Sebi asks registrars, share transfer agents to put in place cyber security framework

The circular has come at a time when there are rising incidents of cyber attacks. Sebi has said the cyber security policy of the RTAs should be approved by the respective boards.

Sebi, Sebi cyber security, cyber security framework, QRTA, Business news, Indian Express

The Securities and Exchange Board of India (Sebi). (File Photo)

Capital markets regulator Sebi on Friday directed large registrars and share transfer agents to put in place a robust cyber security framework, including “minimum physical access of critical systems” by staff and “stringent supervision” of outsourced staff. “No person by virtue of rank or position should have any intrinsic right to access confidential data, applications, system resources or facilities. Any access to QRTA’s (Qualified Registrar and Transfer Agent) systems, applications, networks, databases, etc, should be for a defined purpose and for a defined period,” said the Securities and Exchange Board of India (Sebi) circular on cybersecurity and cyber resilience framework for registrars to issue/share transfer agents (RTAs).

“Employees and outsourced staff such as employees of vendors or service providers, who may be given authorised access to the QRTA’s critical systems, networks and other computer resources, should be subject to stringent supervision, monitoring and access restrictions,” the circular said.

The Sebi circular will be applicable to RTAs servicing more than two crore folios. Such entities have been asked to put in place requisite systems by December 1.

The circular has come at a time when there are rising incidents of cyber attacks. Sebi has said the cyber security policy of the RTAs should be approved by the respective boards.

“Since RTAs perform important functions in providing services to holders of securities, it is desirable that RTAs have robust cyber security and cyber resilience framework in order to provide essential facilities and perform systemically critical functions relating to securities market,” the circular said.

Apart from annual audits of its systems, Qualified Registrar and Transfer Agents have been directed to ensure that suitable alerts are generated in the event of detection of unauthorised or abnormal system activities or unusual online transactions.

The audit report, along with comments from the board of Qualified Registrar and Transfer Agent has to be submitted to Sebi within three months from the end of the financial year.

Story continues below this ad

To ensure strong cyber security framework, the regulator has said QRTAs also have to formulate a policy to regulate the use of internet and internet-based services, including social media sites and cloud-based internet storage sites.

“Proper end of life mechanism should be adopted to deactivate access privileges of users who are leaving the organisation or whose access privileges have been withdrawn,” the circular said. The regulator has also told the RTAs to designate a senior official as chief information security officer (CISO) to “assess, identify and reduce cybersecurity risks, respond to incidents, establish appropriate standards and controls, and direct the establishment and implementation of processes and procedures as per the cyber security and resilience policy approved by the boards” of the RTAs.