Sebi relaxes guidelines pertaining to setting up cybersecurity operations centre

Market regulator Sebi Friday relaxed guidelines pertaining to setting up cybersecurity operations centre for small market intermediaries as they lack knowledge in cybersecurity.

The decision has been taken after discussions with market participants, the Securities and Exchange Board of India (Sebi) said in a circular.

During the meeting, it was noted that compliance with cybersecurity guidelines may be onerous for smaller intermediaries because of lack of knowledge about cybersecurity and also the cost factor involved in setting up own security operations centre.

Under the new framework, Sebi said, small intermediaries can utilise services of market security operations centre (SOC), which is proposed to be set up by market infrastructure institutions (MIIs) with the objective to provide cybersecurity solutions to such intermediaries.

"The intermediaries' membership in market SOC is non-mandatory," it added.

Such a centre will be set up as a separate entity and MIIs will have at least 51 per cent stake in the new entity. Intermediaries, which do not have the capability to set up such centre on their own, can opt for market SOC.

Market SOC would provide only technology perspective for cybersecurity guidelines, but people and process perspectives of cybersecurity would still have to be managed by intermediaries.

Market SOC needs to ensure that intermediaries participating in SOC adhere to minimum IT guidelines and security protocols.

MII will carry out the audit of their market SOC activity annually and submit a report to the regulator.

MIIs have been directed to put in place appropriate systems for implementation of guidelines within six months.

Last week, Sebi had asked MIIs -- clearing corporations, depositories and exchanges -- to set up a round-the-clock cybersecurity operation centre manned by dedicated security analysts to identify, respond, recover and thwart cyber attacks.