SEBI has opened consultation on extending the IT and cybersecurity framework used by Market Infrastructure Institutions to their subsidiaries. The proposal reflects a simple operational reality: a stock exchange, clearing corporation or depository can have strong core systems and still be exposed through a less-protected affiliate.
What counts as market infrastructure
MIIs sit at the heart of trading and settlement, so outages or intrusions can quickly become systemic events. Their subsidiaries may host technology, data, services or operational functions that connect back into those critical systems.
Why regulators look beyond the parent company
Attackers often target the weakest connected environment rather than the most heavily defended one. If a subsidiary has privileged access, shared credentials, common vendors or data links, a compromise can move laterally into more sensitive infrastructure.
The consultation approach matters
SEBI is asking market participants to comment before finalising the extension. That gives exchanges and other institutions an opportunity to identify which subsidiaries should be covered and how proportionality should work for very different businesses.
What comes next
Key questions include scope, audit obligations, incident reporting, third-party risk and whether subsidiaries must meet the same resilience standards as their parent MIIs. The final framework will matter to vendors as well as regulated firms.
Bottom line
Cybersecurity does not stop at a corporate boundary. SEBI’s proposal is an attempt to regulate the connected system rather than only the flagship institution.
Source: SEBI
