Overview
Methodology
Major Regulations
SEBI/HO/MIRSD/CIR/PB/2018/147
This circular enunciates key Cyber Security Controls for Stock Exchanges and Depose under the CPL of the respective Organizations. It sets up minimum measures essential for handling cyber threats, safeguarding data and maintaining a secure environment in these organisations.
SEBI/HO/MIRSD/TPD/P/CIR/2022/80
These rules extend and update the previous guidelines, introducing more cyber security measures. It confronts new trends and integrates best security practices to improve the security of exchanges and depositories.
General Compliance Framework
In combination, these circulars lay down a solid structure for cyber security, as the exchanges and depositories also follow strict conditions protecting their systems and data from hacking and cyber threats. These are intended and developed for enhancing the SECS’s defense against cyber threats while at the same time retaining supervisory authority.
Our Approach.
A preliminary draft report highlighting the initial discoveries and findings from the audit. This document provides an early overview of key issues and areas needing attention before the final report is completed.
Through a GAP Assessment Report, we identify non-compliant controls and advise on necessary remedial actions. This support helps you address gaps and align with compliance requirements effectively.
A comprehensive report detailing the audit’s findings, including an in-depth summary of issues identified, conclusions drawn, and recommendations for improvements. This provides a thorough view of the audit results.
A formal letter confirming that your organization meets all required standards and regulations. This letter serves as official documentation that all applicable controls and compliance requirements have been fulfilled.
A detailed plan outlining specific steps to implement remediation measures. This guides you through addressing identified issues and enhancing overall compliance with regulatory standards.
An Attestation Report formally verifies that the audit was conducted according to relevant standards. It confirms the accuracy of the audit findings and the compliance status, serving as official confirmation of the audit’s validity and results.
Critical Assets Under SEBI Cyber Resilience Framework
In the SEBI Cyber Resilience Framework, data and systems are classified based on which they are tagged as higher risk and demand an extra level of protection. Some examples of Sensitive Personal Data include Personal numbers and Health records, as detailed below, and Aids in avoiding privacy violations. Names and addresses are vital as they fall under Personally Identifiable Information (PII) and require privacy and legal preservation. Sensitive Financial Information includes bank account alerts and credit card records, which help avoid fraud. Business Critical Systems include trading capabilities and customer databases, which define an entity’s continuity and sustainment against cyber adversities.
