SEBI introduces IT Resilience Index for market infrastructure institutions

The Securities and Exchange Board of India (SEBI) introduced an IT Resilience Index (ITRI) to assess the functioning and resilience of information technology systems of market infrastructure institutions (MIIs), including stock exchanges, depositories and clearing corporations.

Under the framework, the ITRI will be computed using a uniform set of nine parameters, each carrying a specific weightage to ensure comparability across MIIs.

Availability and security will carry the highest weightage of 20 per cent each, followed by integrity, governance, reliability and monitoring, business continuity, and modularity and flexibility at 10 per cent each.

Scalability and other aspects, including incident handling, will account for the remaining 5 per cent each.

The move is aimed at strengthening oversight of the resilience of IT systems and identifying emerging weaknesses at an early stage, so that timely corrective measures can be taken.

MIIs will also develop an Early Warning System (EWS) to detect any deterioration in ITRI parameters that could potentially lead to performance issues, system slowness or other disruptions, and take remedial measures.

The beta version of the ITRI framework has already been implemented and will operationalise it along with the EWS and real-time monitoring of service delivery by February 28 next year.

The first ITRI computation under the framework will cover the half-year ended March 31, 2027. MIIs will compute the index on a half-yearly basis within 60 days of the end of each half-year and submit a comparative analysis of two consecutive half-years.

The Industry Standards Forum will formulate baseline parameters, acceptable threshold scores and Standard Operating Procedures (SOPs) for calculating the ITRI, along with an objective, system-driven scoring methodology.

MIIs will further formulate SOPs to monitor system availability and continuity of service delivery to market participants and flag any disruption or deviation.

Separately, the regulator has also aligned its Incident Reporting Portal with the Format for Incident Reporting Exchange (FIRE) framework developed by the Financial Stability Board (FSB) in order to streamline the reporting of cyber incidents.

FIRE enables structured incident reporting by defining common information fields, standardised definitions, and consistent classification of incident attributes, promoting harmonisation across sectors or jurisdictions.

“The portal will facilitate reporting of incidents in stages to reflect the incident life cycle from initial reporting to intermediate updates and final closure, while acknowledging that certain information may not be available at the time of initial reporting,” SEBI said.

SEBI has asked regulated entities (REs) to report cyber incidents through the Cyber Incident Reporting Portal of the regulator.

Published on August 24, 2026