SEBI has introduced the Cybersecurity and Cyber Resilience Framework (CSCRF) to enhance the security posture of regulated entities. This article explains the CSCRF requirements for portfolio managers.
What is CSCRF?
Definition
The CSCRF is a comprehensive set of guidelines designed to enhance both cybersecurity and cyber resilience maturity of the entities regulated by SEBI. It is based on five cyber resiliency goals: Anticipate, Withstand, Contain, Recover and Evolve.
Applicability
The CSCRF is applicable to various SEBI-regulated entities, including portfolio managers.
Objective
The framework aims to safeguard IT infrastructure, protect sensitive data, and ensure resilience in the face of cyber threats.
Key Requirements
Cybersecurity Policy
All regulated entities are required to put in place a comprehensive cybersecurity and cyber resilience policy.
Governance
Portfolio managers must designate a senior official as Chief Information Security Officer (CISO). The Board or equivalent body shall constitute a Technology Committee to review implementation.
Identify
Portfolio managers must identify and classify critical assets based on their sensitivity and criticality for business operations, services, and data management.
Protect
Access Controls:
- No person by virtue of rank or position should have any intrinsic right to access confidential data
- Access should be on a need-to-use basis and based on the principle of least privilege
- Two-factor authentication at log-in for all users connecting using online/internet facility
Network Security:
- Network security devices such as firewalls as well as intrusion detection and prevention systems
- Anti-virus software on servers and other computer systems
Data Protection:
- Data-in motion and Data-at-rest should be in encrypted form
- Measures to prevent unauthorized access or copying or transmission of data
Detect
- Security monitoring systems and processes for continuous monitoring
- Appropriate security monitoring systems and processes to facilitate continuous monitoring of security events
Respond and Recover
Incident Response:
- All cyber-attacks, threats, cyber-incidents, and breaches shall be reported to SEBI within 6 hours of noticing/detecting such incidents
Recovery Objectives:
- Recovery Time Objective (RTO) not more than 4 hours
- Recovery Point Objective (RPO) not more than 30 minutes
Categorisation
Revised Categories
SEBI has revised the categorization rules for PMS providers with respect to the implementation of CSCRF. Portfolio managers have been re-categorised based on asset thresholds and activity levels.
Self-Certified Entities
Self-Certified entities must submit an annual self-declaration of CSCRF compliance to SEBI. No quarterly reporting is required for Self-Certified entities.
Compliance Timeline
Implementation Deadline
The timeline for compliance with the CSCRF remains June 30, 2025, and cyber audits from FY 2025-26 onwards must adhere to the framework.
Cyber Audits
Cyber audits from FY 2025-26 onwards must adhere to the framework and clarifications.
Exemptions and Equivalence
Principle of Exclusivity
CSCRF applies to systems exclusively used for SEBI-related activities.
Principle of Equivalence
Equivalent cybersecurity measures followed under another regulator's framework may be accepted.
Consequences of Non-Compliance
Regulatory Action
Non-compliance with CSCRF can result in enforcement action by SEBI.
Reputational Damage
Cybersecurity incidents can cause significant reputational damage.
Expert Legal Guidance
Anuj Desai & Associates provides expert legal advisory services on CSCRF compliance for portfolio managers. Our securities law experts help clients implement compliant cybersecurity frameworks, conduct required audits, and ensure regulatory compliance. Contact us for guidance on CSCRF and other regulatory matters.