Incident Response Team
The two-member team — a QRTA's Managing Director and Chief Technology Officer — responsible for declaring a technology disaster and invoking the business continuity plan.
In plain language
When a Qualified RTA's systems go down, somebody has to make the call — is this a routine glitch, or a disaster that triggers the business continuity plan? SEBI does not leave that decision to whoever is on shift. It names who is authorised to make it.
That is the Incident Response Team (IRT) — a standing, named body inside every QRTA whose job is exactly this call, and the follow-through once it is made.
How it works
The IRT consists of the QRTA's Managing Director and Chief Technology Officer (CTO), and it is responsible for the actual declaration of a disaster and for invoking the Business Continuity Plan (BCP).
The trigger is time-bound: if a disruption of critical systems lasts more than 30 minutes, the QRTA must declare a "disaster" and restore operations within 45 minutes, either from the primary site or from the Disaster Recovery Site (DRS). QRTAs must also maintain a Near Site (NS), in addition to the DRS, to ensure zero data loss.
The IRT sits inside a wider cyber security governance structure: a Chief Information Security Officer (CISO) is appointed to run day-to-day risk assessment and response, and a Technology Committee of the Board, made up of technology experts, reviews the cyber security and resilience policy every quarter. Cyber-attacks, threats and breaches must separately be reported to SEBI within 6 hours of detection, and also to CERT-In.
A worked example
A QRTA's core transaction-processing system goes down at 11:00 am on a business day. At 11:32 am — past the 30-minute mark — the Incident Response Team, the Managing Director and CTO acting together, declares a disaster.
The clock then runs on 45 minutes: by 12:17 pm the QRTA must have restored operations, either by bringing the primary site back or by cutting over to the DRS. Because the QRTA also maintains a Near Site, no data between the last back-up and the failure is lost.
Separately, because the trigger was a cyber incident rather than a routine hardware fault, the QRTA's CISO must report it to SEBI within 6 hours and to CERT-In — a duty that runs alongside, not instead of, the IRT's 45-minute restoration clock.
Why NISM asks about it
Chapter 7 (Registrars and Transfer Agents Regulations), section 7.4 (Cyber Security and Cyber Resilience Framework for QRTAs), names the IRT's composition and its disaster-declaration role, alongside the 30-minute/45-minute timing and the 6-hour SEBI reporting window. Expect a question on who sits on the IRT and what triggers a disaster declaration.
Common exam traps
- The IRT is exactly two people by role — the MD and the CTO — not the whole IT department.
- 30 minutes is the trigger for declaring a disaster; 45 minutes is the window to restore operations — these are two different clocks, easily swapped in a question.
- 6 hours is the SEBI/CERT-In reporting window for a cyber incident, a separate obligation from the IRT's restoration duty.
- A Near Site is in addition to the DRS, aimed specifically at zero data loss, not a substitute for the DRS.
- This framework applies to QRTAs — RTAs servicing more than 2 crore folios — not to every registered RTA.
Check yourself
1.QRTAs must maintain a Business Continuity Plan (BCP) to ensure:
- a)Operations can resume after disruption
- b)Higher commission payments
- c)Faster NAV computation
- d)Enhanced advertisement outreach
Show the answer
Answer: (a) Operations can resume after disruption
QRTAs shall maintain Business Continuity Plan (BCP) and Disaster Recovery Site (DRS) with a Near site situated at location other than primary processing location (off-site), which is capable to take over operations without disruption in case of any service failure at primary processing site.
"Capable to take over operations without disruption" — continuity is the whole purpose.
Options B, C and D describe commercial or operational benefits that have nothing to do with continuity planning.
What the plan must contain. QRTAs shall have written policy, protocols, processes and controls for BCP and DRS.
And it must be usable, not merely written. The manpower deployed at DRS/ Near Site (NS) shall have the same expertise as available at PDC in terms of knowledge/ awareness of various technological and procedural systems and processes relating to all operations such that DRS/NS can function at short notice, independently. QRTAs shall have sufficient number of trained staff at their DRS so as to have the capability of running live operations from DRS without involving staff of the PDC.
The kit must match too: hardware, system software, application environment, network and security devices and associated application environments of DRS and PDC shall have one to one correspondence between them.
Who invokes it: the Incident Response Team (IRT) consisting of the Managing Director and Chief Technology Officer (CTO) of the QRTA which shall be responsible for actual declaration of a disaster and invoking the BCP.
And the trigger: in case of a disruption of critical systems for more than 30 minutes, the QRTA shall declare a "disaster" and restore operations within 45 minutes either from primary site or DRS.
It is rehearsed regularly — Disaster Recovery Drills should be conducted on a quarterly basis with minimal notice, and live running at least 1 days in every three months and 2 consecutive days every 6 months.
2.Which of the following is NOT part of the cyber security and cyber resilience framework prescribed by SEBI?
- a)Catch the cyber attacker and file a police complaint
- b)Identify, assess, and manage cyber security risk
- c)Continue operations during a cyber attack
Show the answer
Answer: (a) Catch the cyber attacker and file a police complaint
The framework is about preparedness and continuity, not law enforcement.
The cyber security and cyber resilience policy for QRTAs includes the following process to identify, assess, and manage cyber security risk associated with processes, information, networks and systems — which is option B, in the workbook's own words.
And option C is the definition of resilience: Cyber Resilience is an organization's ability to prepare and respond to a cyber-attack and to continue operation during, and recover from, a cyber-attack.
The second of the five goals says the same: Withstand: Continue essential business functions at times of adversary attacks.
Option A is nowhere in the framework. Investigating and prosecuting an attacker is police work; what the QRTA must do is report. Cyber-attacks, threats, cyber-incidents and breaches experienced by QRTAs should be reported to SEBI within 6 hours of noticing / detecting such incidents. Such incidents should also be reported to Indian Computer Emergency Response team (CERT-In).
Report within six hours — to two bodies.
What the framework actually contains. Five goals — Anticipate · Withstand · Contain · Recover · Evolve — linked to six functions: Governance; Identity; Protect; Detect; Respond; Recover.
And what it is protecting: cyber-attacks and threats attempt to compromise the Confidentiality, Integrity and Availability (CIA) of the computer systems, networks and databases.
The concrete measures follow the same logic — a CISO, an Incident Response Team, a Near Site (NS) to ensure zero data loss, a disaster declared after more than 30 minutes with restoration within 45 minutes, quarterly Technology Committee review and quarterly Disaster Recovery Drills.
Every one is about carrying on, not about catching anyone.
Where this is taught
Free preparation for NISM Series II-BRelated terms
- Registrar and Transfer AgentThe SEBI-registered agency that keeps the investor records of a mutual fund — processing purchases and redemptions, updating folios and unit capital, and issuing account statements.
- Wind-down planA QRTA's mandatory plan for transferring its entire operations to another SEBI-registered RTA if its net worth erodes, it becomes insolvent, or it can no longer provide critical services.