Cyber Security and Cyber Resilience framework for Portfolio Managers

SEBI/HO/IMD/IMD-PoD-1/P/CIR/2023/046 · 2023-03-29 · SEBI

Summary

This circular mandates a Cyber Security and Cyber Resilience framework for Portfolio Managers with assets under management of INR 3000 crore or more. The guidelines, effective from October 1, 2023, require the establishment of comprehensive policies, governance structures, and technical controls to protect data integrity and privacy. Compliance involves appointing a CISO, forming a Technology Committee, and adhering to specific access control and risk management standards. This section mandates strict access control, authentication, and supervision policies for all users and outsourced staff. It requires Portfolio Managers to implement comprehensive physical, network, data, and application security measures including encryption and hardening. The text further outlines obligations for patch management, vulnerability assessment, monitoring, and incident response with specific recovery time objectives. Paragraph 51 mandates the reporting of cyber incidents to SEBI within six hours and requires quarterly mitigation reports. Paragraphs 53 and 54 require Portfolio Managers to conduct periodic cybersecurity training and ensure its contents remain current. Paragraph 55 mandates an annual i

Text

all Portfolio Managers with asset under management of INR 3000 crore or more... shall comply with the provisions of Cyber Security and Cyber Resilience

guidelines annexed with this circular shall be effective from October 01, 2023

Portfolio Managers should formulate comprehensive cyber security and cyber resilience policy document... approved by the Board or equivalent body

policy should include the following process to identify, assess, and manage cyber security risks... Identify, Protect, Detect, Respond, Recover

Portfolio Managers should designate a senior official as Chief Information Security Officer (CISO)

Board or equivalent body... shall constitute a Technology Committee comprising experts proficient in technology

Portfolio Manager shall identify and classify critical assets based on their sensitivity and criticality... maintain an up-to-date inventory

No person by virtue of rank or position should have any intrinsic right to access confidential data, applications, system resources or facilities

grant access to IT systems... on a need-to-use basis and based on the principle of least privilege

implement strong password controls... change of password upon first log-on, minimum password length and history, password complexity

logs should be maintained and stored in encrypted form for a time period not less than two (2) years

Account access lock policies after failure attempts should be implemented for all accounts.

Source: SecMarx — Cyber Security and Cyber Resilience framework for Portfolio Managers. Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.