SEBI categorises entities on size, risk level basis under cybersecurity, cyber resilience framework

India's market regulator SEBI has introduced a new cybersecurity framework classifying market entities into three risk categories based on size and operations. Large brokers, depositories, and exchanges fall under 'Category I' with the strictest compliance requirements. The guidelines mandate real-time monitoring, annual audits, and incident reporting within 6 hours. SEBI's move follows increasing cyber threats to financial infrastructure, with Indian exchanges facing 4.5 million attacks monthly. The risk-based approach aims to optimize security resources while protecting retail investors.