Modification in Cyber Security and Cyber resilience framework for Stock Brokers / Depository Participants
Summary
SEBI modifies the cyber security framework for Stock Brokers and Depository Participants by amending reporting timelines in Annexure 1 of a previous circular. The amendment mandates that all cyber incidents be reported to exchanges, depositories, SEBI, CERT-In, and NCIIPC within six hours of detection. Additionally, quarterly reports on cyber vulnerabilities must be submitted within fifteen days after each quarter ends.
Text
paragraph-52 shall be read as under: All Cyber-attacks, threats, cyber-incidents and breaches experienced by Stock Brokers / Depositories Participants shall be reported to Stock Exchanges / Depositories & SEBI within 6 hours of noticing / detecting such incidents or being brought to notice about such incidents. This information shall be shared to SEBI through the dedicated e-mail id: sbdp-cyberincidents@sebi.gov.in. The incident shall also be reported to Indian Computer Emergency Response team (CERT-In) in accordance with the guidelines / directions issued by CERT-In from time to time. Additionally, the Stock Brokers / Depository Participants, whose systems have been identified as “Protected system” by National Critical Information Infrastructure Protection Centre (NCIIPC) shall also report the incident to NCIIPC.
The quarterly reports containing information on cyber-attacks, threats, cyber-incidents and breaches experienced by Stock Brokers / Depository Participants and measures taken to mitigate vulnerabilities, threats and attacks including information on bugs / vulnerabilities, threats that may be useful for other Stock Brokers / Depository Participants / Exchanges /Depositories and SEBI, shall be submitted to Stock Exchanges / Depositories within 15 days from the quarter ended June, September, December and March of every year.
Stock Brokers / Depository Participants shall take necessary action for implementation of the circular.
Stock Exchanges and Depositories shall; a) make necessary amendments to the relevant byelaws, rules and regulations for the implementation of the above direction and b) bring the provisions of this circular to the notice of their members/participants and also disseminate the same on their websites.
The provisions of the Circular shall come into force with immediate effect.
This circular is being issued in exercise of powers conferred under Section 11 (1) of the Securities and Exchange Board of India Act, 1992 to protect the interests of investors in securities and to promote the development of, and to regulate the securities market.
Source: SecMarx — Modification in Cyber Security and Cyber resilience framework for Stock Brokers / Depository Participants. Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.