SEBI Tightens IT Oversight With New Resilience Index For Market Infrastructure

The Securities and Exchange Board of India (SEBI) has introduced a new framework to track the resilience of technology systems used by market infrastructure institutions (MIIs). The IT Resilience Index (ITRI) will give stock exchanges, depositories and clearing corporations a common way to measure the health of their IT systems and spot weaknesses before they lead to service disruptions.

MIIs will also have to establish an Early Warning System (EWS) and real-time service monitoring under the framework.

What Is The New SEBI Circular On The IT Resilience Index?

The ITRI will use nine parameters to assess the resilience of technology systems across MIIs. Availability and security will account for 20% each of the total score.

Five other areas, including integrity, governance, reliability and monitoring, business continuity, and modularity and flexibility, will carry 10% each. The remaining 10% will cover scalability and other aspects, including incident handling.

SEBI wants the scoring process to be largely automated. This is intended to make the results more objective and allow comparisons across institutions.

Where a parameter cannot be calculated automatically, the reason for the exception will first have to be discussed with the MII's Standing Committee on Technology. Manual data collection can then be carried out.

The Information Systems Framework will provide the baseline parameters, acceptable thresholds and standard operating procedures to be used for calculating the index.

When Will MIIs Have To Start Reporting The Resilience Index?

The framework is currently in its beta phase. SEBI has directed MIIs to make the ITRI operational along with the EWS and real-time monitoring of service delivery by 28 February 2027.

The first assessment will cover the six months ending 31 March 2027. After that, MIIs will calculate the index every six months and submit the results within 60 days of the end of each assessment period.

Each submission will include a comparison with the previous half-year. MIIs will also have to provide details of corrective measures already taken or those planned to address identified issues.

The EWS will work alongside the index. It will track changes in individual parameters and flag signs such as system slowness, performance problems or possible service disruptions.

What Else Is SEBI Changing In Cyber Incident Reporting?

Alongside the resilience index, SEBI has aligned its cyber incident reporting portal with the Financial Stability Board's Format for Incident Reporting Exchange (FIRE) framework.

The alignment will bring a common structure to cyber incident reporting. It includes standardised fields and classifications while allowing regulated entities to update a report as an incident develops.

An incident can therefore be reported at the initial notification stage and updated through subsequent developments until final closure.

The two measures form part of SEBI's broader technology oversight framework for market infrastructure. The regulator said they are intended to improve monitoring of IT systems, support service continuity and help identify and resolve emerging technology and cyber risks faster.

Also Read - Pre-Market 25 August 2026: Oil, Iran Tensions And Global Cues In Focus