Guidelines for Business Continuity Plan (BCP) and Disaster Recovery (DR) of Qualified RTAs (QRTAs)
Summary
This circular mandates Qualified RTAs to implement robust Business Continuity and Disaster Recovery frameworks to ensure operational resilience. It specifies strict technical requirements for Disaster Recovery Sites, including distance, synchronization, and zero data loss protocols. Additionally, it requires regular testing through drills and the submission of updated policies to SEBI within a defined timeframe.
Text
QRTAs are required to comply with the following framework for BCP and DR to strengthen overall resiliency and improve preparedness.
QRTAs shall have in place Business Continuity Plan (BCP) and Disaster Recovery Site (DRS) so as to ensure continuity of operations, maintain data and transaction integrity.
The manpower deployed at DRS/ Near Site (NS) shall have the same expertise as available at PDC... QRTAs shall have sufficient number of trained staff at their DRS so as to have the capability of running live operations from DRS without involving staff of the PDC.
All QRTAs shall constitute an Incident and Response team (IRT) / Crisis Management Team (CMT), which shall be chaired by the Managing Director (MD)... or by the Chief Technology Officer (CTO)... IRT/ CMT shall be responsible for the actual declaration of disaster...
The Technology Committee of the QRTAs shall review the implementation of BCP-DR policy approved by the board of the QRTA on a quarterly basis.
Apart from DRS, all QRTAs shall also have a Near Site (NS)... The DRS should preferably be set up in different seismic zones... minimum distance of 500 kilometre shall be ensured between PDC and DRS...
Hardware, system software, application environment, network and security devices and associated application environments of DRS and PDC shall have one to one correspondence between them.
QRTAs should develop systems that do not require configuration changes at the end of AMCs/other regulatory entities for switchover from the PDC to DRS.
In the event of disruption of any one or more of the ‘Critical Systems’... the QRTA shall, within 30 minutes of the incident, declare that incident as ‘Disaster’ and take measures to restore operations including from DRS within 45 minutes... RTO... shall be 45 minutes, to be implemented within 90 days...
QRTAs to also ensure that the Recovery Point Objective (RPO) - the maximum tolerable period for which data might be lost due to a major incident- shall be 15 minutes.
Solution architecture of PDC and NS should ensure high availability, fault tolerance, no single point of failure, zero data loss, and data and transaction integrity.
Solution architecture of PDC and DRS should ensure high availability, fault tolerance, no single point of failure and data and transaction integrity.
You have read the preview. Create a free account to read the full document and see every order that applied it.
Free accounts include 10 searches/day with full text access.
Source: SecMarx — Guidelines for Business Continuity Plan (BCP) and Disaster Recovery (DR) of Qualified RTAs (QRTAs). Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.