M-SOC

A Security Operations Centre is the team and technology that watches an organisation's systems for attacks. Building one from scratch is expensive.

For a small portfolio manager with a handful of staff, that cost is out of proportion to the business. But the data is just as sensitive as a large firm's.

An M-SOC, or Market SOC, is the answer. It is a Security Operations Centre designed specifically for the cyber security needs of smaller registered entities in the financial market. The workbook's description is that it offers a more accessible and cost-effective solution than building a full-fledged SOC from scratch.

It is mandatory, with one narrow exemption. A portfolio manager in the self-certification category with fewer than 100 clients is exempted from the requirement.

Everyone else has to have one.

What it is (Chapter 11, section 11.7, footnote). M-SOC refers to a Security Operations Centre specifically designed to cater to the cyber security needs of smaller registered entities in the financial market, offering a more accessible and cost-effective solution than building a full-fledged SOC from scratch.

The exemption. Portfolio Managers who fall under the self-certification REs category and have less than 100 clients are exempted from the requirement of a mandatory Market-SOC.

Where the categories come from. Section 11.7 covers the Cyber Security and Cyber Resilience Framework (CSCRF) for portfolio managers. As part of operational risk management, portfolio managers need a robust cyber security and cyber resilience framework to protect data integrity and guard against breaches of privacy. All portfolio managers with assets under management as specified by SEBI must follow SEBI's cyber security guidelines, and the CSCRF follows a graded approach, classifying Regulated Entities into five broad categories:

1. Market Infrastructure Institutions (MIIs)
2. Qualified REs
3. Mid-size REs
4. Small-size REs
5. Self-certification REs

How a portfolio manager is categorised. The workbook's entity-wise table for PMS players is drawn on AUM, and only two of the five categories carry a threshold for them:

The timing rule. The category is decided at the beginning of the financial year on the previous financial year's data. Once decided, the RE remains in that category throughout the financial year, irrespective of any change in the parameters during the year. The respective reporting authority validates the category at the time of compliance submission, and the criteria and thresholds continue to be updated as and when required.

So the exemption has two conditions, and both must hold — the self-certification category, which for a PMS means AUM of Rs 3,000 crore and below, and fewer than 100 clients.

Illustrative figures applying the workbook's thresholds. Four portfolio managers are categorised at the start of a financial year on the previous year's data.

Arya Capital and Dwarka Asset clear both tests. Bhairav Wealth fails on client count despite modest AUM. Chandra PMS fails on AUM despite only 84 clients — the exemption is not available to a Mid-size RE at any client number.

Now watch the timing rule bite. Dwarka Asset wins a Rs 400 crore mandate in July, taking AUM to Rs 3,350 crore, and crosses 100 clients in September.

It does not move category mid-year. It stays a self-certification RE, and exempt, for the whole of that financial year — because the category is fixed at the beginning of the year on the previous year's data and holds irrespective of changes during the year.

At the start of the next financial year it is re-categorised on this year's data: Rs 3,350 crore is above Rs 3,000 crore, so it becomes a Mid-size RE and an M-SOC becomes mandatory. The lead time it gets is a consequence of the timing rule, not a concession.

Chapter 11, section 11.7 (Cyber Security and Cyber Resilience framework for Portfolio Managers), sets out the CSCRF's five RE categories, the AUM-based table for PMS players, the beginning-of-year categorisation rule, and the M-SOC exemption in its footnote.

Expect a question on the exemption's two conditions — self-certification category and fewer than 100 clients — on the Rs 3,000 crore AUM line that separates Mid-size from Self-certification for a PMS, and on when the category is decided and how long it holds. The five-category list is also asked directly.

• The exemption needs both conditions. Self-certification category and fewer than 100 clients. Either one alone is not enough, and this is the whole point of the provision.
• Fewer than 100 clients, not 100 or fewer. A portfolio manager with exactly 100 clients is not exempt.
• Rs 3,000 crores and below is Self-certification; above Rs 3,000 crores is Mid-size. For PMS players the workbook's table marks the Qualified and Small-size rows as not applicable.
• The category is frozen for the financial year. Crossing a threshold in the middle of the year does not change the category until the next year's categorisation.
• M-SOC is a shared, scaled-down SOC, not a lighter set of rules. The saving is in how the centre is built and run, not in the obligation to monitor.
• CSCRF is the framework; M-SOC is one requirement inside it. Cyber Security Risk and cyber resilience pages cover the framework itself.