Cyber Security Operations Center for the SEBI registered intermediaries
Summary
This circular extends the cyber security framework to stock brokers and depository participants by allowing them to utilize a Market Security Operations Center (SOC) established by Market Infrastructure Institutions. The Market SOC must be set up as a separate entity with at least 51% stake held by MIIs and focuses on providing technology perspectives for compliance. Intermediaries utilizing this shared SOC are deemed compliant upon submission of audit reports, while MIIs are directed to implement these systems within six months.
Text
These intermediaries may utilize the services of Market SOC which is proposed to be set up by MIIs with the objective of providing cyber security solution to such intermediaries. The intermediaries’ membership in Market SOC is non mandatory.
The Market SOC shall be set up as a separate entity and MIIs shall have at least 51% stake in the new entity.
Intermediaries who don’t have capability to set up a SOC on their own can opt for the Market SOC.
The Market SOC should be in accordance to the circular SEBI/HO/MIRSD/CIR/PB/2018/147 dated December 03, 2018 and should ensure that participating intermediaries are in compliance to the said circular... Market SOC would provide only the technology perspective... people & process perspectives... would still be have to be managed by the intermediaries.
The Market SOC should be evolving continuously in order to be able to manage new security controls and guidelines that may issue by SEBI from time to time.
The Market SOC to ensure that intermediaries participating in their SOC should adhere to the minimum IT guidelines and security protocols all the time.
MII will carry out audit of their Market SOC activity annually and submit the report to SEBI.
The Market SOC will issue an audit report as prescribed in the circular SEBI/HO/MIRSD/CIR/PB/2018/147 dated December 03, 2018, to the participating intermediary.
If an intermediary is subscribed to Market SOC, audit report submitted by intermediary through the Market SOC would be deemed compliant.
Approval for the Market SOC which is to be set up as a separate entity would be in terms of Regulation 38 of Securities Contracts (Regulation) (Stock Exchanges and Clearing Corporations) Regulations, 2018.
MIIs are directed to take necessary steps to put in place appropriate systems and processes for implementation of the circular, including necessary amendments to the relevant bye-laws, rules and regulations, if any, within six months from the date of the circular.
This circular is being issued in exercise of powers conferred under Section 11 (1) of the Securities and Exchange Board of India Act, 1992 and Section 19 of the Depositories Act, 1996 to protect the interests of investors in securities and to promote the development of, and to regulate the securities market.
Source: SecMarx — Cyber Security Operations Center for the SEBI registered intermediaries. Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.