Cyber resilience
An organisation's ability to prepare for and respond to a cyber-attack, keep functioning during it and recover from it — the second half of SEBI's Cyber Security and Cyber Resilience Framework.
In plain language
Cyber security and cyber resilience are two different questions.
Cyber security asks: how do we stop an attack? The workbook defines it as all the tools, measures and processes intended to prevent cyber-attacks.
Cyber resilience asks: when an attack gets through anyway, how do we keep going? It "measures the ability of an organization to prepare and respond to a cyber-attack, continue functioning during and recover from such an attack".
Why the securities market cares: trading moved from open outcry to screens, then to online and mobile trading. The boom in electronic and internet trading has exposed stock exchanges, stock brokers, banks and depositories to the risk of cyber-attacks — and SEBI treats cyber security as a major source of operational risk.
How it works
The framework. SEBI's Cyber Security and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs) comes into effect in a phased manner, superseding earlier separate circulars for MIIs, AMCs, brokers and DPs, QRTAs and KRAs. Under it, five REs are treated as Market Infrastructure Institutions: stock exchanges, depositories, clearing corporations, KRAs and QRTAs.
The five cyber resiliency goals, and the functions mapped to them:
| Goal | Meaning | Cybersecurity function |
|---|---|---|
| Anticipate | Informed preparedness against attacks | Governance, Identify, Protect, Detect |
| Withstand | Continue essential business functions during attacks | Respond |
| Contain | Localise the crisis; isolate trusted from untrusted functions | Respond |
| Recover | Restore business functions to the maximum extent | Recover |
| Evolve | Change functions and capabilities to minimise future impact | Adaptive, evolving controls |
What it requires in practice, per the workbook: a Board/Partner/Proprietor-approved cybersecurity and cyber resilience policy; a Board-approved list of critical systems; access for a defined purpose and period, two-factor security and access logs; periodic audits by a CERT-In empanelled IS auditor; continuous monitoring; timely reporting of incidents through SEBI's incident reporting portal; an Incident Response Management plan, a Cyber Crisis Management Plan (CCMP), root cause analysis and forensic analysis; restoration plans and alternate systems for customers.
REs remain solely accountable for third-party services, vendors managing an RE's systems must follow the SEBI guidelines, and a cyber audit is mandatory at specified periodicity. An RE's category is fixed at the start of the financial year on the previous year's data and does not change during the year.
A worked example
Illustrative incident. A stock broker with 3 lakh clients and an average of Rs 400 crore of client orders a day is hit by ransomware at 10.30 a.m.
| Goal | What resilience looks like |
|---|---|
| Anticipate | Its order and back-office systems were already on the Board-approved critical systems list; a CERT-In empanelled auditor had flagged, and the broker had fixed, weak access controls |
| Withstand | Clients can still square off open positions through the alternate system the broker keeps for such events |
| Contain | The infected back-office servers are isolated from the trading systems, so the attack does not reach order routing |
| Recover | Clean systems are restored; clients are told what happened; the incident is reported through SEBI's portal; root cause and forensic analysis follow |
| Evolve | The controls that failed are redesigned and written into the cyber resilience strategy |
Now the cost of not being resilient, on the illustrative figures. If the broker had had only prevention and the attack took it offline for two full trading days, about Rs 800 crore of client orders (2 × Rs 400 crore) could not have been placed through it — and clients with open positions could not have exited during those two days.
Cyber security reduces the chance of the attack. Cyber resilience decides how much of that Rs 800 crore problem actually happens.
Why NISM asks about it
Chapter 1 (Understanding Securities Markets and Performance), section 1.5.1 "Cyber Security and Cyber Resilience Framework (CSCRF)", defines both terms, lists the five goals and maps them to the cybersecurity functions (Figure 1.2). Expect: the difference between cyber security and cyber resilience; naming or ordering the five goals; which REs count as MIIs under CSCRF (KRAs and QRTAs included); and which goal a described activity belongs to.
Common exam traps
- Security prevents; resilience prepares, withstands and recovers. A question describing recovery after an attack is about resilience.
- Five goals: Anticipate, Withstand, Contain, Recover, Evolve. Governance, Identify, Protect and Detect are functions mapped to Anticipate, not goals.
- Respond maps to Withstand and Contain together.
- Under CSCRF, KRAs and QRTAs are MIIs alongside stock exchanges, depositories and clearing corporations — five in all.
- Incidents are reported through SEBI's incident reporting portal, in a timely manner.
- Audits are by a CERT-In empanelled IS auditing organisation.
- Outsourcing does not transfer accountability. REs are solely accountable for third-party services.
- The workbook cites circulars of 20 August 2024, 31 December 2024, 28 March 2025 and a clarification of 30 April 2025, and describes CSCRF as coming into effect in a phased manner — check the current SEBI position for phase dates, which the workbook does not give.
Check yourself
1.Under the CSCRF, which entities are constituted as Market Infrastructure Institutions?
- a)Stock exchanges, depositories and clearing corporations only
- b)Stock exchanges, depositories, clearing corporations, KYC Registration Agencies and Qualified Registrars and Transfer Agents
- c)Stock brokers, AMCs and depository participants
- d)SEBI, RBI and IFSCA
Show the answer
Answer: (b) Stock exchanges, depositories, clearing corporations, KYC Registration Agencies and Qualified Registrars and Transfer Agents
The CSCRF names five MIIs: (a) Stock Exchanges, (b) Depositories, (c) Clearing Corporations, (d) KYC Registration Agencies (KRAs), and (e) Qualified Registrars and Transfer Agents (QRTAs).
Option A is the trap, because elsewhere the workbook describes Stock Exchanges, Depositories and Clearing Corporations as the systemically important MIIs that provide the critically important facilities related to trading, clearing and settlement. But the CSCRF list adds two more.
Option C names entities correctly described as other intermediaries — Mutual Funds or AMCs, Depository Participants and Stock Brokers — which also need to function within a robust cyber security and cyber resilience framework, but are not MIIs.
The key objective of CSCRF is to address evolving cyber threats, to align with the industry standards, to encourage efficient audits, and to ensure compliance by SEBI REs.
Where this is taught
Free preparation for NISM Series II-BRelated terms
- Algorithmic tradingAny order generated by automated execution logic rather than typed in by a person — software that pushes buy and sell orders into the exchange once its parameters are met.
- Market Infrastructure InstitutionsThe institutions that form the plumbing of the securities market — stock exchanges, depositories and clearing corporations, and under SEBI's cyber framework also KRAs and QRTAs.
- Regulatory sandboxA SEBI framework letting registered market participants live-test FinTech innovations with a limited set of customers, for a limited period, under the regulator's supervision.
- Cyber Security RiskThe risk that an AIF's or its service providers' systems are breached, corrupted or disrupted — governed by SEBI's Cyber Security and Cyber Resilience Framework, which all AIFs had to comply with by 31 August 2025.
- M-SOCA Security Operations Centre built for the cyber security needs of smaller market intermediaries — cheaper and more accessible than building a full SOC, and mandatory for portfolio managers except the smallest.
- Innovation SandboxA SEBI framework letting FinTech firms, start-ups and others not regulated by SEBI test their solutions offline, in isolation from the live market, overseen by exchanges, depositories and qualified RTAs.