Overview
- SEBI announced the IT Resilience Index (ITRI) last week to assess IT systems at stock exchanges, clearing corporations and depositories with a uniform nine-parameter, 100-point framework.
- The index weights availability and security at 20 points each, assigns 10 points to integrity, governance, reliability, monitoring, business continuity and modularity, and gives 5 points to scalability and incident handling.
- MIIs must move their beta ITRI into full operation by February 28, 2027, deploy an Early Warning System and real-time service monitoring, and compute the index half-yearly with the first formal score covering the half-year ended March 31, 2027.
- SEBI requires system-driven, automated computation of the ITRI with manual fixes only after discussion with the Standing Committee on Technology, and it has aligned its incident portal with the FSB’s FIRE format for staged reporting.
- Industry experts praise the clear, quantitative approach but warn that differing MII architectures, fast-evolving cyber threats and significant costs for automated monitoring and redundancy will require ongoing calibration and investment.