5.1 SEBI Cyber Security Framework Overview
SEBI's Cyber Security and Cyber Resilience Framework (CSCRF) mandates comprehensive cyber security measures for all market intermediaries, recognizing that cyber threats pose systemic risks to financial markets.
Regulatory Foundation
The framework has evolved through multiple SEBI circulars:
- 2015 Circular: Initial cyber security framework for stock exchanges and depositories
- 2018 Circular: Extended to all market intermediaries including brokers
- 2022 Circular: Enhanced requirements - SOC, VAPT, incident response
- 2024 Updates: Strengthened reporting and recovery time objectives
Applicability
| Category | Entities | Framework Tier |
|---|---|---|
| Market Infrastructure | Stock Exchanges, Clearing Corporations, Depositories | Tier 1 (Highest) |
| Large Intermediaries | Top brokers by volume, large MFs, custodians | Tier 2 |
| Medium Intermediaries | Mid-size brokers, RTAs, Merchant Bankers | Tier 3 |
| Small Intermediaries | Small brokers, Investment Advisers, RAs | Tier 4 |
SEBI follows a graded approach - requirements scale based on entity size and systemic importance. Tier 1 entities face most stringent requirements; Tier 4 has proportionate compliance.
5.2 Security Operations Center (SOC)
The SOC requirement is central to CSCRF. Market intermediaries must establish or outsource SOC capabilities for 24x7 security monitoring.
SOC Requirements
SOC Functions
- Continuous Monitoring: 24x7 monitoring of all network traffic and systems
- Threat Detection: Real-time detection of security events and anomalies
- Incident Response: First responder for security incidents
- Log Analysis: Centralized log management and correlation
- Vulnerability Management: Track and remediate vulnerabilities
Technical Controls
| Control | Requirement | Tier Applicability |
|---|---|---|
| SIEM | Security Information and Event Management | Tier 1-3 |
| EDR | Endpoint Detection and Response | Tier 1-2 |
| WAF | Web Application Firewall | All Tiers |
| DLP | Data Loss Prevention | Tier 1-2 |
| MFA | Multi-Factor Authentication | All Tiers |
When advising intermediaries on SOC compliance, assess: (1) In-house capability vs. outsourcing economics, (2) SEBI-empaneled SOC provider selection, (3) SLA terms for outsourced SOC - ensure RTO/RPO commitments align with SEBI requirements.
5.3 Incident Reporting to SEBI
Timely incident reporting is mandatory. Failure to report or delayed reporting attracts penalties and regulatory scrutiny.
Reportable Incidents
- Data Breach: Unauthorized access to client/transaction data
- System Compromise: Malware infection, ransomware attack
- Service Disruption: DDoS attacks affecting trading systems
- Unauthorized Trading: Fraudulent orders through compromised systems
- Website Defacement: Unauthorized modification of public-facing systems
Reporting Timelines
| Report Type | Timeline | Recipient |
|---|---|---|
| Initial Report | Within 6 hours of detection | SEBI + CERT-In |
| Detailed Report | Within 48 hours | SEBI |
| Root Cause Analysis | Within 14 days | SEBI |
| Quarterly Summary | Within 15 days of quarter end | SEBI |
The 6-hour initial reporting window begins from DETECTION, not from containment or investigation completion. Report immediately with available information; details can follow in subsequent reports.
Report Contents
5.4 Business Continuity Requirements
Business Continuity Planning (BCP) and Disaster Recovery (DR) are mandatory components of CSCRF, ensuring market stability during cyber incidents.
BCP Components
- Business Impact Analysis: Identify critical processes and acceptable downtime
- Risk Assessment: Evaluate cyber threat scenarios
- Recovery Strategy: Define RTO/RPO for each system
- DR Site: Geographically separated disaster recovery facility
- Testing: Regular BCP/DR drills and exercises
Recovery Time Objectives
| Entity Type | Critical Systems RTO | DR Site Requirement |
|---|---|---|
| Stock Exchanges | 4 hours | Synchronous replication, 100km+ distance |
| Clearing Corporations | 4 hours | Synchronous replication, 100km+ distance |
| Depositories | 4 hours | Near-synchronous, same day recovery |
| Large Brokers (Tier 2) | Same trading day | Asynchronous acceptable |
| Other Intermediaries | Next trading day | Periodic backup sufficient |
SEBI mandates annual DR drills for Tier 1-2 entities. Document drill results, gaps identified, and remediation plans. Incomplete or failed drills must be reported to SEBI with corrective action timelines.
Cyber Insurance
While not mandatory, SEBI recommends cyber insurance covering:
- First-party losses: Business interruption, data recovery costs
- Third-party claims: Client claims for data breach
- Regulatory costs: Investigation and penalty costs
- Crisis management: PR, forensics, legal costs
5.5 Audit and Compliance Requirements
Regular audits and assessments validate CSCRF compliance. Both internal and external audits are mandated.
VAPT Requirements
Audit Framework
| Audit Type | Frequency | Auditor Requirement |
|---|---|---|
| VAPT | Quarterly/Annual | CERT-In empaneled |
| Cyber Security Audit | Annual | CERT-In empaneled |
| SOC Audit | Annual | Qualified IS Auditor |
| Internal Audit | Half-yearly | Internal or external |
| DR Drill | Annual minimum | Internal with external verification |
Board Oversight
- Board-level IT Committee: Mandatory for Tier 1-2 entities
- CISO Appointment: Chief Information Security Officer designation required
- Board Reporting: Quarterly cyber security status to board
- Policy Approval: Board must approve cyber security policy annually
Maintain comprehensive documentation: (1) CSCRF compliance matrix, (2) Audit reports and remediation tracking, (3) Incident reports and RCA, (4) BCP/DR test results, (5) Training records. SEBI may call for records during inspection.
Key Takeaways
- Tiered framework: Requirements scale based on entity size and systemic importance
- SOC mandatory: Tier 1-2 need dedicated SOC; Tier 3-4 can outsource
- 6-hour reporting: Initial incident report within 6 hours of detection
- 4-hour RTO: Critical systems for exchanges and clearing corporations
- CERT-In empaneled: VAPT and cyber audits must use CERT-In empaneled auditors
- Board oversight: IT Committee, CISO appointment, quarterly reporting mandatory
Part 5 Assessment
Test Your Understanding
10 questions on SEBI Cyber Security Framework, SOC, and incident reporting