SEBI's IT Resilience Index tests India’s market tech strength
SEBI has unveiled the IT Resilience Index (ITRI), a technology health scorecard for market infrastructure institutions to assess the robustness of critical IT systems beyond standard compliance. The index, designed for MIIs such as stock exchanges, clearing corporations, and depositories, uses nine
Key takeaways
- SEBI introduced the IT Resilience Index (ITRI) to measure IT system robustness for market infrastructure institutions beyond compliance.
- ITRI applies nine parameters with weights that emphasize availability and security at 20% each, plus other factors like continuity and scalability.
- MIIs include stock exchanges, clearing entities, and depositories; an Early Warning System will flag deteriorating ITRI signals.
What Happened
The market regulator SEBI introduced a technology health scorecard for market infrastructure institutions (MIIs) aimed at evaluating the strength of their core IT systems rather than just checking routine compliance. This mechanism, called the IT Resilience Index (ITRI), intends to function as a quantitative resilience gauge for MIIs that support trading, clearing, settlement, and securities holding.
MIIs include stock exchanges, clearing corporations, and depositories. The ITRI is presented as one of the early efforts globally by a regulator to create a numerical barometer of operational resilience comparable to capital adequacy metrics used in banking. The objective is to determine whether the IT ecosystems behind market operations can withstand operational shocks, cyber threats, technical failures, and sudden surges in market activity.
The groundwork for ITRI dates back to 2015, when SEBI circularly designated MIIs as “systemically important” and urged a robust cybersecurity framework for critical functions. The proposed index seeks to move from a purely compliance-based regime to a data-driven risk-monitoring approach and relies on nine parameters whose weights reflect a systemic-risk hierarchy.
The parameter weights assign the highest importance to availability and security, each at 20%. Business continuity and reliability carry 10%, and scalability has 5%. The remaining weights and sub-parameters are to be defined and refined with input from the Technical Advisory Committee and the Industry Standards Forum of MIIs. An Early Warning System (EWS) would monitor signs of deterioration in ITRI indicators to prompt remedial actions.
The initiative comes amid a digitally transforming Indian securities market, characterized by greater retail participation via online platforms, rising algorithmic trading, and faster settlement cycles. SEBI notes that market efficiency increasingly hinges on technology reliability, elevating IT resilience to a boardroom-level concern.
In comparison to other jurisdictions, the article notes that several markets have implemented operational resilience frameworks, but not all in a single ITRI format. The UK has rules on operational resilience requiring identification of important services, disruption tolerances, and recovery capabilities. The EU’s Digital Operational Resilience Act (DORA) is described as a rulebook rather than a numerical scorecard. The United States is described as not having a single ITRI.
Why It Matters
By shifting toward a quantitative resilience framework, SEBI aims to quantify the risk posture of MIIs and enable proactive risk management in the face of cyber and operational shocks. A structured resilience index could influence governance discussions at MIIs and affect how technology plans are prioritized at the highest levels of market infrastructure management.
Background
The ITRI concept builds on SEBI’s 2015 decision to tag MIIs as systemically important, which elevated the emphasis on cybersecurity for critical market functions. The proposed index will be developed with nine parameters and weighted to reflect potential immediate disruption risks, with an Industry Standards Forum of MIIs tasked with detailing sub-parameters and measurement criteria.
Key Facts
- SEBI introduced the IT Resilience Index (ITRI) to assess the robustness of MIIs’ IT systems, beyond standard compliance.
- MIIs targeted include stock exchanges, clearing corporations, and depositories in India.
- The ITRI uses nine parameters with weights: Availability 20%, Security 20%, Business Continuity and Reliability 10%, Scalability 5% (and others yet to be finalized).
- An Early Warning System (EWS) will monitor deterioration in ITRI parameters and prompt remedial action.
- The ITRI framework aims to shift from compliance-only oversight to a quantitative risk-monitoring approach.
- SEBI notes India’s markets are increasingly digital, with more retail participation, algorithmic trading, and faster settlement cycles.
- Global comparisons indicate some markets have operational resilience rules, but DORA is a rulebook rather than a scorecard, and the U.S. lacks a single ITRI; the UK has related disruption-tolerance rules.
What Happens Next
The Industry Standards Forum of MIIs will define detailed sub-parameters and measurement criteria, with actual data used to refine weights through outages, cyber incidents, and stress tests. SEBI may continue developing the EWS and adjust the weights as empirical evidence accumulates, aiming to establish the ITRI as a living indicator of market technology resilience.
Sources reviewed
Project Chintan independently synthesized and analyzed information cross-checked across the sources listed above.
Related stories
Karnataka suspends food licences of online platforms over Datura sale
Hindustan Copper launches 6% OFS at Rs 514 floor price
Kerala MVD tightens crackdown on unauthorised vehicle mods after HC order
