Clarifications to Cybersecurity and Cyber Resilience Framework for SEBI Regulated Entities

Page 1 of 3 परिपत्र / CIRCULAR SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2024/184 December 31, 2024 प्रति सभी आनुकल्पिक तनवेश तनतिय ाँ(एआईफ) सभी तनर्गमन बैंकि औि स्व-प्रम तिि तसिंडीके ट बैंक सभी सम शोिन तनर्म (क्लीयरििंर् क िपोिेशन) सभी स मूतिक तनवेश स्कीमें सभी क्रे तडट िेतटिंर् एजेंतसय ाँ सभी अतभिक्षक (कस्टोतडयन) सभी तडबेंचि न्य सी (टरस्टी) सभी तनक्षेप र् ि (तडपॉतिटिी) सभी अतभतिि तनक्षेप र् ि सिभ र्ी (डीडीपी) सभी तनक्षेप र् ि सिभ र्ी (तडपॉतिटिी प तटगतसपेंट) [तनक्षेप र् िोिं (तडपॉतिटिी) के जरिए] सभी तनवेश सल िक ि / अनुसिंि न तवश्लेषक सभी के व ईसी ितजस्टरीकिि एजेंतसय ाँ सभी मचेंट बैंकि सभी म्यूचुअल फिं ड / असेट मैनेजमेंट किं पतनय ाँ सभी पोटगफोतलयो प्रबिंिक सभी तनर्गम ितजस्टर ि औि शेयि अिंििि अतभकि ग (आिटीए) सभी स्टॉक दल ल (ब्रोकि) [एक्सचेंजोिं के जरिए] सभी स्टॉक एक्सचेंज सभी जोल्पिम पूाँजी तनतिय ाँ To, All Alternative Investment Funds (AIFs) All Bankers to an Issue (BTI) and Self￾Certified Syndicate Banks (SCSBs) All Clearing Corporations All Collective Investment Schemes (CIS) All Credit Rating Agencies (CRAs) All Custodians All Debenture Trustees (DTs) All Depositories All Designated Depository Participants (DDPs) All Depository Participants through Depositories All Investment Advisors (IAs) / Research Analysts (RAs) All KYC Registration Agencies (KRAs) All Merchant Bankers (MBs) All Mutual Funds (MFs)/ Asset Management Companies (AMCs) All Portfolio Managers All Registrar to an Issue and Share Transfer Agents (RTAs) All Stock Brokers through Exchanges All Stock Exchanges All Venture Capital Funds (VCFs)

Page 2 of 3 महोदय / महोदया, Dear Sir / Madam, तवषय: सेबी से तवतनयतमि (िेग्यूलेटेड) एिं तटतटयोिं के तलए स इबि सुिक्ष औि स इबि िमलोिं से तनपटने की क्षमि के ढ ाँचे (सीएससीआिएफ) के सिंबिंि मेंस्पष्टीकिि Subject: Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)

1. Recognising the need for robust cybersecurity measures and protection of data and IT infrastructure, Securities and Exchange Board of India (SEBI) has issued ‘Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)’ vide circular SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated August 20, 2024. This framework is a necessary evolution to the changing threat landscape and rapid technological advancements and designed to ensure that SEBI REs maintain robust cybersecurity posture, remain equipped with adequate cyber resiliency measures and can withstand, respond to, and recover from cyber threats effectively.
2. Upon receipt of various queries from REs seeking clarifications on the aforementioned circular, it has been decided to clarify as under: 2.1.Regulatory forbearance: With regard to the compliance requirements, which are effective from January 01, 2025 under the CSCRF, regulatory forbearance is provided till March 31,
3. For any non-compliance during this period that comes to the notice of the regulator, no regulatory action shall be taken provided the REs are able to demonstrate meaningful steps taken / progress made in implementation of CSCRF. An opportunity shall be given to the REs to demonstrate the same before any regulatory action is considered by SEBI.

Page 3 of 3 2.2.Extension of compliance dates for Regulated Entities (REs): While the circular is effective from January 01, 2025, the date of compliance of CSCRF for following REs has been extended based on the feedback received on the rationalisation of categorisation of certain REs: a. KYC Registration Agencies (KRAs): Compliance timeline is extended from January 01, 2025 to April 01, 2025. b. Depository Participants (DPs): Compliance timeline is extended from January 01, 2025 to April 01, 2025. 2.3.Data Security Standard with regard to Data Localisation: Based on the feedback received on the provisions of Data Localisation, a need is felt for further consultations. Accordingly, the guidelines and provisions with regard to Data Localisation [Data Security standard (PR.DS.S2)] has been kept in abeyance until further notification. 3. The provisions of this Circular shall come into force with immediate effect. 4. This circular is being issued in exercise of powers conferred under Section 11 (1) of the Securities and Exchange of India Act, 1992, to protect the interests of investors in securities and to promote the development of, and to regulate the securities market. 5. This circular is issued with the approval of Competent Authority. 6. This circular is available on SEBI website at www.sebi.gov.in under the category “Legal” and drop “Circulars”. भवदीय Yours faithfully, श्‍वेि बनजी Shweta Banerjee मि प्रबिंिक General Manager दूिभ ष / Phone: 022-26449509 ईमेल / Email: shwetas@sebi.gov.in