Modification in Cyber Security and Cyber resilience framework of Qualified Registrars to an Issue and Share Transfer Agents (“QRTAs”)
Summary
This circular modifies the cyber security framework for Qualified Registrars to an Issue and Share Transfer Agents (QRTAs) by updating specific paragraphs regarding asset classification, vulnerability assessments, and audits. It mandates QRTAs to identify critical assets, conduct regular VAPT exercises using CERT-In empaneled agencies, and perform comprehensive cyber audits twice a year. Additionally, QRTAs must submit compliance declarations and implementation status reports to SEBI within specified timeframes.
Text
In partial modification to Annexure A of SEBI circular dated September 08, 2017, the paragraph-11, 40, 41 and 42 shall be read as under:
QRTAs shall identify and classify critical assets based on their sensitivity and criticality for business operations, services and data management... The Board of the QRTAs shall approve the list of critical systems. To this end, QRTAs should maintain up-to-date inventory of its hardware and systems...
QRTAs shall carry out periodic vulnerability assessment and penetration tests (VAPT)... QRTAs shall conduct VAPT at least once in a financial year. However, for the QRTAs, whose systems have been identified as “protected system” by NCIIPC... VAPT shall be conducted at least twice in a financial year. Further, all QRTAs are required to engage only CERT-In empaneled organizations for conducting VAPT. The final report on said VAPT shall be submitted to SEBI after approval from Technology Committee of respective QRTAs, within 1 month of completion of VAPT activity.
Any gaps/vulnerabilities detected shall be remedied on immediate basis and compliance of closure of findings identified during VAPT shall be submitted to SEBI within 3 months post the submission of final VAPT report.
In addition, QRTAs shall perform vulnerability scanning and conduct penetration testing prior to the commissioning of a new system which is a critical system or part of an existing critical system.
Further, the QRTAs are mandated to conduct comprehensive cyber audit at least twice in a financial year. All QRTAs shall submit a declaration from the MD/ CEO certifying compliance by the QRTAs with all SEBI Circulars and advisories related to Cyber security from time to time, along with the Cyber audit reports.
All QRTAs are directed to communicate the status of the implementation of the provisions of this circular to SEBI within 10 days from the date of this Circular.
The provisions of the Circular shall come into force with immediate effect.
This circular is being issued in exercise of powers conferred under Section 11 (1) of the Securities and Exchange Board of India Act, 1992 to protect the interests of investors in securities and to promote the development of, and to regulate the securities market.
Source: SecMarx — Modification in Cyber Security and Cyber resilience framework of Qualified Registrars to an Issue and Share Transfer Agents (“QRTAs”). Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.