SEBI’s IT Resilience Index has to compute itself

Who it binds, and who it does not

The IT Resilience Index binds Market Infrastructure Institutions and nobody else. Stock exchanges, clearing corporations and depositories owe it; brokers, portfolio managers, merchant bankers, AIFs and every other SEBI regulated entity owe nothing under it. That is worth settling first, because SEBI issued a second cyber circular on the same day — HO/(449)2026-ITD-5_DIV1/I/19448/2026, realigning the incident reporting portal — and that one reaches every entity already reporting under CSCRF. Same date, same subject area, entirely different populations.

The addressee list carries one carve-out, stated by name: AMC Repo Clearing Ltd. An exclusion written into the addressees rather than into the operative text is easy to lose when the circular is summarised, and it is the kind of detail worth reading off the notification rather than off a summary of it.

The nine parameters

The index scores the robustness of an institution’s critical systems — a term the circular does not redefine, pointing instead at the clauses of three existing master circulars that already do. Its scope reaches beyond those systems to the other systems feeding into or related to them, which is a wider boundary than it first appears.

Availability and Security carry forty of the hundred between them. Everything beneath that is unwritten: the circular sets the nine parameters and their weightages and stops there, directing the Industry Standards Forum of MIIs to finalise the sub-parameters and the detailed measurement criteria. The ISF also formulates the baseline parameters, the acceptable threshold scores and the scoring methodology, so that the results are comparable across institutions. Until that work lands, an MII knows what it will be scored on and not how.

The index has to compute itself

This is the requirement that makes the circular an engineering problem rather than a reporting one. The computation must be system-driven — produced automatically from IT systems, or from data extracted from them, without manual intervention. SEBI states the purpose in the same breath: so that the computation remains non-discretionary and, in the circular’s own word, fool proof.

The exception is narrow and supervised. Where a parameter genuinely cannot be computed automatically, the institution may retrieve the data by hand — but only after discussing that exception with its Standing Committee on Technology in advance. A manual figure produced first and explained afterwards does not meet the wording.

Read against the reporting line, the intent is clear enough. The index goes half-yearly to the SCOT and the Governing Board, as a comparative analysis of two consecutive half-years on a rolling basis, together with the corrective actions taken or proposed. A score a board is asked to act on is a score somebody could otherwise be tempted to smooth, and a computation nobody’s hands touch is much harder to smooth.

Early warning, and watching service delivery

Two further obligations sit beside the index and are easy to skip past, because neither is expressed as a score.

• An Early Warning System. The MII must build one that detects possible deterioration in any ITRI parameter before it becomes a visible performance issue, along with the framework to remedy what it detects. The index measures the half-year; this is what is meant to catch the problem inside it.
• Continuous visibility into service delivery. MIIs already monitor process and application performance and resource utilisation at each IT component level, under the capacity-planning circular of 10 December 2024. This adds systems that give continuous visibility into the service actually delivered to market participants, including consolidated dashboards.

Taken together, the three requirements describe a loop rather than a filing: measure the half-year, detect deterioration inside it, and show the board what was done about it.

The four dates

MIIs have already implemented a beta version of the framework, which the circular records rather than requires. What follows is dated.

The ordering is the awkward part. Sub-parameters are due at the end of November, the SOPs that depend on them two months later, and the working system a month after that. An institution waiting for the ISF before it starts building has roughly three months to build once it can. The two obligations that do not depend on the ISF — the Early Warning System and the service-delivery monitoring — are the ones available to start on now.

Why this is not the CCI

Both are weighted parameters totalling 100, computed periodically by a SEBI regulated entity, and that is the whole of the resemblance. Confusing them is expensive in both directions: an MII that treats its CCI submission as covering this owes a framework it has not built, and a non-MII that reads coverage of the index as applying to it builds one it does not owe.

An MII computes both, against different criteria, on different cycles, for different readers. The CSCRF obligations are unchanged by this circular, and so is the incident-reporting clock — the FIRE alignment of the same month, HO/(449)2026-ITD-5_DIV1/I/19448/2026, changed the format and the staging of an incident report and moved none of its deadlines.

Parameters, weightages, obligations and every date on this page are from IT Resilience Index for Market Infrastructure Institutions (MIIs), HO/47/18/11(1)2026-MRD-TPD1/I/19509/2026, issued 24 August 2026, read from the circular PDF on sebi.gov.in. It follows the consultation paper of 25 March 2026. The sub-parameters and measurement criteria beneath the nine parameters are not settled at the time of writing and are due from the Industry Standards Forum by 30 November 2026 — nothing here should be read as anticipating them. This page is commentary on a published circular, not legal advice, and the circular should be read in full before anyone relies on a characterisation of it, including this one. External measurement referenced here is a Bitsight capability; BitScore Cybertech LLP is an authorised Bitsight partner.