In view of the increasing cybersecurity threat to the securities market, the Securities and Exchange Board of India (“SEBI”) vide its circular dated February 22, 2023 (“Circular”), has issued an advisory to all Regulated Entities (“REs”) on cybersecurity best practices. REs including stock exchanges, depositories and mutual funds have been advised to implement these cybersecurity practices as recommended by Financial Computer Security Incident Response Team (CSIRT-Fin) for an efficient and effective response to and recovery from a cyber-incident. The compliance of the advisory shall be provided by the REs along with their cybersecurity audit report. The compliance shall be submitted as per the existing reporting mechanism and frequency of the respective cybersecurity audit.

SEBI has laid down twelve recommendations to be implemented by REs in order to better tackle cybersecurity threats, which inter alia include measures to deal with phishing attacks, data breaches, concentration risks from outsourced agencies and cyber risks from cloud services.

To protect data and prevent data breach, SEBI suggests REs to adopt following measures:

1. Prepare detailed incident response plan;
2. Enforce effective data protection, backup, and recovery measures;
3. Encrypt data at rest to prevent the attacker from accessing the unencrypted data;
4. Identify and classify sensitive and Personally Identifiable Information (PII) data and apply measures for encrypting such data in transit and at rest; and
5.  Deploy data leakage prevention (DLP) solutions / processes.

To combat phishing attacks REs have been advised to proactively monitor the cyberspace to identify phishing websites with respect to the REs’ domain and report the same to CSIRT-Fin/CERT-In for taking appropriate action. Additionally, security awareness campaigns that stress the avoidance of clicking on links and attachments in email have been advised to help tackle such attacks. Certain important cybersecurity controls have also been recommended, such as scanning all emails, attachments, and downloads both on the host and at the mail gateway with a reputable antivirus solution, blocking malicious domains/IPs and restricting the execution of “powershell” and “wscript” in enterprise environment, if not required, etc.

SEBI has advised REs to define roles and responsibilities of Chief Information Security Officer (CISO) and other senior personnel. REs have also been directed to maintain a strong log retention policy and password policy and also enable multi factor authentication (MFA) for all users. To keep cloud services secure, checking public accessibility of all cloud instances in use has been recommended.

SEBI has noted that availing services from single third-party vendors creates concentration risks as any cyber-attack at such organizations could have systemic implication on the REs. To mitigate such risks, SEBI has advised REs to prescribe specific cyber security controls for such vendors including audit of their systems and protocols from independent auditors.

SEBI has specified in the Circular that the advisories issued by CERT-In, as well as SEBI’s instructions on external audit of Res by independent auditors, should be implemented in letter and spirit by the regulated entities. Res are also advised to go for ISO certification as the same provides a reasonable assurance on the preparedness of the RE with respect to cybersecurity.

Please find a copy of the Circular, here.

Read our thought paper on the CERT-IN`s six-hour reporting rule for cyber security incidents, here.

This update has been contributed by Vinod Joseph (Partner) and Paridhi Jain (Associate).

Argus Knowledge Centre is now on WhatsApp! Send us a message on +91 8433523504 to receive updates from our Knowledge Centre.