Sebi issues cybersecurity framework for KYC Registration Agencies

"Since KRAs perform important function of maintaining KYC records of the clients in the securities market, it is desirable that KRAs have robust Cyber Security and Cyber Resilience framework in order to provide essential facilities and perform systemically critical functions relating to securities market," Sebi noted.

Accordingly, Sebi has asked KRAs to formulate a comprehensive cybersecurity and cyber resilience policy document encompassing the framework.

The policy document should be approved by the board of KRAs and in case of deviations from the suggested framework, reasons for such deviations, technical or otherwise, should be provided in the policy document. The document should be reviewed by the board of KRAs at least annually.

KRAs will have to define responsibilities of its employees, outsourced staff, and employees of vendors, members and other entities, who may have privileged access to the networks. Further, such staff should also be subject to stringent supervision, monitoring and access restrictions.

They need to establish a reporting procedure to facilitate communication of unusual activities and events to the designated officer in a timely manner.

KRAs should establish appropriate security monitoring systems and processes to facilitate continuous monitoring of security events and timely detection of unauthorised or malicious activities, held in contractual or fiduciary capacity, by internal and external parties.

Sebi said that alerts generated from monitoring and detection systems need to be suitably investigated in order to determine activities that are to be performed to prevent expansion of such incident of cyber attack or breach, mitigate its effect and eradicate the incident.