To mitigate data breaches, Sebi issues cybersecurity framework for KYC registration agencies

Must Read

How AI monitoring can make your business smarter and better

Artificial Intelligence (AI) makes it feasible for machines to learn from experience, adapt to new inputs, and perform human-like tasks.

Why cybersecurity threats have increased during Covid-19 pandemic

Cybersecurity industry has never had more significant task to carry out than guarding strategic associations and businesses from digital assaults during the coronavirus pandemic

How to choose an effective DDoS mitigation plan

There are several flavours from which to choose when selecting an effective DDoS mitigation strategy. Most enterprises opt for one of the cloud protection flavours (always-on or on-demand)

Amid growing concerns over possible data breaches, markets regulator Sebi put in place a detailed framework for KYC registration agencies, requiring them to define responsibilities of employees, including outsourced staff, who have privileged access to networks. Besides, the watchdog said that no person should have any intrinsic right to access confidential data by virtue of their rank or position.

With the new norms, to be effective from January 1, 2020, KYC registration agencies or KRAs would be required to define the responsibilities of its employees, including outsourced staff, who have privileged access to the networks, the (Sebi) said in a circular.

Sebi said that rapid technological developments in securities market have highlighted the need for maintaining robust cyber security and cyber resilience framework to protect the integrity of data and guard against breaches of privacy.

Cybersecurity framework includes measures, tools and processes that are intended to prevent cyber-attacks and improve cyber resilience.

“Since KRAs perform important function of maintaining KYC records of the clients in the securities market, it is desirable that KRAs have robust Cyber Security and Cyber Resilience framework in order to provide essential facilities and perform systemically critical functions relating to securities market,” Sebi noted.

Accordingly, Sebi has asked KRAs to formulate a comprehensive cybersecurity and cyber resilience policy document encompassing the framework.

The policy document should be approved by the board of KRAs and in case of deviations from the suggested framework, reasons for such deviations, technical or otherwise, should be provided in the policy document. The document should be reviewed by the board of KRAs at least annually.

KRAs will have to define responsibilities of its employees, outsourced staff, and employees of vendors, members and other entities, who may have privileged access to the networks. Further, such staff should also be subject to stringent supervision, monitoring and access restrictions.

They need to establish a reporting procedure to facilitate communication of unusual activities and events to the designated officer in a timely manner.

KRAs should establish appropriate security monitoring systems and processes to facilitate continuous monitoring of security events and timely detection of unauthorised or malicious activities, held in contractual or fiduciary capacity, by internal and external parties.

Sebi said that alerts generated from monitoring and detection systems need to be suitably investigated in order to determine activities that are to be performed to prevent expansion of such incident of cyber attack or breach, mitigate its effect and eradicate the incident.

Subscribe to receive the day's headlines from Tech Observer straight in your inbox

Share your views

*The moderation of comments is automated and not cleared manually by Embedding of any link and use of abusive or unparliamentary language are prohibited.
- Advertisement -

Latest in TECH

Related Articles