- Home
- News
- Articles+
- Aerospace
- Agriculture
- Alternate Dispute Resolution
- Banking and Finance
- Bankruptcy
- Book Review
- Bribery & Corruption
- Commercial Litigation
- Competition Law
- Conference Reports
- Consumer Products
- Contract
- Corporate Governance
- Corporate Law
- Covid-19
- Cryptocurrency
- Cybersecurity
- Data Protection
- Defence
- Digital Economy
- E-commerce
- Employment Law
- Energy and Natural Resources
- Entertainment and Sports Law
- Environmental Law
- FDI
- Food and Beverage
- Health Care
- IBC Diaries
- Insurance Law
- Intellectual Property
- International Law
- Know the Law
- Labour Laws
- Litigation
- Litigation Funding
- Manufacturing
- Mergers & Acquisitions
- NFTs
- Privacy
- Private Equity
- Project Finance
- Real Estate
- Risk and Compliance
- Technology Media and Telecom
- Tributes
- Zoom In
- Take On Board
- In Focus
- Law & Policy and Regulation
- IP & Tech Era
- Viewpoint
- Arbitration & Mediation
- Tax
- Student Corner
- ESG
- Gaming
- Inclusion & Diversity
- Law Firms
- In-House
- Rankings
- E-Magazine
- Legal Era TV
- Events
- News
- Articles
- Aerospace
- Agriculture
- Alternate Dispute Resolution
- Banking and Finance
- Bankruptcy
- Book Review
- Bribery & Corruption
- Commercial Litigation
- Competition Law
- Conference Reports
- Consumer Products
- Contract
- Corporate Governance
- Corporate Law
- Covid-19
- Cryptocurrency
- Cybersecurity
- Data Protection
- Defence
- Digital Economy
- E-commerce
- Employment Law
- Energy and Natural Resources
- Entertainment and Sports Law
- Environmental Law
- FDI
- Food and Beverage
- Health Care
- IBC Diaries
- Insurance Law
- Intellectual Property
- International Law
- Know the Law
- Labour Laws
- Litigation
- Litigation Funding
- Manufacturing
- Mergers & Acquisitions
- NFTs
- Privacy
- Private Equity
- Project Finance
- Real Estate
- Risk and Compliance
- Technology Media and Telecom
- Tributes
- Zoom In
- Take On Board
- In Focus
- Law & Policy and Regulation
- IP & Tech Era
- Viewpoint
- Arbitration & Mediation
- Tax
- Student Corner
- ESG
- Gaming
- Inclusion & Diversity
- Law Firms
- In-House
- Rankings
- E-Magazine
- Legal Era TV
- Events
SEBI Issues Proposal for Comprehensive Cyber-Security and Cyber-Resilience Framework
![SEBI Issues Proposal for Comprehensive Cyber-Security and Cyber-Resilience Framework SEBI Issues Proposal for Comprehensive Cyber-Security and Cyber-Resilience Framework](https://www.legaleraonline.com/h-upload/2023/07/07/1010787-cyber-security.webp)
SEBI Issues Proposal for Comprehensive Cyber-Security and Cyber-Resilience Framework The Securities and Exchange Board of India (SEBI) has issued a consultation paper on ‘Consolidated Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs).’ The market regulator has released a consultation paper to improve the cybersecurity and cyber resilience of...
ToRead the Full Story, Subscribe to ![Legal Era](/images/logo.png)
Access the exclusive LEGAL ERAStories,Editorial and Expert Opinion
SEBI Issues Proposal for Comprehensive Cyber-Security and Cyber-Resilience Framework
The Securities and Exchange Board of India (SEBI) has issued a consultation paper on ‘Consolidated Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs).’
The market regulator has released a consultation paper to improve the cybersecurity and cyber resilience of market intermediaries, market infrastructure institutions, and other regulated entities.
The paper outlines a consolidated cybersecurity and cyber resilience framework (CSCRF) which will seek to address five functions—identify, protect, detect, respond and recover. Ensuring the cyber-resilience and compliance of third-party vendors will fall under the identify function.
Under the proposed framework, a graded approach will be followed, however, some guidelines will be applicable to all REs, some to select REs and some to market infrastructure institutions (MIIs).
Under the Identify function, the REs will also need to identify critical systems, formulate a comprehensive cybersecurity and cyber resilience policy and do scenario-based testing for assessing risk, among other things.
Under the Protect function, REs will be required to implement network segmentation techniques to restrict access to sensitive information, hosts, and services; conduct a periodic audit by a CERT-In empanelled auditor to audit the implementation and compliance to standards mentioned in this new framework; and do vulnerability assessment and penetration testing (VAPT) to test the IT environment, among other things.
Moreover, the Detect function, REs must establish security mechanisms through Security Operation Centre (SOC) for continuous monitoring of security events and timely detection of anomalous activities and MIIs will need to include red-teaming exercises, among other things. Red teaming involves simulating a cyber-attack to assess an entity’s security framework.
Under the Respond function, all REs will be required to have a Cyber Crisis Management Plan (CCMP) and investigate alerts from detection systems for root-cause analysis, among other things.
Lastly under the Recover function, REs must be equipped with well-documented response and recovery plan for cyber incidents and need to inform of actions taken during the recovery process to all related stakeholders, among other things.