SEBI rolls out IT resilience index and FIRE-aligned portal; cybersecurity MoU signed
SEBI unveiled a system-driven IT Resilience Index for MIIs and aligned its cyber incident portal with the FIRE framework. Separately, SEBI partnered with RRU and NISM to deepen cybersecurity training and create a Technical Innovation Unit.
Key takeaways
- SEBI introduced the IT Resilience Index (ITRI) for MIIs with a nine-parameter framework prioritizing availability and security.
- The cyber incident portal will be aligned with the FIRE framework to standardize reporting across the market.
- Sebi, RRU, and NISM signed an MoU to boost cybersecurity training, research, and capacity building, including a new Technical Innovation Unit.
What Happened
The Securities and Exchange Board of India (SEBI) introduced two measures to strengthen technology resilience in the securities market. First, market infrastructure institutions (MIIs) will adopt a system-driven IT Resilience Index (ITRI) that assesses the resilience of critical IT systems across nine parameters, with the highest weights given to availability and security. Second, SEBI aligned its cyber incident reporting portal with the Financial Stability Board’s Format for Incident Reporting Exchange (FIRE) framework. Officials said the framework aims to improve early detection of technology risks, enable standardized reporting of cyber incidents, and provide continuous visibility into service delivery via dashboards. MIIs are required to calculate the index automatically, report semi-annually, and use an Early Warning System based on ITRI to identify deteriorating parameters.
In a separate development, SEBI announced a tripartite MoU with Rashtriya Raksha University (RRU) and the National Institute of Securities Markets (NISM). Signed on August 17 and publicly disclosed on August 24, the agreement aims to enhance cybersecurity, research, and training across the securities market. The collaboration will design and deliver training programs, develop certification courses, and establish a Technical Innovation Unit (TIU) to serve as a command centre for joint operations, research, and innovation. The TIU is described as focusing on advanced technologies, security operations, vulnerability assessments, and related capacity-building efforts for regulators, market participants, and the public.
Why It Matters
The ITRI introduces a standardized, automated method to monitor the resilience of MIIs’ critical IT systems, potentially enabling earlier remediation of vulnerabilities and more consistent performance benchmarks across the market infrastructure. Aligning the cyber incident portal with FIRE could improve cross-institutional reporting and reduce delay in sharing incident data, aiding regulators in tracking systemic cyber risks. The MoU with RRU and NISM signals a coordinated push to expand cybersecurity expertise, practical training, and research capacity in the Indian securities market, potentially elevating overall defensive capabilities and incident response readiness through shared curricula and hands-on exercises.
Background
SEBI’s new measures come as part of ongoing efforts to strengthen market infrastructure resilience and cyber risk management. The ITRI framework covers critical systems defined in SEBI master circulars and requires a baseline for measurement criteria to allow comparability across MIIs. The industry Standards Forum (ISF) will finalize sub-parameters and thresholds by late 2026, and the index calculation is intended to be fully automated, with manual data retrieval allowed only after prior consultation. Separately, the MoU builds on SEBI’s existing educational initiatives by creating a TIU and expanding capacity-building activities in partnership with a national security-focused university and an educational arm of SEBI.
Key Facts
- SEBI introduced a system-driven IT Resilience Index (ITRI) for MIIs, allocating up to 20% weight to availability and security, with other parameters at 5–10% each.
- MIIs must calculate ITRI automatically, submit semi-annual rolling comparisons, and implement an Early Warning System based on ITRI.
- SEBI aligned its cyber incident reporting portal with the FIRE framework to standardize incident reporting across the securities market ecosystem.
- SEBI, Rashtriya Raksha University (RRU), and NISM signed an MoU on August 17 to deepen cybersecurity training, research, and capacity building; announced publicly on August 24.
- The MoU includes establishing a Technical Innovation Unit (TIU) as a command centre for operations, research, and innovation in the securities market.
What Happens Next
ISF will finalize ITRI sub-parameters, baseline scores, thresholds, and standard operating procedures by November 30, 2026. MIIs will implement automated ITRI calculations, begin semi-annual reporting within the defined timelines, and roll out Early Warning System features. The TIU's development will proceed within the framework of the MoU, with programs, certifications, and collaborations to be rolled out over time to expand cybersecurity education and practical training for regulators, entities, and professionals.
Sources reviewed
Project Chintan independently synthesized and analyzed information cross-checked across the sources listed above.
Related stories
Kerala MVD tightens crackdown on unauthorised vehicle mods after HC order
Original reporting key to regaining public trust in media: N. Ram
Karnataka chief minister seeks fairer share of wealth for southern states
