The Cybersecurity and Cyber Resilience Framework (CSCRF) imposes specific core obligations on all SEBI regulated entities (REs). These obligations are designed to ensure that REs have robust cybersecurity measures in place. This article provides a comprehensive technical analysis of these core obligations.
Regulatory Basis
The CSCRF core obligations are derived from the primary circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated August 20, 2024, and subsequent clarifications.
Core Obligations
1. Governance and Oversight
Requirement: REs must establish a governance structure for cybersecurity.
Key Elements:
- Clear roles and responsibilities
- CISO reporting directly to MD/CEO
- Board-level oversight
- Regular reporting to senior management
Implementation:
- Appoint a CISO
- Define cybersecurity roles
- Establish reporting lines
- Conduct regular board reviews
2. Cybersecurity Policy
Requirement: REs must have a comprehensive cybersecurity and cyber resilience policy.
Key Elements:
- Risk assessment framework
- Security controls
- Incident response procedures
- Business continuity plans
- Third-party risk management
Implementation:
- Develop a written policy
- Get board approval
- Communicate to all employees
- Review and update regularly
3. Risk Assessment
Requirement: REs must conduct regular cybersecurity risk assessments.
Key Elements:
- Identify assets and threats
- Assess vulnerabilities
- Evaluate risks
- Prioritize remediation
Implementation:
- Conduct annual risk assessments
- Update risk registers
- Implement risk mitigation measures
4. Vulnerability Assessment and Penetration Testing
Requirement: REs must conduct regular VAPT.
Key Elements:
- Identify vulnerabilities
- Test security controls
- Remediate findings
- Submit reports
Implementation:
- Conduct VAPT annually
- Remediate findings immediately
- Submit closure of findings within 3 months
5. Incident Response
Requirement: REs must have incident response capabilities.
Key Elements:
- Incident detection
- Response procedures
- Communication protocols
- Recovery plans
Implementation:
- Develop an incident response plan
- Train staff on procedures
- Conduct incident response drills
6. Business Continuity and Disaster Recovery
Requirement: REs must have BCP and DR capabilities.
Key Elements:
- Business continuity plans
- Disaster recovery sites
- Regular DR drills
Implementation:
- Conduct DR drills quarterly
- Test on live trading days
- Document and retain records
7. Third-Party Risk Management
Requirement: REs must manage risks from third-party vendors.
Key Elements:
- Vendor assessment
- Contractual obligations
- Ongoing monitoring
Implementation:
- Assess vendor cybersecurity
- Include cybersecurity in contracts
- Monitor vendor compliance
8. Data Protection and Privacy
Requirement: REs must protect client data.
Key Elements:
- Data classification
- Encryption
- Access controls
- Data localization
Implementation:
- Classify data by sensitivity
- Implement encryption
- Restrict access
- Ensure data localization
9. Awareness and Training
Requirement: REs must train employees on cybersecurity.
Key Elements:
- Security awareness training
- Phishing simulations
- Role-based training
Implementation:
- Conduct annual training
- Test employee awareness
- Document training records
10. Compliance and Audit
Requirement: REs must demonstrate compliance.
Key Elements:
- Regular audits
- Compliance reporting
- Remediation of findings
Implementation:
- Conduct internal audits
- Submit compliance reports
- Remediate audit findings
Categorization of REs
SEBI has categorized REs into five categories based on:
- Extent of operations
- Trade volume
- Number of clients
- Other relevant factors
Each category has different compliance requirements and timelines.
Common Compliance Gaps
1. No CISO
Some REs do not have a CISO.
Solution: Appoint a CISO.
2. No VAPT
Some REs do not conduct VAPT.
Solution: Conduct regular VAPT.
3. No BCP/DR
Some REs do not have BCP/DR plans.
Solution: Develop and test BCP/DR plans.
4. No Incident Response Plan
Some REs do not have incident response plans.
Solution: Develop and implement incident response plans.
Conclusion and How Anuj Desai & Associates Can Help
CSCRF core obligations are comprehensive and require significant effort to implement.
Anuj Desai & Associates offers specialized services to help REs comply with CSCRF:
- CISO advisory
- Policy development
- VAPT implementation
- BCP/DR planning
- Incident response planning
- Compliance audit and advisory
Contact us today to ensure your CSCRF compliance. Our team will guide you through the process.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers are advised to consult qualified professionals for legal and compliance matters. Anuj Desai & Associates is a SEBI compliance consulting firm based in India.