The Securities and Exchange Board of India (SEBI) mandates that Recognized Entities (REs) report and manage cybersecurity incidents according to established guidelines. This framework is aimed at ensuring cybersecurity preparedness, identifying vulnerabilities, and mitigating risks in line with best practices.

Description:

The National Commodity & Derivatives Exchange Limited (NCDEX) has issued an updated Standard Operating Procedure (SOP) for handling cyber security incidents. The key points include:

1. Reporting Timeline: All Regulated Entities (REs), Members, and Depository Participants (DPs) are required to report any cyber security incident to the Exchanges/Depositories within 6 hours of detecting or noticing the incident.
2. Precautionary Containment Measures: Exchanges/Depositories may implement precautionary measures to contain threats, including disabling connectivity between REs/DPs and Exchanges/Depositories to prevent the lateral movement of threats or malware.
3. Report Submission for Restoring Connectivity: To restore connectivity, the affected REs/DPs must submit immediate mitigation measure reports, Root Cause Analysis (RCA), forensic audit reports, Vulnerability Assessment and Penetration Testing (VAPT), or any other report required by the relevant Exchange/Depository/SEBI.
4. Additional Time for RCA Submission: SEBI/MIIs may grant additional time for submitting the Root Cause Analysis (RCA) on a case-by-case basis, considering the complexity of the incident.
5. Effective Date: The provisions outlined in the SOP/circular will apply to all cyber incidents reported from January 20, 2025, onwards.