India's securities market is experiencing rapid growth, but this expansion also brings increasing cybersecurity risks. Financial institutions and market participants handle sensitive investor information, financial records, and critical business transactions, making them attractive targets for cybercriminals.

According to the CERT-In report referenced in this whitepaper, cyberattacks on Indian financial institutions have increased by 300% over the past three years, with confidential information theft being a major motive. To address these growing threats, the Securities and Exchange Board of India (SEBI) has introduced stringent cybersecurity and cyber resilience guidelines for regulated entities.

These guidelines aim to strengthen IT infrastructure, protect investor information, and ensure organizations can identify, prevent, detect, and respond to evolving cyber threats.

‍

Understanding SEBI's Cybersecurity and Cyber Resilience Framework

On June 27, 2024, SEBI released revised IT Governance and Cybersecurity Guidelines requiring regulated entities to implement an enhanced cybersecurity and cyber resilience framework.

The framework follows five essential cybersecurity functions defined by the National Institute of Standards and Technology (NIST):

• Identify: Understand and assess cybersecurity risks across organizational systems and infrastructure.
• Protect: Implement appropriate safeguards to secure critical resources and sensitive information.
• Detect: Continuously monitor systems to identify suspicious activities and potential security incidents.
• Respond: Establish mechanisms to manage and respond effectively to cybersecurity incidents.
• Recover: Maintain recovery processes to restore systems and operations following security incidents.

The framework also introduces six key components:

1. Cyber Risk Governance and Management

Establish processes for identifying, assessing, and managing cybersecurity risks across SEBI-regulated entities.

2. Data Classification and Localization

Categorize data into Regulatory and IT/Cybersecurity categories. Regulatory Data must be stored in India, while IT/Cybersecurity Data has greater flexibility in its storage requirements.

3. Security Operations Centre (SOC)

Establish a Security Operations Centre for continuous monitoring and response to cyber threats, with periodic evaluations of its effectiveness.

4. API and Mobile Application Security

Implement security standards for APIs and mobile applications to prevent unauthorized access and potential data breaches.

5. Cyber Capability Index (CCI)

Introduce a metric to assess an organization's cybersecurity resilience and preparedness against cyberattacks.

6. Software Bill of Materials (SBOM)

Document software components to identify vulnerabilities and manage potential supply chain security risks.

‍

Who Needs to Comply with SEBI Guidelines?

The SEBI cybersecurity and cyber resilience framework applies to various entities regulated by the securities market regulator, including:

• Listed companies
• Stock exchanges
• Intermediaries
• Mutual funds
• Portfolio managers
• Credit rating agencies
• Custodians
• Depositories and participants
• Investment advisors
• Venture capital funds and alternative investment funds
• Proxy advisors
• Foreign Institutional Investors (FIIs) and Foreign Portfolio Investors (FPIs)

These organizations must establish appropriate cybersecurity controls to protect their IT infrastructure, sensitive information, and financial operations.

‍

Consequences of SEBI Non-Compliance

Failure to comply with SEBI's cybersecurity guidelines can result in significant financial, legal, operational, and reputational consequences.

Some of the major risks include:

• Monetary Penalties: Significant fines and additional penalties for regulatory delays or violations.
• Legal Action: Potential criminal prosecution and costly litigation.
• Operational Disruptions: Suspension of trading, debarment from the securities market, and detailed audits.
• Reputational Damage: Public disclosure of violations that can affect investor confidence.
• Management Accountability: Disqualification of directors and potential personal liability.
• Investor Compensation: Orders requiring restitution and refunds to affected investors.

The whitepaper highlights enforcement cases involving CDSL Ventures Ltd. and Ventura Securities Ltd. CDSL Ventures received a ₹2 lakh fine following inadequate IT security measures that led to a malware attack, while Ventura Securities received a ₹5 lakh fine for non-compliance with cybersecurity requirements.

‍

How Zaperon Supports SEBI Compliance

Zaperon Identity Protection Platform 2.0 helps organizations strengthen their cybersecurity posture through Zero Trust access controls, identity protection, and continuous security monitoring.

It supports key SEBI cybersecurity requirements by helping organizations secure user identities, monitor application access, enforce strong authentication, and maintain detailed audit records.

With Zaperon, organizations can:

• Maintain Comprehensive Audit Logs: Record application access information, user activities, and device security posture. Administrator activities are also tracked through securely stored system logs that can be audited to identify unusual patterns and behavior.
• Eliminate Password-Related Risks: Use PKI-based Passwordless Authentication to reduce vulnerabilities associated with password reuse and storage. Access for former employees can be immediately revoked across devices and applications.
• Enforce Phishing-Resistant MFA: Secure SaaS, on-premises, and desktop applications with Multi-Factor Authentication (MFA) that validates over 15 factors related to device certificates, user behavior, device posture, and access context.
• Apply Least-Privilege Access: Enforce Zero Trust policies to ensure users access only the applications required for their roles and only through authorized and secure devices.
• Monitor Device Security: Uniquely identify devices using PKI-based certificates and continuously assess device posture to maintain secure access regardless of user location.
• Detect Identity Threats: Identify suspicious user behavior and device-related anomalies, block risky access, and generate alerts for security administrators.

‍

Strengthen Financial Sector Security with Zaperon

Meeting SEBI cybersecurity requirements requires continuous monitoring, strong identity verification, controlled access, and effective security governance. Organizations must ensure that every user, device, and application accessing critical resources is properly verified and protected.

Through PKI-based Passwordless Authentication, phishing-resistant MFA, continuous Zero Trust access control, and proactive Identity Threat Detection and Response, Zaperon helps SEBI-regulated organizations strengthen their cybersecurity posture and protect critical financial infrastructure against evolving threats.