SEBI Proposes IT Resilience Index to Strengthen Market Infrastructure Due to Rising Tech Risks

The Securities and Exchange Board of India (SEBI) has proposed a framework for introducing an IT Resilience Index (ITRI) for Market Infrastructure Institutions (MIIs) such as stock exchanges, clearing corporations, and depositories. The objective is to assess and monitor the robustness, security, and efficiency of critical IT systems that ensure uninterrupted market functioning. The index will be computed using predefined parameters including availability, security, governance, business continuity, and scalability, with assigned weightages. MIIs are required to calculate the ITRI on a half-yearly basis through a system-driven, non-discretionary process and submit comparative analysis reports to SEBI. The framework also mandates standardization through the Industry Standards Forum to ensure uniformity and comparability across institutions. This initiative aims to enhance transparency, identify vulnerabilities, and strengthen technological resilience in the securities market, thereby safeguarding investor interests and improving overall market stability.

Securities and Exchange Board of India

Consultation Paper: Framework of IT Resilience Index for Market Infrastructure Institutions (MIIs)

SEBI- Mar 25, 2026 |  Reports : Reports for Public Comments

Click here to provide your comments

1. Objective:

1.1. The objective of the consultation paper is to seek views on creation of IT Resilience Index (ITRI) for MIIs that would be computed periodically on a pre-decided set of parameters and which would provide insights to the MII on health of its IT systems across various dimensions.

2. Background:

2.1. IT systems of MIIs are cornerstone of smooth and uninterrupted functioning of MIIs. Creation of an index that would capture smooth functioning and resilience of IT systems of MIIs would provide insights to the management and oversight committees of MIIs on the systems of MIIs and possible areas of improvement.

2.2. Based on the discussions with MIIs, an initial framework of ITRI for MIIs was formulated. The MIIs have implemented a working model of such index and the results were subsequently discussed in various meetings of SEBI’s Technical Advisory Committee (TAC).

3. Regulatory Objective:

3.1. To provide a framework to compute ITRI of MIIs based on system-driven computation

3.2. To enable MIIs to compare the health/efficacy of their IT systems over time and to identify areas of improvement

3.3. To create a uniform set of metrics and their weights to compare ITRI across MIIs

4. Proposals:

Keeping in mind the aforesaid objectives, a draft Circular with the formulation of proposed Framework of ITRI for MIIs has been prepared.

5. Invitation for Public Comments:

5.1. Public comments are invited on the proposals outlined in the draft Circular at

Annexure 1. The comments/ suggestions should be submitted latest by April 15, 2026, through the online web-based form which can be accessed using the following link:

https://www.sebi.gov.in/sebiweb/publiccommentv2/PublicCommentAction.do? doPublicComments=yes

5.2. In case of any technical issue in submitting your comment(s) through the web based public comments form, you may email your comment(s) to anupamk@sebi.gov.in / mrdtpad@sebi.gov.in. While sending the email, kindly mention the subject as “Consultation Paper on Framework of IT Resilience Index for Market Infrastructure Institutions (MIIs)”

Issued on: March 25, 2026

*****

Annexure 1

Draft Circular

SEBI/HO/MRD/TPD-1/P/CIR/2026/XXX

 MM DD, 2026

To,

All Stock Exchanges

All Clearing Corporations

All Depositories

Dear Sir/ Madam,

Subject: Framework of IT Resilience Index for Market Infrastructure Institutions (MIIs)

1. IT systems of MIIs are cornerstone of their smooth and uninterrupted functioning. Creation of an index that would capture well-functioning and resilience of IT systems of MIIs would provide insights to the management and oversight committees of MIIs on the health of such systems and possible areas of improvement.

2. Accordingly, pursuant to discussion with SEBI’s Technical Advisory Committee (TAC), the following system-driven framework for computation of IT Resilience Index (ITRI) is stipulated for MIIs:

2.1. ITRI shall measure the robustness of Critical Systems of MIIs as defined at Clause 9.1.2.3 of Master Circular dated December 30, 2024 for Stock Exchanges and Clearing Corporations, Clause 4.31.2.3 of Master Circular dated December 03, 2024 for Depositories, and Clause 16.4.3(c) of Master Circular dated August 04, 2023 for Commodity Derivatives Segment. The scope shall also include other systems feeding / related to such Critical Systems.

2.2. The parameters of computing ITRI and their weightages shall be as follows:

2.3. The Industry Standards Forum (ISF) of MIIs constituted by SEBI shall finalize sub-parameters and detailed measurement criteria for each parameter of ITRI (mentioned at Para 2.2 above) within a period of three months from the date of this Circular.

2.4. MIIs shall compute ITRI on a half-yearly basis within a period of 60 days from the end of each half-year. The comparative analysis of two consecutive half-years along with observations of SCOT / Governing Board and corrective actions taken (or proposed to be taken), if any, shall be submitted to SEBI within a period of 90 days from the end of each half-year.

2.5. The MIIs shall endeavour that the computation of ITRI shall be system-driven, i.e., to the extent possible, ITRI would be computed automatically from IT systems (or data extracted from such systems) without manual intervention. This is stipulated with the objective of ensuring that computation of ITRI remains non-discretionary and fool proof.

2.6. The ISF shall also formulate baseline parameters, acceptable threshold scores as well as the SOP for calculating ITRI along with an objective system-driven scoring methodology. This is with the intention of having comparability across MIIs.

2.7. The aforesaid framework would function as a self-operating model requiring MIIs to periodically compute the ITRI and provide insights to their Governing Boards on overall health of IT systems and areas of improvements.

3. MIIs are required to take necessary steps to put in place systems for implementation of this Circular, including necessary amendments to the relevant bye-laws, rules and regulations, if any.

4. MIIs have already implemented the beta version of the ITRI framework. MIIs shall operationalize the aforesaid ITRI framework (including standardization exercise by ISF mentioned at Para 2.3 and 2.6 above) within six months from the date of this Circular. The first submission under this framework shall be for the half-year ended September 30, 2026.

5. This Circular is being issued in exercise of powers conferred under Section 11(1) of the Securities and Exchange Board of India Act, 1992 and to protect the interests of investors in securities and to promote the development of, and to regulate the securities market.