SEBI Introduces IT Resilience Index Framework for MIIs

Summary: SEBI Circular No. HO/47/18/11(1)2026-MRD-TPD1/I/19509/2026 dated August 24, 2026 introduces an IT Resilience Index (ITRI) framework for Market Infrastructure Institutions (MIIs) to monitor the availability, reliability, performance and cyber resilience of their IT systems. The ITRI will measure the robustness of Critical Systems and related systems using nine parameters: Availability and Security carry 20% each; Integrity, Governance, Reliability and Monitoring, Business Continuity, and Modularity and Flexibility carry 10% each; Scalability and Others, such as incident handling, carry 5% each. The Industry Standards Forum (ISF) must finalize sub-parameters and detailed measurement criteria by November 30, 2026, along with baseline parameters, threshold scores and an SOP for system-driven scoring. MIIs must compute ITRI half-yearly within 60 days of each half-year, submit comparative analysis and corrective actions to their Standing Committee on Technology and Governing Board, and develop an Early Warning System. They must also provide continuous visibility into service delivery through consolidated dashboards and SOPs. The framework, including Early Warning System and Real Time Monitoring of Service Delivery, must be operationalized by February 28, 2027, with the first ITRI computation covering the half-year ending March 31, 2027. The framework follows SEBI’s March 25, 2026 consultation paper on ITRI. SEBI Proposes IT Resilience Index to Strengthen Market Infrastructure Due to Rising Tech Risks The Circular is issued under Section 11(1) of the Securities and Exchange Board of India Act, 1992. It also builds upon SEBI’s earlier framework for capacity planning and real-time performance monitoring of MIIs. Revised Guidelines for Capacity Planning by SEBI

Securities and Exchange Board of India

Circular No. HO/47/18/11(1)2026-MRD-TPD1/I/19509/2026 Dated: August 24, 2026

To,
All Stock Exchanges
All Clearing Corporations
All Depositories
(Except AMC Repo Clearing Ltd.)
Dear Sir/ Madam,

Subject: IT Resilience Index for Market Infrastructure Institutions (MIIs)

A. Background

1. IT systems of Market Infrastructure Institutions (MIIs) form backbone of smooth and uninterrupted functioning of Securities market and are fundamental to ensuring its orderly, efficient and uninterrupted functioning. Any disruption, degrading in performance or compromise of these systems may adversely impact critical market operations and pose risks to the trust in the securities market.

2. Accordingly, it is imperative that MIIs ensure the availability, reliability, performance and cyber resilience of their IT systems through robust governance, proactive monitoring and timely corrective measures, so that the securities market continues to operate in a fair, transparent and efficient manner.

3. In order to discharge their role of performance monitoring and ensure timely service delivery to market participants, a framework covering oversight of resilience of IT systems, identifying emerging weaknesses at early stage and initiation of timely corrective measures, has been formulated.

B. IT Resilience Index (ITRI) for MIIs

4. Pursuant to discussion with SEBI’s Technical Advisory Committee (TAC) and Consultation paper dated March 25, 20261, it is decided to create an index that would capture well-functioning and resilience of IT systems of the MII.

5. Following system-driven framework for computation of ITRI is stipulated for MIIs: 5.1. ITRI shall measure the robustness of Critical Systems of MIIs as defined at Clause 9.1.2.3 of Master Circular dated December 30, 2024 for Stock Exchanges and Clearing Corporations, Clause 4.31.2.3 of Master Circular dated December 03, 2024 for Depositories, and Clause 16.4.3(c) of Master Circular dated August 04, 2023 for Commodity Derivatives Segment. The scope shall also include other systems feeding / related to such Critical Systems.

5.2. The parameters of computing ITRI and their weightages shall be as follows:

5.3. The Industry Standards Forum (ISF) of MIIs constituted by SEBI shall finalize sub-parameters and detailed measurement criteria for each parameter of ITRI (mentioned at Para 5.2 above) by November 30, 2026.

5.4. MIIs shall compute ITRI on a half-yearly basis within a period of 60 days from the end of each half-year and submit the comparative analysis of two consecutive half-years (on a rolling basis) and corrective actions taken (or proposed to be taken), to their Standing Committee on Technology (SCOT) and the Governing Board.

5.5. The MIIs shall ensure that the computation of ITRI shall be system-driven, i.e., ITRI would be computed automatically from IT systems (or data extracted from such systems) without manual intervention. This is stipulated with the objective of ensuring that computation of ITRI remains non-discretionary and fool proof. In case any of the parameters of ITRI could not be computed automatically from IT systems and necessitates manual intervention, MII shall carry out manual data retrieval only after prior discussion of such exceptions with their SCOT.

5.6. The ISF shall also formulate baseline parameters, acceptable threshold scores as well as the SOP for calculating ITRI along with an objective system-driven scoring methodology. This is with the intention of having comparability across MIIs.

5.7. The aforesaid framework would function as a self-operating model requiring MIIs to periodically compute the ITRI and provide insights to their Governing Boards on overall health of IT systems and areas of improvements

C. Early Warning System through ITRI

6. MIIs shall develop an Early Warning System to detect possible deterioration in any of the parameters of ITRI leading to possible performance issue, slowness etc. in their systems and framework to remedy these.

D. Continuous Monitoring of Service Delivery to Market Participants

7. At present, MIIs are stipulated2 to continuously monitor the performance of processes / applications and utilization of its system resources at each IT component level to enable the MIIs to do early detection of any possible performance issue, slowness etc.

8. It is further stipulated that MIIs shall build systems providing continuous visibility in to service delivery to market participants. Such systems shall include consolidated dashboards that will assist in monitoring system/application performance and continuous service delivery as well as any deviation / anomalies thereof.

9. MIIs shall also formulate SOPs with regard to para 8 above to monitor availability of systems and continuity of service delivery to all market participants and flag any disruption / deviation thereof.

E. Implementation Time

10. The implementation timeline for operationalization of the ITRI framework by MIIs shall be as follows-

10.1. MIIs have already implemented the beta version of the ITRI framework. MIIs shall operationalize the aforesaid ITRI framework including Early Warning System and Real Time Monitoring of Service Delivery by February 28, 2027.

10.2. The detailed Standard Operating Procedures (SOP) in this regard, after finalization of sub-parameters by ISF (para 5.3 and 5.6) shall be submitted to SEBI after review by SCOT of MIIs by January 31, 2027.

10.3. The first submission of ITRI computation under this framework shall be for the half-year ending March 31, 2027.

11. MIIs are required to take necessary steps to put in place systems for implementation of this Circular, including necessary amendments to the relevant bye-laws, rules and regulations, if any.

12. This Circular is being issued in exercise of powers conferred under Section 11(1) of the Securities and Exchange Board of India Act, 1992 and to protect the interests of investors in securities and to promote the development of, and to regulate the securities market.

Yours faithfully,

Darshil D. Bhatt
Deputy General Manager
Division of Policy and Development – 4
Market Regulation Department
+91-22-26449735
Email: [email protected]

Notes:

¹ Consultation Paper on Framework of IT Resilience Index for Market Infrastructure Institutions (MIIs).

² SEBI Circular dated December 10, 2024 on “Revised Guidelines for Capacity Planning and Real Time Performance Monitoring framework of Market Infrastructure Institutions (MIIs)”