SEBI Modifies Cybersecurity, Cyber Resilience Framework for KRAs, Mandates Cyber Audit Twice a Year

SEBI’s new framework will come into force with immediate effect, with KRAs communicating the status of the implementation within 10 days.

By Press Trust of India | Updated: 31 May 2022 14:23 IST

SEBI Modifies Cybersecurity, Cyber Resilience Framework for KRAs, Mandates Cyber Audit Twice a Year

KRAs are required to conduct VAPT at least once in a financial year

Highlights

SEBI mandated KRAs to conduct a comprehensive cyber audit
KRAs are required to identify and classify critical assets
KRAs board will be required to approve the list of critical systems

Capital markets regulator SEBI on Monday changed the cybersecurity and the cyber resilience framework of KYC Registration Agencies (KRAs) and mandated them to conduct a comprehensive cyber audit at least twice in a financial year. Along with the cyber audit report, all KRAs have been instructed to submit a statement from the MD and CEO certifying compliance by them with all of SEBI's cybersecurity-related guidelines and notices issued periodically, according to a circular.

Under the revised framework, KRAs are required to identify and classify critical assets based on their sensitivity and criticality to business operations, services and data management.

Critical assets should include business-critical systems, internet-facing applications/systems, systems containing sensitive data, sensitive personal data, sensitive financial data, personally identifiable information data, among others. All ancillary systems used to access or communicate with critical systems, whether for operations or maintenance, must also be classified as critical systems.

Samsung Wins Patent for a Tri-Fold Smartphone With Specialised Barrier Layer for Improved Durability

In addition, the KRAs board will be required to approve the list of critical systems.

"To this end, KRA must maintain an up-to-date inventory of its hardware and systems, software and information assets (internal and external), details of its network resources, connections to its network and data flows," SEBI said.

According to SEBI, KRAs must conduct regular Vulnerability Assessments and Penetration Tests (VAPT) that includes all infrastructure components and critical assets such as servers, network systems, security devices and other IT systems to detect security vulnerabilities in the IT environment and an in-depth evaluation of the security posture of the system through simulations of real attacks on your systems and networks.

SpiceJet Says Q4 2021 Earnings Delayed Due to Ransomware Attack

In addition, the regulator said that KRAs must conduct VAPT at least once in a financial year.

However, for KRAs whose systems have been identified as a "protected system" by the National Critical Information Infrastructure Protection Center (NCIIPC), SEBI said, VAPT must be performed at least twice in a fiscal year.

Furthermore, all KRAs are required to engage only CERT-In integrated organisations to conduct VAPT.

The final report on the VAPT must be submitted to SEBI after the approval of the technology standing committee of the respective KRA, within a month from the end of the VAPT activity.

"Any gaps/vulnerabilities detected must be remedied immediately and the closure compliance of the findings identified during VAPT will be sent to SEBI within 3 months after VAPT's final report is submitted to Sebi," the regulator said.

In addition, KRAs must also perform vulnerability scans and penetration tests prior to the roll-out of a new system that is a critical system or part of an existing critical system.

The new framework will come into force with immediate effect, SEBI said, adding that all KRAs must communicate the status of the implementation of the circular to the regulator within 10 days.

How is Alexa faring in India? We discuss this on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.