SEBI unveils index for market infrastructure institutions

1. At a Glance

• SEBI launched the IT Resilience Index (ITRI), a standardised scorecard to assess the robustness of IT systems of Market Infrastructure Institutions (MIIs) — stock exchanges, depositories, and clearing corporations [1][4].
• Assesses MIIs across nine parameters on a 100-point scale, aimed at early detection of technology weaknesses before they cause outages [1][2].
• Ties into SEBI's broader push for cyber/tech resilience in India's securities market infrastructure — relevant for GS-III (economy/IT) and governance-of-regulators questions.
• Mandates a linked Early Warning System (EWS) for MIIs to pre-empt system slowness/disruptions [4][1].

2. Why in the News

• SEBI issued a circular (reported in The Hindu Business Line, 25 August 2026) introducing the ITRI for MIIs as part of efforts to strengthen IT system resilience [4].
• Business Standard reported SEBI's move to introduce the ITRI on 24 August 2026, following an earlier proposal stage reported around 25 March 2026 [2][3].

3. Background & Evolution

• SEBI has progressively tightened technology oversight of MIIs: cyber security operations centre mandate (2018), annual System Audit circular (2020), governance committee for MIIs (2022), real-time performance monitoring guideline revisions (December 2024) [2].
• March 2026: SEBI first proposed the IT Resilience Index framework for MIIs [2].
• August 2026: SEBI formally introduced/finalised the ITRI via circular, with MIIs having already run a beta version [1][4].

4. Core Static Facts

5. Multi-Dimensional Analysis

Economic

• MIIs (NSE, BSE, NSDL, CDSL, clearing corporations) are systemically critical to capital markets; IT outages directly disrupt price discovery, settlement, and investor confidence.
• Standardised resilience scoring aids SEBI in pre-emptive supervision, reducing costly market-wide disruption risk.

Scientific/Technological

• Index parameters (availability, security, integrity, scalability) mirror standard IT service-reliability/ITIL-type frameworks applied to financial market infrastructure.
• EWS requirement pushes MIIs toward predictive/real-time monitoring rather than post-incident audits.

Legal/Governance

• Issued via SEBI circular (subordinate regulation) under its general power to regulate securities markets — reporting escalates to MIIs' own Standing Committee on Technology (SCOT) and governing boards, reinforcing board-level accountability [1].
• Builds on prior circulars (cyber security operations centre 2018, System Audit 2020) — layered regulatory architecture rather than a one-off rule.

Administrative

• Phased rollout: beta version already run by MIIs → full framework operational by 28 Feb 2027 → first formal half-yearly score for period ending 31 March 2027 — a long compliance runway typical of SEBI's MII-tech reforms [1].

6. Recent Developments (last 12-18 months)

• December 2024: SEBI revised guidelines for real-time performance monitoring of MIIs [2].
• 25 March 2026: SEBI proposed the ITRI framework for MIIs [3].
• 24-25 August 2026: SEBI introduced/finalised the ITRI via circular; reported by Business Standard and The Hindu Business Line [2][4].

7. Prelims Hooks

• ITRI = Information Technology Resilience Index, introduced by SEBI.
• Applies to Market Infrastructure Institutions (MIIs): stock exchanges, depositories, clearing corporations.
• Assessed across nine parameters on a 100-point scale.
• Availability and Security carry the highest weight — 20 points each.
• Integrity, Governance, Reliability & Monitoring, Business Continuity, Modularity & Flexibility — 10 points each.
• Scalability and Incident Handling — 5 points each (lowest weight).
• MIIs must set up an Early Warning System (EWS) to flag deterioration in ITRI parameters.
• Full framework (including EWS and Real-Time Monitoring of Service Delivery) to be operational by 28 February 2027.
• First formal ITRI computation: half-year ending 31 March 2027.
• ITRI is computed half-yearly, within 60 days of each half-year's end.
• Reporting escalation: MII's Standing Committee on Technology (SCOT) and governing board.
• MIIs had already run a beta version of ITRI before formal introduction.
• Prior related SEBI move: December 2024 revision of real-time MII performance-monitoring guidelines.

8. Mains Relevance

• GS-III: Indian Economy — mobilization of resources, growth; Science & Technology — IT/cyber resilience in critical financial infrastructure.
• GS-II: Statutory, regulatory bodies (SEBI) — governance and accountability mechanisms.
• Possible question stems:
• "Discuss the significance of technology resilience frameworks like SEBI's IT Resilience Index for the stability of India's capital market infrastructure." (GS-III)
• "Examine the evolving role of SEBI in regulating technology risk in Market Infrastructure Institutions. What are the challenges in ensuring compliance?" (GS-II/III)
• "Why is board-level accountability for IT governance important for systemically important financial market institutions? Discuss with reference to recent SEBI measures." (GS-II)

9. Related Topics to Study Next

• SEBI's regulatory architecture — powers, composition, functions under SEBI Act, 1992.
• Market Infrastructure Institutions (MIIs) — definition, categories (stock exchanges, depositories, clearing corporations), SEBI (MII) Regulations.
• Cyber security frameworks in Indian financial sector — RBI's cyber security framework for banks, comparative approach.
• Systemically Important Financial Institutions (SIFIs) — concept and regulatory oversight.
• Depositories in India — NSDL, CDSL, Depositories Act, 1996.
• Digital Personal Data Protection Act, 2023 — data governance overlap with IT resilience norms.
• SEBI committees on MII governance (2022 governance committee) — link to institutional reform trajectory.
• CERT-In and critical information infrastructure protection — national cyber resilience ecosystem.

10. Common Errors / Trap Areas

• Do not confuse ITRI (IT Resilience Index) with SEBI's earlier Cyber Security and Cyber Resilience Framework (CSCRF) — related but distinct instruments.
• MIIs ≠ only stock exchanges; the term also includes depositories and clearing corporations — don't drop the latter two.
• The operationalisation deadline (28 Feb 2027) is distinct from the first computation period (half-year ending 31 March 2027) — aspirants often merge the two dates.
• ITRI is issued via circular, not an amendment to the SEBI Act or a notified Regulation — avoid citing a wrong legal instrument.
• Weightage is not equal across parameters — Availability/Security (20 each) outweigh Scalability/Incident Handling (5 each); don't assume uniform 100/9 distribution.