Sebi introduces IT Resilience Index for market infrastructure institutions: Here's what you need to know

The Securities and Exchange Board of India (Sebi) has introduced an IT Resilience Index (ITRI) framework for market infrastructure institutions (MIIs) to monitor the robustness and resilience of their critical IT systems and strengthen the continuity of securities market operations.

The regulator, in its latest circular, said IT systems of MIIs form the backbone of the smooth and uninterrupted functioning of the securities market, and any disruption, performance degradation or compromise of these systems could affect critical market operations and pose risks to trust in the securities market.

Sebi said the framework is aimed at ensuring the availability, reliability, performance and cyber resilience of IT systems through robust governance, proactive monitoring and timely corrective measures.


9 parameters to determine IT resilience

Under the system-driven framework, the ITRI will measure the robustness of critical systems of MIIs, along with other systems feeding into or related to such critical systems.

The index will have a total score of 100, with nine parameters and their respective weightages:

(Source: Sebi)

The Industry Standards Forum (ISF) of MIIs, constituted by Sebi, will finalise the sub-parameters and detailed measurement criteria for each of these parameters by November 30, 2026.

The ISF will also formulate baseline parameters, acceptable threshold scores and standard operating procedures (SOPs) for calculating the ITRI, along with an objective, system-driven scoring methodology aimed at ensuring comparability across MIIs.

ITRI to be computed twice a year

MIIs will be required to compute the ITRI on a half-yearly basis, within 60 days from the end of each half-year.

They will also have to submit a comparative analysis of two consecutive half-years on a rolling basis, along with corrective actions taken or proposed, to their Standing Committee on Technology (SCOT) and Governing Board.

SEBI has stipulated that the ITRI computation should be system-driven, meaning it should be generated automatically from IT systems or data extracted from those systems without manual intervention.

The objective, according to SEBI, is to ensure that the computation remains non-discretionary and foolproof.

Where a parameter cannot be computed automatically and requires manual intervention, the MII will be required to undertake manual data retrieval only after discussing the exception with its SCOT.

Early warning system for IT disruptions

As part of the framework, MIIs will also have to develop an Early Warning System to detect possible deterioration in any ITRI parameter that could lead to performance issues, slowness or other problems in their systems.

The regulator has also mandated continuous monitoring of service delivery to market participants.

MIIs will have to build systems that provide continuous visibility into service delivery, including consolidated dashboards to monitor system and application performance, continuity of services and any deviations or anomalies.

They will also have to formulate SOPs to monitor the availability of systems and continuity of service delivery to all market participants and flag any disruption or deviation.

ITRI framework to be operational by February 2027

SEBI said MIIs have already implemented a beta version of the ITRI framework.

The full ITRI framework, including the Early Warning System and real-time monitoring of service delivery, is required to be operationalised by February 28, 2027. The detailed SOPs, after the ISF finalises the sub-parameters and measurement criteria, will have to be submitted to SEBI after review by the SCOT of the respective MIIs by January 31, 2027.

The first submission of ITRI computation under the framework will cover the half-year ending March 31, 2027.

SEBI said MIIs will be required to take necessary steps to put systems in place for implementation of the framework, including amendments to relevant bye-laws, rules and regulations, where required.

(Disclaimer: Recommendations, suggestions, views and opinions given by the experts are their own. These do not represent the views of Economic Times)