Cyber Security & Cyber Resilience framework for KYC Registration Agencies

SEBI/HO/MIRSD/DOP/CIR/P/2019/111 · 2019-10-15 · Market Intermediaries Regulation and Supervision Department

Summary

This circular mandates that KYC Registration Agencies (KRAs) implement a robust Cyber Security and Cyber Resilience framework to protect data integrity and privacy. SEBI directs KRAs to comply with the detailed framework outlined in Annexure A by January 1, 2020. The framework requires KRAs to establish governance structures, identify risks, and enforce strict protection controls for their IT systems. This section mandates strict physical and network security controls for Key Infrastructure Entities, including access restrictions and encryption standards. It outlines requirements for application security, patch management, vulnerability assessments, and continuous monitoring of IT environments. Finally, it establishes protocols for incident response, recovery planning, periodic audits by certified professionals, and mandatory reporting to SEBI. This section provides a structured template for reporting cybersecurity incidents, detailing affected systems and incident types. It includes fields for describing symptoms, mitigation actions, and agencies notified during the event. The document concludes with questions regarding prior occurrences and the scope of affected hosts.

Text

KRAs are directed to take necessary steps to put in place systems for implementation of this circular by January 01, 2020.

KRAs should formulate a comprehensive Cyber Security and Cyber Resilience policy document... approved by the Board of KRAs... reviewed by the Board of KRAs atleast annually

The Cyber Security and Cyber Resilience policy should include the following process to identify, assess, and manage cyber security risk... Identify... Protect... Detect... Respond... Recover

KRAs should designate a senior official as Chief Information Security Officer (CISO) whose function would be to assess, identify and reduce cyber security risks...

The Board of the KRAs shall constitute a Technology Committee comprising experts proficient in technology. This Technology Committee should on a quarterly basis review the implementation of the Cyber Security and Cyber Resilience policy

KRAs should identify critical assets based on their sensitivity and criticality... maintain up-to-date inventory of its hardware and systems, software and information assets

KRAs should grant access to IT systems, applications, databases and networks on a need-to-use basis and based on the principle of least privilege.

KRAs should implement strong password controls for users’ access to systems... change of password upon first log-on, minimum password length and history, password complexity as well as maximum validity period.

KRAs should ensure that records of user access are uniquely identified and logged for audit and review purposes. Such logs should be maintained and stored in encrypted form for a time period not less than two (2) years.

Two-factor authentication at log-in should be implemented for all users that connect using online/internet facility.

Physical access to the critical systems should be revoked immediately if the same is no longer required.

KRAs should ensure that the perimeter of the critical equipment room are physically secured and monitored by employing physical, human and procedural controls such as the use of security guards, CCTVs, card access systems, mantraps, bollards, etc. where appropriate.

Source: SecMarx — Cyber Security & Cyber Resilience framework for KYC Registration Agencies. Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.