🗞️ Why in News The Securities and Exchange Board of India issued a circular on August 24, 2026 introducing an IT Resilience Index (ITRI) for Market Infrastructure Institutions. The index scores institutions on a uniform set of parameters, replacing subjective audit findings with comparable measurement.
What a Market Infrastructure Institution Is
Market Infrastructure Institutions (MIIs) are the three categories of entity on which the securities market physically runs:
| Category | Examples |
|---|---|
| Stock exchanges | NSE, BSE, MSE, MCX, NCDEX |
| Depositories | NSDL, CDSL |
| Clearing corporations | NSE Clearing, Indian Clearing Corporation, MCX Clearing |
India has exactly two depositories, NSDL and CDSL, which is a standard Prelims fact.
The Index
ITRI is computed on nine parameters with fixed weights. The two carrying the highest weight are:
| Parameter | Weight |
|---|---|
| Availability | 20 per cent |
| Security | 20 per cent |
| Integrity, Governance, Reliability, Monitoring, Business Continuity, Modularity, Flexibility | 10 per cent each |
The stated purpose is to strengthen performance monitoring, ensure timely service delivery, identify emerging IT weaknesses early, and enable timely corrective action.
The Companion Measure
In the same batch, SEBI aligned its Incident Reporting Portal with the FIRE framework, meaning Format for Incident Reporting Exchange, developed by the Financial Stability Board. This standardises cyber-incident information fields, definitions and classification.
The FSB was established in 2009 at the London G20 Summit, succeeding the Financial Stability Forum of 1999. It is based in Basel, and India is a member.
SEBI Itself
| Attribute | Detail |
|---|---|
| Established | 1988 as a non-statutory body |
| Statutory status | April 12, 1992, under the SEBI Act, 1992 |
| Headquarters | Mumbai |
| Character | Quasi-legislative, quasi-executive and quasi-judicial |
| Appeals | To the Securities Appellate Tribunal (SAT), and thereafter to the Supreme Court on a question of law |
The Existing Cyber Architecture
| Instrument | Content |
|---|---|
| Cyber Security and Cyber Resilience Framework (CSCRF) | SEBI’s framework for regulated entities |
| BCP-DR norms | Business Continuity Plan and Disaster Recovery, with Recovery Time Objective (RTO) and Recovery Point Objective (RPO) |
| CERT-In | Under the Information Technology Act, 2000; its 2022 directions require reporting of specified cyber incidents within six hours |
| DPDP Act, 2023 | Digital personal data protection obligations |
Critical Analysis
Financial-market risk has migrated from credit and liquidity to operational and technological. A single exchange outage now transmits systemic stress faster than a solvency event, because trading halts freeze price discovery and margin flows simultaneously. That is why the regulator is now scoring uptime with the seriousness once reserved for capital adequacy.
Quantification carries its own hazard. Any published index invites gaming toward the measured parameters. Weighting Availability and Security at 20 per cent each may under-price Governance, where most real failures originate. Outages are typically change-management failures, meaning a badly tested deployment, rather than raw technology failures. An index that rewards uptime may inadvertently discourage the very upgrades that produce long-run resilience.
Concentration risk is not diversifiable for the retail investor. With two depositories and effectively two dominant equity exchanges, an investor cannot hedge MII failure by choosing a different provider. The index should therefore be paired with mandatory interoperability and failover-to-competitor arrangements, not treated as a substitute for them. Measuring resilience does not create it.
Adopting the FSB’s FIRE format is strategically significant. It makes Indian incident data internationally comparable, which supports India’s positioning in global financial standard-setting, a theme carried forward from its G20 presidency.
UPSC Relevance
GS Paper 3 (Economy and Security): Indian economy, mobilisation of resources, financial markets and regulators; cyber security.
GS Paper 2 (Polity): Statutory, regulatory and quasi-judicial bodies.
Prelims focus: SEBI’s 1988 constitution and April 12, 1992 statutory status; the appeal route through SAT; what MIIs comprise; India’s two depositories; ITRI’s nine parameters with Availability and Security at 20 per cent each; FIRE as an FSB framework; the FSB’s 2009 creation at the London G20 Summit; CERT-In’s six-hour reporting window.
Mains angle: Argue that operational resilience has become a systemic-risk category in its own right, distinct from the capital-adequacy paradigm that dominates financial regulation. Note that regulators worldwide are still adapting instruments designed for solvency risk to a risk that manifests as downtime.
Way forward: Publish MII resilience scores or bands so investors receive a resilience signal; tie the score to supervisory intensity and to MII directors’ accountability; mandate live failover drills rather than tabletop exercises; and harmonise SEBI, RBI and CERT-In incident-reporting timelines so a single incident is not reported three different ways in three different formats.
📌 Facts Corner — Knowledgepedia
The Measure:
- SEBI circular of August 24, 2026 introducing the IT Resilience Index (ITRI) for MIIs
- Nine parameters; Availability and Security weighted highest at 20 per cent each
- Other parameters at 10 per cent each: Integrity, Governance, Reliability, Monitoring, Business Continuity, Modularity, Flexibility
- Companion measure: Incident Reporting Portal aligned to the FSB’s FIRE format
Market Infrastructure Institutions:
- Stock exchanges, depositories and clearing corporations
- India’s two depositories: NSDL and CDSL
SEBI:
- Constituted 1988; statutory from April 12, 1992 under the SEBI Act, 1992
- Headquarters Mumbai; quasi-legislative, quasi-executive, quasi-judicial
- Appeals to the Securities Appellate Tribunal, then to the Supreme Court on a question of law
Financial Stability Board:
- Established 2009 at the London G20 Summit, succeeding the Financial Stability Forum (1999)
- Headquartered in Basel; India is a member
- FIRE: Format for Incident Reporting Exchange
Other Relevant Facts:
- SEBI’s Cyber Security and Cyber Resilience Framework (CSCRF) applies to regulated entities
- BCP-DR norms use Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
- CERT-In operates under the IT Act, 2000; 2022 directions require six-hour incident reporting
Sources: SEBI, Business Standard
Source: SEBI Introduces an IT Resilience Index for Market Infrastructure Institutions — Ujiyari.com | Free UPSC & State PCS Current Affairs
