Cyber Security & Cyber Resilience framework for Stock Brokers / Depository Participants - Clarifications
Summary
This circular clarifies the submission timelines and formats for quarterly cyber security reports by stock brokers and depository participants. It specifies that auditors must hold specific certifications such as CERT-IN empanelment, DISA, CISA, CISM, or CISSP to audit compliance. The document also defines the audit periodicity, distinguishing between annual audits for most entities and half-yearly audits for Type III stock brokers.
Text
Quarterly reports containing information on cyber-attacks and threats experienced by Stock Brokers / Depository Participants and measures taken to mitigate vulnerabilities, threats and attacks including information on bugs / vulnerabilities / threats that may be useful for other Stock Brokers / Depository Participants should be submitted to Stock Exchanges / Depositories.
For the quarter ended on September 30, 2019, quarterly reports shall be submitted by stock brokers / depository participants not later than November 30, 2019 as per the format specified.
Effective from quarter ending on December 31, 2019, the time period for submission of the report shall be 15 days after the end of the quarter.
Auditors qualified in following certifications can audit the systems of depository participants and stock brokers to check the compliance of Cyber Security and Cyber Resilience provisions: CERT-IN empanelled auditor, an independent DISA (ICAI) Qualification, CISA (Certified Information System Auditor) from ISACA, CISM (Certified Information Securities Manager) from ISACA, CISSP (Certified Information Systems Security Professional) from International Information Systems Security Certification Consortium (commonly known as (ISC)2).
The periodicity of audit for the purpose of compliance with Cyber Security and Cyber Resilience provisions for depository participants shall be annual. The periodicity of audit for the compliance with the provisions of Cyber Security and Cyber Resilience provisions for stock brokers, irrespective of number of terminals and location presence, shall be as under: Type I Annual, Type II Annual, Type III Half-yearly.
Stock Exchanges and Depositories shall a) make necessary amendments to the relevant byelaws, rules and regulations for the implementation of the above direction; b) bring the provisions of this circular to the notice of their members and depository participants respectively and also disseminate the same on their websites; and c) communicate to SEBI, the status of implementation of the provisions of this circular in their Monthly Report.
This circular is being issued in exercise of powers conferred under Section 11 (1) of the Securities and Exchange Board of India Act, 1992 and Section 19 of the Depositories Act to protect the interests of investors in securities and to promote the development of, and to regulate the securities market.
Source: SecMarx — Cyber Security & Cyber Resilience framework for Stock Brokers / Depository Participants - Clarifications. Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.