The Securities and Exchange Board of India (SEBI), in coordination with the Indian Computer Emergency Response Team (CERT-In), has issued an advisory for financial sector organizations regarding Software as a Service (SaaS) based solutions. This advisory highlights the risks associated with SaaS adoption and mandates compliance measures. This article provides a comprehensive technical analysis of this advisory.
Regulatory Basis
Primary Circular: SEBI/HO/MIRSD2/DOR/CIR/P/2020/221
SEBI issued the circular on "Advisory for Financial Sector Organizations regarding Software as a Service (SaaS) based solutions" on November 3, 2020. The advisory was based on inputs from CERT-In regarding the risks associated with SaaS adoption.
Reporting Requirement
The compliance of the advisory shall be reported by entities on a half-yearly basis.
The SaaS Advisory
Background
It has been learnt that some of the financial sector institutions are availing or thinking of availing Software as a Service (SaaS) based solution for managing their Governance, Risk & Compliance (GRC) functions so as to improve their cyber security posture.
Key Risk Identified
Many a time the risk and compliance data of the institution moves cross border beyond the legal and jurisdictional boundary of India due to the nature of shared cloud SaaS. While SaaS may provide ease of doing business and quick turnaround, it also brings significant risk to the overall health of India's financial sector with respect to data safety and security.
Critical Data Sets at Risk
If the following data sets fall in the hands of an adversary/cyber attacker, it may lead to an unprecedented increase in the attack surface area and weakening of Indian financial sector infrastructure's overall resilience:
- Credit Risk Data
- Liquidity Risk Data
- Market Risk Data
- System & Sub-System Information
- Internal & Partner IP Schema
- Network Topography & Design
- Audit/Internal Audit Data
- System Configuration Data
- System Vulnerability Information
- Risk Exception Information
- Supplier Information & its dependencies related Data
Advisory Recommendations
1. Layered Defence Approach
Financial sector organisations may be advised to protect such critical data using layered defence approach and seamless protection against external or insider threat.
2. Data Localisation
The organisations may also be advised to ensure complete protection and seamless control over their critical system by continuous monitoring through direct control and supervision protocol mechanisms while keeping such critical data within the legal boundary of India.
3. Reporting
The organisations may also be requested to report back to their respective regulatory authority regarding compliance to this advisory.
4. Periodic Updates
It is requested that you may kindly keep CERT-In informed of the actions taken and periodically provide the updated compliance to this advisory.
Compliance Requirements
1. Assessment
Assess whether your organization uses SaaS-based solutions for GRC functions.
2. Risk Evaluation
Evaluate the risks associated with SaaS adoption.
3. Data Localisation
Ensure critical data remains within India's legal boundaries.
4. Monitoring
Implement continuous monitoring through direct control and supervision protocol mechanisms.
5. Reporting
Report compliance on a half-yearly basis.
Applicability to RAs
| RA Type | SaaS Advisory Applicability |
|---|---|
| RA only | Applicable if using SaaS solutions |
| RA + other intermediary | Applicable |
| RA using SaaS for GRC | Applicable |
Common Compliance Gaps
1. Not Assessing SaaS Risks
Some RAs do not assess risks associated with SaaS.
Solution: Conduct a SaaS risk assessment.
2. Data Cross-Border
Some RAs allow critical data to move outside India.
Solution: Ensure data localisation.
3. No Reporting
Some RAs do not report compliance.
Solution: Submit half-yearly compliance reports.
4. No Monitoring
Some RAs do not monitor SaaS solutions.
Solution: Implement continuous monitoring.
Conclusion and How Anuj Desai & Associates Can Help
The SaaS advisory is a critical compliance requirement for financial sector organizations.
Anuj Desai & Associates offers specialized services to help RAs comply with the SaaS advisory:
- SaaS risk assessment
- Data localisation implementation
- Compliance reporting
- Continuous monitoring setup
- Compliance audit and advisory
Contact us today to ensure your SaaS practices comply with SEBI requirements. Our team will guide you through the process.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers are advised to consult qualified professionals for legal and compliance matters. Anuj Desai & Associates is a SEBI compliance consulting firm based in India.