Sebi introduces IT Resilience Index for market infrastructure institutions

The Securities and Exchange Board of India (Sebi) on Monday introduced a framework to strengthen the resilience, reliability, and cyber security of the information technology systems operated by Market Infrastructure Institutions (MIIs), including stock exchanges, clearing corporations and depositories.

The regulator said IT systems of MIIs form the backbone of the securities market and are fundamental to its smooth, orderly, and uninterrupted functioning. Any disruption, deterioration in performance or compromise of these systems could affect critical market operations and undermine investor confidence.

Sebi said MIIs must ensure the availability, reliability, performance, and cyber resilience of their IT infrastructure through robust governance, proactive monitoring and timely corrective measures. The objective is to ensure that the securities market continues to operate in a fair, transparent and efficient manner.

IT Resilience Index

As part of the new framework, Sebi has decided to introduce an IT Resilience Index (ITRI) to assess the robustness and resilience of critical IT systems operated by MIIs. The index follows discussions with Sebi’s Technical Advisory Committee and the regulator’s consultation paper issued on March 25, 2026.

The ITRI will cover critical systems identified under Sebi’s master circulars for stock exchanges and clearing corporations, depositories and the commodity derivatives segment. It will also cover other systems that feed into or relate to these critical systems.

The Industry Standards Forum (ISF) of MIIs will finalise the sub-parameters and detailed measurement criteria for the index by November 30, 2026. It will also establish baseline parameters, acceptable threshold scores and standard operating procedures (SOPs), along with an objective, system-driven methodology to ensure comparability across MIIs.

MIIs will calculate the ITRI every six months, within 60 days of the end of each half-year. They will submit a rolling comparison of two consecutive half-years, along with corrective actions taken or proposed, to their Standing Committee on Technology (SCOT) and governing boards.

Sebi has mandated that ITRI calculations should be system-driven and automated, without manual intervention, to make the process objective and less prone to errors. Any exception requiring manual data retrieval will have to be discussed with the SCOT beforehand.

Early warning and real-time monitoring

The framework will also require MIIs to establish an Early Warning System to identify deterioration in ITRI parameters that could result in performance issues, system slowdowns or other disruptions.

MIIs must additionally develop systems that provide continuous visibility into service delivery to market participants. These systems will include consolidated dashboards to monitor application and system performance, service continuity and any deviations or anomalies.

MIIs will also be required to establish SOPs for monitoring system availability and uninterrupted service delivery, while promptly flagging disruptions or deviations.

Implementation by February 2027

Sebi said MIIs have already implemented a beta version of the ITRI framework. The full framework, including the Early Warning System and real-time monitoring of service delivery, must be operational by February 28, 2027.

Detailed SOPs, following finalisation of the ITRI sub-parameters by the ISF and review by the SCOT, must be submitted to Sebi by January 31, 2027. The first ITRI submission under the new framework will cover the half-year ending March 31, 2027. MIIs will also have to make necessary changes to their systems and, where required, amend relevant bye-laws, rules and regulations to implement the framework.