centre (NCIIPC), are mandated to send regular updates/closure status of the vulnerabilities found in their respective “protected systems” to NCIIPC.
• The MIIs are required to take necessary steps to put in place systems for implementation of the circular, including necessary amendments to the relevant bye-laws, rules, and regulations
• The MIIs are directed to communicate the status of the implementation of the provisions of this circular to SEBI within 30 days from the date of this Circular.
[Circular No. SEBI/HO/MRD/TPD/P/CIR/2023/147]
