The Securities and Exchange Board of India (Sebi) has introduced a new Cybersecurity and Cyber Resilience Framework for regulated entities. The framework, set to be implemented in phases starting from January 2025, aims to enhance security monitoring mechanisms in light of increasing cyber attacks.
A Cyber Capability Index (CCI) will also be introduced to assess the cybersecurity maturity and resilience of market infrastructure institutions and qualified regulated entities. The framework, developed after consultations with stakeholders, will replace existing cybersecurity circulars and guidelines.
To assist small regulated entities, stock exchanges NSE and BSE will establish Security Operation Centres (SOCs) tailored to their needs. These SOCs will provide cybersecurity solutions to ensure cyber resiliency despite limited resources.
All regulated entities are required to establish appropriate security monitoring mechanisms through SOCs. Compliance with the framework will be conducted in two phases, with deadlines set for January 1, 2025, and April 1, 2025. Entities are expected to conduct cybersecurity audits post-deadlines and submit reports as per the CSCRF.
The framework covers various areas such as IT services, Software as a Service (SaaS) solutions, data classification, and audit requirements for software solutions. The initiative aims to bolster cybersecurity measures in the financial sector amidst growing cyber threats.