QSB Cybersecurity Obligations — Why the Bar Is Higher Than for Other Brokers

QSBs handle sensitive data of a large number of investors, making them prime targets for cyber-attacks. Any cyber-attack on the systems of a QSB can compromise the confidentiality and integrity of such data. This article explains why the cybersecurity bar is higher for QSBs, the additional features required, and the half-yearly audit and VAPT obligations.

The Regulatory Basis

The cybersecurity obligations for QSBs are specified in SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/24 dated February 06, 2023.

Why the Bar Is Higher

Volume of Sensitive Data

QSBs handle sensitive data of a large number of investors in the securities market. Any cyber-attack on the systems of a QSB can compromise the confidentiality and integrity of such data.

Systemic Importance

QSBs are systemically important brokers. A successful cyber-attack on a QSB could have widespread impact on the securities market and investor confidence.

Higher Risk Profile

Given their size and market presence, QSBs are more likely to be targeted by sophisticated cyber-attacks. They must therefore have commensurately stronger defences.

Additional Cybersecurity Features Required

Dedicated Team of Security Analysts

QSBs shall have a dedicated team of security analysts, which may include domain experts in the field of cyber security and resilience, network security and data security. This team shall carry out the following activities:

• Prevention: Continuous threat analysis, network and host scanning for vulnerabilities and breaches, deploying adequate and appropriate technology to prevent attacks originating from external environment and internal controls to manage insider threats.
• Monitoring, Detection and Analysis: Potential intrusions/security incidents in real-time and through historical trending on security-relevant data sources.
• Network Defence: Operating network defence technologies such as Intrusion Detection Systems (IDSes) and data collection/analysis systems.
• Cyber-Attack Simulation: Conducting cyber-attack simulation on quarterly basis to aid in developing cyber resiliency measures and test the adequacy and effectiveness of the framework adopted.
• Awareness and Training: Conducting awareness and training programs for its employees with regard to cyber security and situational awareness on quarterly basis.
• Prevention of Recurrence: Prevention of attacks similar to those already faced.

Chief Information Security Officer (CISO)

• The dedicated team of security analysts shall report to the Chief Information Security Officer (CISO) of the QSB.
• Such CISO shall be designated as a Key Managerial Personnel (KMP) and shall directly report to the MD & CEO of the QSB.

Documented Processes

The QSB should have well-defined and documented processes for:

• Monitoring of its systems and networks.
• Analysis of cyber security threats and potential intrusions/security incidents.
• Usage of appropriate technology tools.
• Classification of threats and attacks.
• Escalation hierarchy of incidents.
• Response to threats and breaches.
• Reporting of the incidents.

Half-Yearly VAPT

QSBs shall carry out:

• Continuous assessment of the threat landscape faced by them.
• Vulnerability assessment on a half-yearly basis to detect security vulnerabilities in their IT environments exposed to internet.
• Penetration tests on a half-yearly basis to conduct an in-depth evaluation of the security posture of the system through simulations of actual attacks.

Business Continuity Plan (BCP)

• QSBs shall put in place a comprehensive Business Continuity Plan (BCP) and such policy shall be reviewed on half-yearly basis.
• QSBs shall develop and document mechanisms and standard operating procedures to recover from cyber-attacks within the stipulated Recovery Time Objective (RTO).
• The CISO of the QSB shall review the implementation of the BCP on a monthly basis and submit a report to the board.

Half-Yearly Cyber Audit

QSBs shall arrange to have their systems audited on half-yearly basis by a CERT-IN empanelled auditor to check compliance with the above mentioned requirements related to cyber security and technical glitches. The report shall be submitted to stock exchanges along with the comments of the cybersecurity committee within one month of completion of the half year.

How We Help

At Anuj Desai & Associates, we help QSBs establish robust cybersecurity frameworks, conduct VAPT, and ensure compliance with SEBI's enhanced cybersecurity requirements. If you need assistance with cybersecurity compliance, reach out to our regulatory compliance desk.