Modification in Cyber Security and Cyber resilience framework of KYC Registration Agencies (KRAs)

SEBI/HO/MIRSD/DoP/P/CIR/2022/74 · 2022-05-30 · SEBI

Summary

This circular modifies the Cyber Security and Cyber Resilience framework for KYC Registration Agencies (KRAs) by updating specific paragraphs of a 2019 directive. It mandates KRAs to classify critical assets, conduct regular vulnerability assessments, and perform comprehensive cyber audits twice a year. Additionally, it requires immediate remediation of vulnerabilities, submission of audit reports with CEO certification, and implementation status updates to SEBI.

Text

In partial modification to Annexure A of SEBI circular dated October 15, 2019, the paragraph-11, 40, 41 and 42 shall be read as under:

KRAs shall identify and classify critical assets based on their sensitivity and criticality for business operations, services and data management. The Board of the KRAs shall approve the list of critical systems.

To this end, KRAs shall maintain up-to-date inventory of its hardware and systems, software and information assets (internal and external), details of its network resources, connections to its network and data flows.

KRAs shall carry out periodic vulnerability assessment and penetration tests (VAPT)... in order to detect security vulnerabilities in the IT environment... KRAs shall conduct VAPT at least once in a financial year. However, for the KRAs, whose systems have been identified as “protected system” by NCIIPC under the Information Technology (IT) Act, 2000, VAPT shall be conducted at least twice in a financial year.

Further, all KRAs are required to engage only CERT-In empaneled organizations for conducting VAPT.

The final report on said VAPT shall be submitted to SEBI after approval from Technology Committee of respective KRAs, within one month of completion of VAPT activity.

Any gaps/vulnerabilities detected shall be remedied on immediate basis and compliance of closure of findings identified during VAPT shall be submitted to SEBI within 3 months post the submission of final VAPT report.

In addition, KRAs shall perform vulnerability scanning and conduct penetration testing prior to the commissioning of a new system which is a critical system or part of an existing critical system.

Further, the KRAs are mandated to conduct comprehensive cyber audit at least twice a financial year. All KRAs shall submit a declaration from the MD/ CEO certifying compliance by the KRAs with all SEBI Circulars and advisories related to Cyber security from time to time, along with the cyber audit report.

KRAs shall take necessary steps to put in place systems for implementation of the circular.

All KRAs are directed to communicate the status of the implementation of the provisions of this circular to SEBI within 10 days from the date of this Circular.

The provisions of the Circular shall come into force with immediate effect.

Source: SecMarx — Modification in Cyber Security and Cyber resilience framework of KYC Registration Agencies (KRAs). Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.