Guidelines for Business Continuity Plan (BCP) and Disaster Recovery (DR) of Market Infrastructure Institutions (MIIs)

SEBI/HO/MRD1/DTCS/CIR/P/2021/33 · 2021-03-22 · SEBI

Summary

This circular updates the framework for Business Continuity Plans and Disaster Recovery for Market Infrastructure Institutions to reduce recovery times. It mandates specific technical configurations, including a 45-minute Recovery Time Objective and zero data loss via Near Site infrastructure. The document outlines testing protocols, policy documentation requirements, and a transition period for compliance.

Text

Upon examination and based on consultation with MIIs and Technical Advisory Committee (TAC) of SEBI, the modified framework for BCP and DR shall be as under:

Stock Exchanges, Clearing Corporations and Depositories (collectively referred as Market Infrastructure Institutions – MIIs) shall have in place BCP and DRS so as to maintain data and transaction integrity.

Apart from DRS, all MIIs including Depositories shall also have a Near Site (NS) to ensure zero data loss.

The DRS should preferably be set up in different seismic zones and in case due to certain reasons such as operational constraints, change of seismic zones, etc., minimum distance of 500 kilometer shall be ensured between PDC and DRS so that both DRS and PDC are not affected by the same disaster.

The manpower deployed at DRS/NS shall have the same expertise as available at PDC... MIIs shall have sufficient number of trained staff at their DRS so as to have the capability of running live operations from DRS without involving staff of the PDC.

All MIIs shall constitute an Incident and Response team (IRT)/ Crisis Management Team (CMT), which shall be chaired by the Managing Director (MD) of the MII or by the Chief Technology Officer (CTO)... IRT/ CMT shall be responsible for the actual declaration of disaster, invoking the BCP and shifting of operations from PDC to DRS whenever required.

The Technology Committee of the MIIs shall review the implementation of BCP- DR policy approved by the Governing board of the MII on a quarterly basis.

MIIs shall conduct periodic training programs to enhance the preparedness and awareness level among its employees and outsourced staff, vendors, etc. to perform as per BCP policy.

Hardware, system software, application environment, network and security devices and associated application environments of DRS / NS and PDC shall have one to one correspondence between them.

MIIs should test such switchover functionality by conducting unannounced live trading from its DRS for at least 1 day in every six months. Unannounced live trading from DRS of MIIs shall be done at a short notice of 45 minutes after 90 days from the date of this circular.

In the event of disruption of any one or more of the ‘Critical Systems’... the MII shall, within 30 minutes of the incident, declare that incident as ‘Disaster’ and take measures to restore operations including from DRS within 45 minutes of the declaration of ‘Disaster’. Accordingly, the Recovery Time Objective(RTO)... shall be 45 minutes, to be implemented within 90 days from the date of the circular.

MIIs to also ensure that the Recovery Point Objective (RPO) - the maximum tolerable period for which data might be lost due to a major incident- shall be 15 minutes.

Source: SecMarx — Guidelines for Business Continuity Plan (BCP) and Disaster Recovery (DR) of Market Infrastructure Institutions (MIIs). Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.