Testing Framework for the Information Technology (IT) systems of the Market Infrastructure Institutions (MIIs)

SEBI/HO/MRD/TPD/P/CIR/2023/65 · 2023-05-05 · SEBI

Summary

This circular mandates Market Infrastructure Institutions to establish a comprehensive testing framework for their IT systems throughout the lifecycle. It directs MIIs to implement specific testing methodologies, including functional, security, and regression testing, approved by their Standing Committee on Technology. The directive requires MIIs to submit their approved testing frameworks within 30 days of the circular's issuance.

Text

MIIs are systemically important institutions... it is imperative to devise a comprehensive testing framework to manage the IT systems/applications of MIIs throughout their lifecycle, which can assist the MIIs in performing thorough risk assessment before deploying any IT systems in production/ live environment.

All MIIs should do extensive testing, validation and documentation whenever new systems/ applications or changes to existing systems/applications are introduced before the deployment in production/live environment.

A comprehensive methodology for system testing, functional testing, application security testing should be established and the same shall be approved by Standing Committee on Technology (SCOT) of respective MIIs.

Testing should be carried out in a separate environment that replicates/mirrors the production environment in order to minimize any disruption.

All MIIs shall have the practice of traceability matrix to ensure that the test plan covers all intended functionality of the IT system and application.

All MIIs shall adopt the practice of using automated testing techniques to run the test cases automatically, which may increase the depth and scope of tests and ultimately help to improve the software quality.

All MIIs shall establish policy/procedures on the use of third party systems/applications/software codes to ensure these systems are subject to review and testing before they are integrated with the systems of the MIIs.

All MIIs shall ensure that core code components operate as intended and do not produce unintended consequences... All MIIs shall also ensure that Application Programming Interface Testing is done so that the concerned application can interact with other applications without causing disruptions of any kind.

All MIIs should perform regression testing for changes... to an existing IT system to validate that it continues to function properly after the changes have been implemented.

All MIIs may institute tools to measure test/code coverage to assess comprehensiveness of the test.

All Issues identified from testing... should be properly tracked and remediated immediately. Major issues that could have an adverse impact on the MII should be reported to their SCOT and addressed prior to deployment to the production environment.

All MIIs should ensure that the results of all testing, including results of User Acceptance Testing (UAT), that was conducted, are documented in the test report. The same shall be checked by the auditor during System and Network Audit.

Source: SecMarx — Testing Framework for the Information Technology (IT) systems of the Market Infrastructure Institutions (MIIs). Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.