Consolidated Cybersecurity and Cyber Resilience Framework for SEBI Regulated Entities

SEBI has issued Consultation Paper on Consolidated Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities(REs) on July 04, 2023. The framework provides following compliances for REs:

IDENTIFY

1. REs shall identify and classify critical assets based on their sensitivity and criticality for business operations, services and data management. The Board / Partner / Proprietor of the REs shall approve the list of critical systems.
2. REs shall formulate a comprehensive cybersecurity and cyber resilience policy and incorporate best practices from standards such as ISO 27001, COBIT 5, etc.
3. Comprehensive scenario-based testing shall be done for assessing risk related to cybersecurity in REs’ IT environment including both internal and external cyber-risks.
4. REs shall be solely accountable for all aspects related to third-party services taken including (but not limited to) confidentiality, integrity, availability, non-repudiation, and security of its data and logs, and ensuring compliance with laws, regulations, circulars, etc. issued by SEBI / Government of India. Accordingly, REs shall be responsible and accountable for any violation of the same.

PROTECT

1. Strong log retention policy, password policy and access policy shall be documented and implemented.
2. REs shall implement network segmentation techniques to restrict access to the sensitive information, hosts, and services.
3. Layering of Full-disk Encryption (FDE) along with File-based Encryption (FE) shall be used for data protection.
4. For the development of all critical software / applications and further feature enhancements, there shall be separate Development, System Integration Testing, User Acceptance Testing and Quality Assurance environments.
5. Periodic audit shall be conducted by a CERT-In empanelled auditor to audit the implementation and compliance to standards mentioned in the consolidated CSCRF.
6. Vulnerability Assessment and Penetration Testing (VAPT) shall be done to detect open vulnerabilities in the IT environment for critical assets and infrastructure components as defined in the framework. A comprehensive VAPT scope has also been added.
7. Application Programming Interface (API) security and Endpoint security solution shall be implemented with rate limiting, throttling, and proper authentication and authorisation mechanisms.
8. Applicable to MIIs: ISO 27001 certification shall be mandatory for MIIs as it provides essential security standards with respect to Information Security Management System (ISMS).
9. Applicable to MIIs: MIIs shall conduct self-assessment of their cyber resilience using Cyber Capability Index (CCI) on a quarterly basis.

DETECT

1. REs shall establish appropriate security mechanism through Security Operation Centre (SOC) [RE’s own SOC, third-party SOC, or a managed SOC] for continuous monitoring of security events and timely detection of anomalous activities.
2. Functional efficacy of SOC shall be measured on a half-yearly basis. A quantifiable method and indicative (but not limited to) list of parameters for measuring SOC efficacy has been formulated.
3. Applicable to MIIs: MIIs shall conduct red teaming exercise as part of their cybersecurity framework.

RESPOND

1. All REs shall formulate an up-to-date Cyber Crisis Management Plan (CCMP).
2. Comprehensive Incident Response management plan and respective SOPs shall be established by REs.
3. Alerts generated from monitoring and detection systems shall be suitably investigated for Root Cause Analysis (RCA).

RECOVER

1. A comprehensive response and recovery plan shall be documented and get triggered for the timely restoration of systems affected by the cyber incident.
2. An indicative (but not limited to) recovery plan has been attached.
3. Actions taken during recovery process shall be informed to all related stakeholders.

Framework compliance reporting shall be done by REs to their respective authorities in the standardized formats notified by SEBI.