Modification in Cyber Security and Cyber resilience framework for Stock Brokers / Depository Participants

SEBI/HO/MIRSD/TPD/P/CIR/2022/80 · 2022-06-07 · SEBI

Summary

This circular modifies the Cyber Security and Cyber Resilience framework for Stock Brokers and Depository Participants by updating specific paragraphs of a 2018 directive. It mandates rigorous asset classification, periodic Vulnerability Assessment and Penetration Tests (VAPT) by CERT-In empaneled agencies, and comprehensive annual cyber audits. Additionally, it requires immediate remediation of vulnerabilities, submission of compliance declarations, and implementation reporting within ten days.

Text

In partial modification to Annexure -1 of SEBI circular dated December 03, 2018, the paragraph-11, 41, 42 and 44 shall be read as under:

Stock Brokers / Depository Participants shall identify and classify critical assets based on their sensitivity and criticality for business operations, services and data management... The Board/Partners/Proprietor of the Stock Brokers / Depository Participants shall approve the list of critical systems.

To this end, Stock Brokers / Depository Participants shall maintain up-to-date inventory of its hardware and systems, software and information assets (internal and external), details of its network resources, connections to its network and data flows.

Stock Brokers / Depository Participants shall carry out periodic Vulnerability Assessment and Penetration Tests (VAPT) which inter-alia include critical assets and infrastructure components... in order to detect security vulnerabilities in the IT environment and in-depth evaluation of the security posture of the system through simulations of actual attacks on its systems and networks.

Stock Brokers / Depository Participants shall conduct VAPT at least once in a financial year. All Stock Brokers / Depository Participants are required to engage only CERT-In empaneled organizations for conducting VAPT.

The final report on said VAPT shall be submitted to the Stock Exchanges / Depositories after approval from Technology Committee of respective Stock Brokers / Depository Participants, within 1 month of completion of VAPT activity.

In addition, Stock Brokers / Depository Participants shall perform vulnerability scanning and conduct penetration testing prior to the commissioning of a new system which is a critical system or part of an existing critical system.

Any gaps/vulnerabilities detected shall be remedied on immediate basis and compliance of closure of findings identified during VAPT shall be submitted to the Stock Exchanges / Depositories within 3 months post the submission of final VAPT report.

Further, the Stock Brokers / Depository Participants are mandated to conduct comprehensive cyber audit at least once in a financial year.

All Stock Brokers / Depository Participants shall submit with Stock Exchange/Depository a declaration from the MD/ CEO/ Partners/ Proprietors certifying compliance by the Stock Brokers / Depository Participants with all SEBI Circulars and advisories related to Cyber security from time to time, along with the Cyber audit report.

Stock Brokers / Depository Participants shall take necessary steps to put in place systems for implementation of the circular.

All Stock Brokers / Depository Participants are directed to communicate the status of the implementation of the provisions of this circular to Stock Exchanges / Depositories within 10 days from the date of this Circular.

Source: SecMarx — Modification in Cyber Security and Cyber resilience framework for Stock Brokers / Depository Participants. Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.