SEBI modifies ‘Cyber Security and Cyber Resilience Framework’ for QRTAs

Circular- SEBI/HO/MIRSD/MIRSD_RTAMB/P/CIR/2022/73 dated May 27, 2022

The SEBI vide Circular SEBI/HO/MIRSD/CIR/P/2017/100 dated 08.09.2017 prescribed framework for Cyber Security and Cyber Resilience for Qualified Registrars to an Issue and Share Transfer Agents (QRTAs).

The SEBI has modified the framework prescribed for Cyber Security and Cyber Resilience for Qualified Registrars to an Issue and Share Transfer Agents (QRATs). As per the modified framework, more detailed norms are provided for the classification/designation of the critical assets.

The critical assets should include business-critical systems, internet-facing applications /systems, systems that contain sensitive data, sensitive personal data, sensitive financial data, Personally Identifiable Information (PII) data, etc. In addition to this, all the ancillary systems used for accessing/communicating with critical systems either for operations or maintenance should also be classified as critical system. The Board of the QRTAs is required to approve the list of critical systems.

Further, the report of the Vulnerability Assessment and Penetration Testing (VAPT) and the gaps found therein shall be submitted to the SEBI within a period of 1 month from the date of completion of VAPT activity.

The circular is made effective immediately.

Click Here To Read The Full Circular