Advisory for SEBI Regulated Entities (REs) regarding Cybersecurity best practices
Summary
This circular issues an advisory for SEBI Regulated Entities regarding cybersecurity best practices to mitigate growing cyber threats. It mandates that compliance with the advisory be reported alongside the cybersecurity audit report as per existing mechanisms. The advisory is effective immediately and relies on recommendations from CSIRT-Fin, including specific measures for CISO roles, phishing prevention, and patch management. This section mandates specific cybersecurity controls including data protection, log retention, and authentication mechanisms for Regulated Entities. It outlines requirements for privilege management, cloud service security, and the implementation of CERT-In advisories. Finally, it addresses concentration risks in outsourcing and emphasizes the necessity of external audits and ISO certification.
Text
Financial sector organizations have been experiencing rapidly growing cyber incidents in frequency and sophistication, necessitating a recognition that cyber risk extends beyond an entity's own systems due to interdependency.
Traditional approaches to risk management and governance may no longer be comprehensive or agile enough to address rapid changes in the threat environment and technological change.
Regulated entities must implement the recommendations provided by the Financial Computer Security Incident Response Team (CSIRT-Fin) as enclosed in Annexure-A to ensure efficient response and recovery from cyber-incident.
The advisory should be read in conjunction with applicable SEBI circulars including the Cybersecurity and Cyber Resilience framework, Annual System Audit framework, and subsequent updates issued by SEBI.
The compliance of the advisory shall be provided by the REs along with their cybersecurity audit report conducted as per the applicable SEBI Cybersecurity and Cyber Resilience framework, submitted via existing reporting mechanisms.
The advisory annexed with this circular shall be effective with immediate effect.
This circular is issued in exercise of powers conferred under Section 11(1) of the Securities and Exchange Board of India Act, 1992, to protect investor interests and promote securities market development.
REs are advised to define roles and responsibilities of Chief Information Security Officer (CISO) and other senior personnel, with reporting and compliance requirements clearly specified in the security policy.
The REs need to proactively monitor the cyberspace to identify phishing websites w.r.t. to REs domain and report the same to CSIRT-Fin/CERT-In for taking appropriate action.
Thoughtfully designed security awareness campaigns stressing avoidance of clicking on links and attachments in email can establish an essential pillar of defense against infections introduced via phishing emails and malicious adverts.
All operating systems and applications should be updated with the latest patches on a regular basis, sourcing patches only from authorized sites of the OEM, and considering virtual patching for zero-day vulnerabilities where patches are unavailable.
Security audit / Vulnerability Assessment and Penetration Testing (VAPT) of the application should be conducted at regular basis and in accordance with the Cyber Security and Cyber Resilience circulars of SEBI issued from time to time.
You have read the preview. Create a free account to read the full document and see every order that applied it.
Free accounts include 10 searches/day with full text access.
Source: SecMarx — Advisory for SEBI Regulated Entities (REs) regarding Cybersecurity best practices. Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.