SEBI Mandates IT Resilience Index for MIIs to Bolster Market Stability Against Cyber Threats

SEBI Mandates IT Resilience Index for MIIs to Bolster Market Stability Against Cyber Threats​

Market infrastructure institutions (MIIs) are being subjected to stringent new regulatory scrutiny following the release of a comprehensive IT Resilience Index (ITRI). The move by SEBI aims to ensure that critical systems underpinning the Indian securities market maintain uninterrupted operation, thereby safeguarding investor trust and promoting market efficiency. This mandate establishes a robust, measurable framework for assessing the technological preparedness of stock exchanges, clearing corporations, and depositories across India.

Understanding the Need for IT Resilience at MIIs​

The stability and functioning of the entire securities market depend heavily on the IT systems utilized by Market Infrastructure Institutions (MIIs). Any disruption, performance degradation, or compromise to these fundamental IT infrastructure poses significant risks to critical market operations. Consequently, SEBI has determined that it is imperative for MIIs to proactively ensure the availability and resilience of their IT systems through sound governance practices and continuous monitoring.

The newly formulated framework provides an oversight mechanism to identify emerging technological weaknesses in a timely manner. This measures the capabilities of MIIs to discharge their regulatory roles while ensuring timely service delivery to all market participants. The mandate underscores that operational resilience is now a core, measurable metric for these market pillars.

Structure and Parameters of the IT Resilience Index (ITRI)​

The ITRI was developed after discussions with SEBI's Technical Advisory Committee (TAC). It is designed as a system-driven framework to accurately capture the well-functioning and robustness of an MII’s critical systems. The index assesses various components, covering core areas from security protocols to operational flexibility.

Key parameters contributing to the total 100-point ITRI include Availability and Security, each carrying a 20% weightage. Governance (10%) and Integrity (10%) also play crucial roles in determining an MII’s resilience score. Other components, such as Business Continuity, Modularity and Flexibility, and Scalability, are allocated varying weights to ensure a holistic assessment.

Operationalizing the ITRI Framework Across MIIs​

MIIs are required to compute the ITRI on a half-yearly basis. This ensures that operational performance is tracked continuously and allows for the submission of comparative analyses over two consecutive half-years. Furthermore, MIIs must meticulously document all corrective actions taken based on their self-assessment findings.

A critical stipulation is that the ITRI computation must be system-driven. This means the index will be automatically computed from IT systems or data extracted from them, thereby precluding manual intervention and ensuring the process remains non-discretionary and fool proof. The Industry Standards Forum (ISF), constituted by SEBI, is tasked with finalizing detailed measurement criteria for these parameters by November 30, 2026.

New Focus on Early Warning and Continuous Service Monitoring​

The regulatory move introduces a significant focus on proactive risk management through an Early Warning System. MIIs must now develop systems capable of detecting any possible deterioration in the ITRI parameters that could lead to performance slowdowns or operational issues.

In addition, MIIs are mandated to build consolidated systems providing continuous visibility into service delivery for market participants. These systems must include dashboards designed to monitor system and application performance. They must also enable the detection of any deviations or anomalies in real-time, ensuring constant transparency for all stakeholders.

Implementation Timeline and Next Steps for MIIs​

The operationalization of the complete ITRI framework is scheduled by February 28, 2027. This includes fully incorporating both the Early Warning System and the Real Time Monitoring of Service Delivery capabilities into their existing operations. The first official submission of the ITRI computation under this new mandate will cover the half-year ending March 31, 2027.

MIIs are instructed to take immediate necessary steps toward implementing this Circular. This includes making relevant amendments to current bye-laws and regulations. SEBI views this exercise as fundamental to protecting investor interests and promoting comprehensive development within the securities market ecosystem.