Advertisement
The Gulf conflict has disrupted global supply chains, pushed...
REITs have changed the way commercial real estate is owned a...
What does it take to preserve a real estate legacy while bui...
What really powers the cloud? Behind every Google search, A...
A lot of what defines a home isn’t visible at handover. I...
Sebi has decided to introduce an IT Resilience Index (ITRI) to assess the performance and resilience of information technology systems used by market infrastructure institutions (MIIs), including stock exchanges, depositories and clearing corporations. The framework will use nine parameters with defined weightages to enable consistent assessment across MIIs. It will also include an Early Warning System to identify emerging weaknesses that could result in system performance issues or disruptions. MIIs will operationalise the framework, including real-time service monitoring, by February 2027, with the first index calculation covering the half-year ended March 2027.
The Securities and Exchange Board of India (Sebi) has decided to introduce an IT Resilience Index (ITRI) to assess the functioning and resilience of information technology systems at market infrastructure institutions (MIIs), including stock exchanges, depositories and clearing corporations.
The framework is aimed at strengthening oversight of IT resilience and identifying weaknesses at an early stage so that corrective action can be taken before they result in performance issues or disruptions.
Under the framework, the ITRI will be calculated using nine parameters with fixed weightages to ensure that the performance of different MIIs can be compared. Availability and security will carry the highest weightage of 20% each. Integrity, governance, reliability and monitoring, business continuity, and modularity and flexibility will account for 10% each. Scalability and other aspects, including incident handling, will carry 5% each.
MIIs will also develop an Early Warning System (EWS) to identify deterioration in ITRI parameters that could lead to system performance problems, slower systems or other disruptions. The system will allow MIIs to take remedial measures when such issues are detected.
MIIs have already implemented the beta version of the ITRI framework. They are required to operationalise the framework, including the EWS and real-time monitoring of service delivery, by February 28, 2027. The first ITRI calculation will cover the half-year ended March 31, 2027.
The index will be calculated every six months within 60 days of the end of each half-year. MIIs will submit a comparison of two consecutive half-years, along with corrective measures taken or proposed, to their Standing Committee on Technology (SCOT) and governing boards.
Sebi said the calculation will be system-driven to keep the process objective, non-discretionary and reliable. If a parameter cannot be calculated automatically and requires manual intervention, the MII will retrieve the data manually only after discussing the exception with its SCOT.
The Information Systems Framework (ISF) will establish baseline parameters, acceptable threshold scores and Standard Operating Procedures (SOPs) for calculating the ITRI. It will also prescribe an objective, system-driven scoring methodology to maintain comparability among MIIs.
The framework will operate as a self-assessment model under which MIIs periodically calculate the index and provide their governing boards with an assessment of the overall health of their IT systems and areas requiring improvement.
MIIs already continuously monitor process and application performance as well as system resource utilisation at the component level to detect possible performance issues and system slowness at an early stage. Under the new framework, they will also develop systems offering continuous visibility into service delivery to market participants.
These systems will include consolidated dashboards covering system and application performance, service delivery and deviations or anomalies. MIIs will also establish SOPs for monitoring system availability and continuity of services and for flagging disruptions or deviations.
In a separate circular, Sebi said it has aligned its Incident Reporting Portal with the Financial Stability Board’s (FSB) Format for Incident Reporting Exchange (FIRE) framework to streamline cyber incident reporting.
FIRE provides common information fields, standardised definitions and consistent classification of incident attributes, allowing cyber incidents to be reported in a more uniform manner across sectors and jurisdictions. Sebi said its portal will allow incidents to be reported in stages, covering the incident lifecycle from initial reporting and subsequent updates to final closure, while allowing for information that may not be available when an incident is first reported.
Sebi has directed regulated entities to report cyber incidents through its Cyber Incident Reporting Portal.
Source PTI
Advertisement
Facebook
Whatsapp
