9911796707
TMI BlogClarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)X X X X Extracts X X X X X X X X Extracts X X X X ..... ers in India (APMI) BSE Limited (Investment Adviser Administration and supervisory body- IAASB) BSE Limited (Research Analysts Administration and supervisory body- RAASB) Sir / Madam, Subject: Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs) 1. Securities and Exchange Board of India (SEBI) has issued 'Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)' vide circular SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated August 20, 2024. Upon receipt of various queries from REs seeking extension and clarification on the aforementioned circular, SEBI has also issued 'Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulate ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... tion REs 1. Number of total registered clients More than 10 lakhs More than 1 lakh and up to 10 lakhs More than 10,000 and up to 1 lakh More than 1,000 and up to 10,000 2. Clientele trading volume in a year (in Crores) More than 10, 00,000 More than 1,00,000 and up to 10,00,000 More than 10,000 and up to 1,00,000 More than 1,000 and up to 10,000 2.1.2. Stock Brokers with less than 1,000 crores clientele trading volume (in a year) and less than 1,000 total registered clients are exempted from CSCRF. 2.2. Depository Participants (DPs): It shall be noted that categorisation of DP shall be decided based on the highest thresholds of below-mentioned classification. For example: if a DP is registered as both stock broke ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... . Table 3: Criteria and thresholds for Portfolio Managers categorisation S. No. Criteria Qualified REs Mid-size REs Small-size REs Self-certification REs 1. AUM N.A. Above Rs, 3000 Crores N.A. Rs. 3000 Crores and below Further, Portfolio Managers who fall under self-certification REs category and have less than 100 clients shall be exempted from the requirement of mandatory Market-SOC (M-SOC). 2.7. Alternate Investment Funds (AIFs) and Venture Capital Funds (VCFs): Categorisation shall be at the manager level instead of AIF level. If the manager of AIF is also the manager of VCFs, then corpus of VCF schemes managed by the manager shall also be included for determining the threshold limits. Therefore, criteria and ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... highest category under which such an RE falls shall be applicable to that RE. 5. W.r.t. 'Framework for Adoption of Cloud Services by SEBI Regulated Entities (REs)' issued vide SEBI circular SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/033 dated March 06, 2023 (CSCRF: Annexure-J), implementation of a dedicated Hardware Security Module (HSM) shall be made mandatory for MIIs and Qualified REs (as per the classification given in CSCRF). However, mid-size REs, small-size REs, and self-certification REs shall be allowed to implement any alternative of HSM based on their risk assessment. Such risk assessment shall be approved by the Board/ Partners/ Proprietor of the RE. 6. Stock Brokers, Depository Participants, KRAs, Portfolio Managers, Investment Adviser ..... X X X X Extracts X X X X X X X X Extracts X X X X
|
