SEBI issues ‘Cyber Security and Cyber Resilience Framework’ for Portfolio Managers

Circular No. SEBI/HO/IMD/IMD-PoD-1/P/CIR/2023/046, dated: 29.03.2023

SEBI has introduced a cybersecurity and Cyber Resilience framework for all portfolio managers having an asset worth of at least Rs 3,000 crore. As per the new norms, portfolio managers are required to report any instances of cyber-attacks or breaches encountered by them within 6 hrs of detecting such incidents.

Portfolio managers must have a Recovery Time Objective and a Recovery Point Objective of not more than 4 hrs and 30 min. The new guidelines shall be effective from 01.10.2023.

Further, the framework suggests a five point process to identify, assess, and manage cyber security risks associated with processes, information, networks, and systems –

(a) Identify’ critical IT assets and risks associated with such asset

(b) Protect’ assets by deploying suitable controls, tools, and measures

(c) Detect’ incidents, anomalies, and attacks through appropriate monitoring tools/processes,

(d) Respond’ by taking immediate steps after identification of the incident, anomaly, or attack

(e) Recover’ from incident through incident management, disaster recovery, and business continuity framework.

Also, Portfolio Managers should conduct periodic training programs to enhance awareness level among the employees and outsourced staff, vendors, etc. on IT / Cyber security policy and standards. Special focus should be given to build awareness levels and skills of staff from non-technical disciplines.

Click Here To Read The Full Circular