Modification in Cyber Security and Cyber resilience framework of KYC Registration Agencies (KRAs)
Summary
SEBI modifies the cyber security framework for KYC Registration Agencies by mandating immediate reporting of cyber incidents. KRAs must report all cyber-attacks and breaches to SEBI within six hours and submit quarterly mitigation reports. The circular exercises powers under Section 11(1) of the SEBI Act, 1992 to protect investor interests.
Text
In partial modification to Annexure A of SEBI circular dated 15 October 2019 the paragraph-51 shall be read as under: All Cyber-attacks, threats, cyber-incidents and breaches experienced by KRAs shall be reported to SEBI within 6 hours of noticing / detecting such incidents or being brought to notice about such incidents.
The incident shall also be reported to Indian Computer Emergency Response team (CERT-In) in accordance with the guidelines / directions issued by CERT-In from time to time. Additionally, the KRAs, whose systems have been identified as “Protected system” by National Critical Information Infrastructure Protection Centre (NCIIPC) shall also report the incident to NCIIPC.
The quarterly reports containing information on cyber-attacks, threats, cyber-incidents and breaches experienced by KRAs and measures taken to mitigate vulnerabilities, threats and attacks including information on bugs/ vulnerabilities/threats that may be useful for other KRAs shall be submitted to SEBI within 15 days from the quarter ended June, September, December and March of every year.
KRAs shall take necessary steps to put in place systems for implementation of the circular.
The provisions of the Circular shall come into force with immediate effect.
This circular is being issued in exercise of powers conferred under Section 11 (1) of the Securities and Exchange Board of India Act, 1992 to protect the interests of investors in securities and to promote the development of, and to regulate the securities market.
Source: SecMarx — Modification in Cyber Security and Cyber resilience framework of KYC Registration Agencies (KRAs). Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.