Cybersecurity and Cyber Resilience Framework for Stock Brokers — Core Obligations

SEBI has prescribed a comprehensive cybersecurity and cyber resilience framework for stock brokers to protect the integrity of data and guard against breaches of privacy. The framework, introduced through SEBI Circular SEBI/HO/MIRSD/CIR/PB/2018/147 dated December 3, 2018, requires all stock brokers to formulate a comprehensive Cyber Security and Cyber Resilience policy document. This article explains the core obligations, governance requirements, and key controls that brokers must implement.

The Regulatory Basis

Rapid technological developments in securities market have highlighted the need for maintaining robust cyber security and cyber resilience framework to protect the integrity of data and guard against breaches of privacy. Since stock brokers and depository participants perform significant functions in providing services to holders of securities, it is desirable that these entities have robust cyber security and cyber resilience framework.

The framework was designed after discussions with Exchanges, Depositories and Stock Brokers' and Depository Participants' associations. The guidelines are effective from April 1, 2019.

Governance Requirements

Cyber Security Policy

Stock Brokers should formulate a comprehensive Cyber Security and Cyber Resilience policy document encompassing the framework mentioned hereunder. In case of deviations, reasons for such deviations should be provided in the policy document.

Board/Partners/Proprietor Approval

The policy document should be approved by the Board / Partners / Proprietor of the Stock Broker.

Annual Review

The policy document should be reviewed by the Board / Partners / Proprietor at least annually with the view to strengthen and improve its Cyber Security and Cyber Resilience framework.

Designated Officer

Stock Brokers should designate a senior official or management personnel (the "Designated Officer") whose function would be to assess, identify, and reduce security and Cyber Security risks, respond to incidents, establish appropriate standards and controls, and direct the establishment and implementation of processes and procedures.

Technology Committee

The Board / Partners / Proprietor of the Stock Brokers shall constitute an internal Technology Committee comprising experts. This Technology Committee should on a half-yearly basis review the implementation of the Cyber Security and Cyber Resilience policy.

The Five Core Functions

The Cyber Security Policy should include the following process to identify, assess, and manage Cyber Security risk:

• Identify: Critical IT assets and risks associated with such assets.
• Protect: Assets by deploying suitable controls, tools and measures.
• Detect: Incidents, anomalies and attacks through appropriate monitoring tools/processes.
• Respond: By taking immediate steps after identification of the incident, anomaly or attack.
• Recover: From incident through incident management and other appropriate recovery mechanisms.

Key Controls

Identification

Stock Brokers shall identify and classify critical assets based on their sensitivity and criticality for business operations, services and data management. The critical assets shall include business critical systems, internet facing applications / systems, systems that contain sensitive data, sensitive personal data, sensitive financial data, Personally Identifiable Information (PII) data, etc. All the ancillary systems used for accessing/communicating with critical systems shall also be classified as critical system.

Protection: Access Controls

• No person by virtue of rank or position should have any intrinsic right to access confidential data, applications, system resources or facilities.
• Any access to systems should be for a defined purpose and for a defined period.
• Access should be granted on a need-to-use basis and based on the principle of least privilege.
• All critical systems accessible over the internet should have two-factor security.
• Records of user access to critical systems should be maintained and stored in a secure location for a time period not less than two years.

Protection: Data Security

• Critical data must be identified and encrypted in motion and at rest by using strong encryption methods.
• Measures to prevent unauthorized access or copying or transmission of data / information should be implemented.
• The information security policy should also cover use of devices such as mobile phones, faxes, photocopiers, scanners, etc.
• Only authorized data storage devices should be allowed within the IT infrastructure.

Protection: Network Security Management

• Establish baseline standards to facilitate consistent application of security configurations.
• For algorithmic trading facilities, adequate measures should be taken to isolate and secure the perimeter.
• Install network security devices, such as firewalls, proxy servers, intrusion detection and prevention systems.

Vulnerability Assessment and Penetration Testing (VAPT)

Stock Brokers shall carry out periodic Vulnerability Assessment and Penetration Tests (VAPT) which inter-alia include critical assets and infrastructure components. Stock Brokers shall conduct VAPT at least once in a financial year. All Stock Brokers are required to engage only CERT-In empaneled organizations for conducting VAPT.

Monitoring and Detection

Stock Brokers should establish appropriate security monitoring systems and processes to facilitate continuous monitoring of security events / alerts and timely detection of unauthorised or malicious activities.

Incident Reporting

All Cyber-attacks, threats, cyber-incidents and breaches experienced by Stock Brokers shall be reported to Stock Exchanges & SEBI within six hours of noticing / detecting such incidents. This information shall be shared to SEBI through the dedicated e-mail id: sbdp-cyberincidents@sebi.gov.in.

Periodic Audit

Stock Brokers are mandated to conduct comprehensive cyber audit at least once in a financial year. All Stock Brokers shall submit with Stock Exchange a declaration from the MD / CEO / Partners / Proprietors certifying compliance by the Stock Brokers with all SEBI Circulars and advisories related to Cyber security from time to time, along with the Cyber audit report.

Cyber Audit Frequency

| Type of Stock Broker | Periodicity | | Type I | Annual | | Type II | Annual | | Type III | Half-yearly |

Systems Managed by Vendors

Where the systems of a Stock Broker are managed by vendors and the Stock Broker may not be able to implement some of the guidelines directly, the Stock Broker should instruct the vendors to adhere to the applicable guidelines and obtain the necessary self-certifications from them.

How We Help

At Anuj Desai & Associates, we help stock brokers develop and implement cybersecurity and cyber resilience policies, conduct VAPT, and ensure compliance with SEBI's framework. If you need assistance with cybersecurity compliance, reach out to our regulatory compliance desk.