Step-by-Step Guide to Implement SEBI's Cybersecurity Framework in Your Organization

The SEBI cybersecurity framework applies to a wide range of financial institutions in the Indian securities market, ensuring security compliance for financial institutions It also removes all the existing issues of circulars and develops a consistent manner of addressing cybersecurity. Based on the framework, there are five types of Regulated Entities: Market Infrastructure Institutions (MIIs), Qualified REs, Mid-size REs, Small-size REs and Self-certification REs.

The classification depends on several factors:

• Asset Under Management (AUM) for mutual funds, portfolio managers, and Alternative Investment Funds (AIFs)
• Active client base for stock brokers
• Number of folios serviced for Registrar and Transfer Agents (RTAs)
• Type of operations for custodians and depository participants

Thus, the initial move towards compliance would be to know what category your organisation belongs to. Thresholds and categories of regulated entities under the CSCRF were revised by the regulator, where Portfolio Managers with Assets Under Management of Rs 10,000 crore and above would be considered as Qualified REs.