Decoding SEBI’s New Cyber Resilience Mandate: Structural Overhaul and the Elevation of CTO and CISO Roles

The landscape of Indian financial markets is undergoing a significant digital transformation. In response to the escalating complexity of technological risks, the Securities and Exchange Board of India (SEBI) has instituted pivotal amendments to the Securities Contracts (Regulation) (Stock Exchanges and Clearing Corporations) Regulations, 2018. These changes fundamentally restructure the governance of Market Infrastructure Institutions (MIIs), placing a renewed emphasis on the roles of Key Managerial Personnel (KMPs).

The amendment specifically targets the elevation of the Chief Technology Officer (CTO) and the Chief Information Security Officer (CISO) within the corporate hierarchy. This strategic move aligns with the regulator's objective to fortify cyber resilience across the ecosystem. By positioning MIIs as the primary defense mechanism against cyber threats, SEBI intends to institutionalize a robust framework for information technology governance. However, while the Cyber Security and Cyber Resilience Framework (CSCRF) provides clarity on roles, a critical analysis reveals nuances regarding accountability mechanisms and structural independence that merit close scrutiny.

The New Regulatory Paradigm for KMPs

The core of the amendment lies in the redefinition of responsibilities assigned to technical leadership. SEBI has moved beyond viewing IT solely as a support function, recognizing it instead as a critical risk management vertical.

1. The Chief Information Security Officer (CISO)

Under the newly emphasized provisions of Regulation 30B, the appointment of a CISO is no longer merely procedural but central to organizational governance. Guided by the recommendations within the CSCRF, the CISO’s mandate has been expanded to include:

  • Incident Containment and Recovery: Leading the organization's response to cyber incidents to ensure minimal downtime and rapid restoration of services.
  • Governance and Standards: Functioning as a standard-setter for cyber-security policies and overseeing their implementation.
  • Full-Time Tenure: SEBI has explicitly clarified that the CISO position must be a full-time engagement, underscoring the intensity and importance of the role.

2. The Chief Technology Officer (CTO)

In contrast to the CISO, the CTO’s role remains domain-specific but equally critical. The CTO is tasked with:

  • Operational Supervision: Overseeing the workflows and processes related to the technological infrastructure.
  • Corrective Action: Implementing remedial measures to address technical inefficiencies or failures.