Mu. Funds will now have to report to SEBI within six hours of the cyber attack

MUMBAI: The Securities and Exchange Board of India (SEBI), the capital market regulator, has tightened the cyber security framework for mutual funds. To this end, mutual funds have decided to require Periodic Vulnerability Assessment and Penetration Testing (VAPT) by an external agency to submit its report within a month.

All incidents of cyber attacks, intimidation and breaches of mutual funds will have to be reported to SEBI within six hours of the incident. Mutual Funds and Asset Management Companies (AMCs) are required to conduct VAPT once in a financial year and for these systems which are identified as protected by National Critical Information Infrastructure Protection Center under IT Act, VAPT should be conducted at least once in each financial year. SEBI has stated in a circular that there will be. This circular will be implemented from 15th July.

Quarterly reports containing information on cyber attacks, fears, cyber incidents and breaches that the mutual funds have experienced and taken action that may be useful to other fund houses should be submitted to SEBI within 15 days after the end of each quarter. In the meantime, mutual funds will have to conduct cyber audits twice in each financial year.

All Mutual Funds with Cyber ​​Audit Reports will be required to submit a declaration from the Managing Director and Chief Executive Officer of the Mutual Fund acknowledging that all SEBI advisory on cyber security has been complied with.