SEBI Chairman Tuhin Kanta Pandey announced two new initiatives aimed at strengthening cybersecurity, incident reporting and information sharing across the securities market ecosystem.
Addressing the SEBI Symposium on Cyber Defence, Pandey said cyber threats transcend organisational and regulatory boundaries and can have consequences across interconnected institutions and even national borders.
“Cyber threats do not respect organisational boundaries. They do not respect regulatory boundaries. And they certainly do not respect national borders,” he said.
SEBI has launched a revamped Incident Reporting Portal and a new Cyber Suraksha Portal as part of its efforts to enhance cyber resilience across the securities market.
Pandey said a cyber incident that originates in one organisation can potentially spread through vendors, technology platforms, third parties or other connected institutions. Therefore, cyber resilience needs to be strengthened not only at the level of individual organisations but across the entire financial ecosystem.
The revamped SEBI Incident Reporting Portal is aimed at making cybersecurity incident reporting more structured, timely and actionable. The portal is aligned with the Financial Stability Board’s (FSB) Format for Incident Reporting Exchange (FIRE), which seeks to bring greater consistency to incident reporting and reduce friction in cross-border reporting.
The second initiative, the Cyber Suraksha Portal, will serve as a central hub for sharing cybersecurity-related information among stakeholders. It will facilitate the exchange of cybersecurity knowledge, vulnerability warnings, policy measures and insights from cyber incidents.
“These are not merely technology platforms,” Pandey said, emphasising that their effectiveness would ultimately depend on how well institutions use them to share information, learn from incidents and respond promptly.
He said lessons from a cyberattack on one institution should help protect others, while effective practices developed by regulators or countries should serve as references for the wider financial ecosystem.
Pandey stressed that cyber resilience should not be viewed as an effort to ensure that systems are never attacked. Instead, it should focus on building the ability to anticipate threats, withstand attacks, respond effectively, recover quickly and learn from incidents.
“Cyber resilience does not mean assuming that our systems can never be attacked. It means building the capability to anticipate, withstand, respond to, recover from and learn from an attack,” he said.
