SEBI Widens the Cyber Net: MII Subsidiaries, FIRE Reporting and the AI-Era CSCRF
SEBI's 11 September consultation would bring MII subsidiaries under the parent's IT and cyber framework. With FIRE-format incident reporting and a new IT Resilience Index, capital-market cyber rules are tightening quickly.
By Intellinative Research Team ·
Key takeaways
- On 11 September 2026 SEBI proposed that the IT and cyber framework for MIIs also apply to their subsidiaries. A subsidiary would be caught by any one of three tests. Comments close on 2 October 2026.
- Since 24 August 2026, SEBI's incident portal takes staged reports (initial, intermediate, final) in the FSB's FIRE format. The deadlines are unchanged: email within 6 hours and portal filing within 24 hours.
- A new IT Resilience Index for MIIs becomes operational on 28 February 2027. Availability and Security each carry a 20% weight.
- SEBI's 5 May 2026 AI advisory calls for immediate patching, AI-assisted vulnerability assessment, API security, Zero Trust and current SBOMs.
- IRDAI (April 2026) and PFRDA (January 2026) also use 6-hour incident reporting. The six-hour window is now standard across Indian financial regulators.
Three tests decide whether a subsidiary is in scope
SEBI's consultation paper of 11 September 2026 addresses a gap that group structures create. Exchanges, clearing corporations and depositories often move technology, data or operations into subsidiaries. Those subsidiaries have not always been held to the parent's cyber standard. Under the proposal, a subsidiary is covered if it meets any one of the following tests (CorpLawUpdates summary):
- Function test: it performs an activity that the MII itself should perform.
- Data test: it handles data that the MII is required to protect.
- Infrastructure test: it shares technology infrastructure with the MII.
An exemption is available only when the infrastructure test is the sole trigger. It requires documented compensatory controls and approval from the MII's Standing Committee on Technology (SCOT) and its Board.
- 3 tests: function, data, shared infrastructure. Any one brings a subsidiary into scope (SEBI consultation, 11 Sep 2026)
- 6h / 24h email report, then portal filing, now in staged FIRE format (SEBI circular, 24 Aug 2026)
- 20% weight each for Availability and Security in the IT Resilience Index (SEBI circular, 24 Aug 2026)
- 395 M hits in 11 minutes: DDoS on NSE's website in May 2025, disclosed in its offer document (Multibagg / HDFC Sky)
FIRE-format reporting and the IT Resilience Index
On 24 August 2026 SEBI issued two circulars. The first aligns its Cyber Incident Reporting Portal with the Financial Stability Board's Format for Incident Reporting Exchange (FIRE). Reports now go in stages: an initial report, then intermediate updates, then a final report. The deadlines stay the same: email within 6 hours and portal filing within 24 hours.
The second creates an IT Resilience Index (ITRI) for MIIs with nine weighted parameters. It becomes operational on 28 February 2027. The first assessment period is the half-year ending 31 March 2027, and reports are due within 60 days of each period end (Business Standard).
CSCRF today: tiers, SBOM, Market SOC and the capability index
SEBI's Cybersecurity and Cyber Resilience Framework (circular of 20 August 2024) sorts regulated entities into five tiers: MII, Qualified, Mid-size, Small-size and Self-certification. After several extensions, compliance was due by 31 August 2025 for most entities. MIIs, KRAs and QRTAs were held to the earlier 30 June 2025 date. SEBI issued clarifications on 30 April 2025 and technical clarifications on 28 August 2025.
| CSCRF element | What it asks for |
|---|---|
| SBOM | A software bill of materials for critical applications, covering in-house, COTS and SaaS software |
| Market SOC (M-SOC) | Eligible entities are told to speed up onboarding to the market-wide SOC |
| Cyber Capability Index | A weighted score. MIIs are assessed by a third party every six months; Qualified REs self-assess annually. Parameter counts and score bands are reported by vendor summaries, so check them against the CSCRF annexure |
| Tiering | Obligations scale across the five entity tiers |
The May 2026 AI advisory raised the bar
SEBI's advisory of 5 May 2026 on emerging advanced AI tools for vulnerability detection tells all regulated entities to patch immediately (with virtual patching where no fix exists), run both conventional and AI-assisted vulnerability assessments, secure their APIs, speed up M-SOC onboarding, adopt Zero Trust, and keep asset inventories and SBOMs current. It closely follows CERT-In's 12-hour remediation blueprint. For a full analysis of the advisory and its ten controls, see our research report AI-Driven Vulnerability Scanners and Capital Market Resilience.
An AI-generated alert is not a finding. … Technology may be outsourced but regulatory responsibility cannot. — Tuhin Kanta Pandey, SEBI Chairman, Global Fintech Fest · 10 Sep 2026
Six hours is now the standard reporting window
| Regulator | Instrument | Incident reporting | Notable requirements |
|---|---|---|---|
| SEBI | CSCRF + FIRE circular | Email 6h, portal 24h, staged | SBOM for critical systems, M-SOC, CCI, ITRI for MIIs |
| RBI | 2026 Directions | DAKSH 6h + CERT-In | CISO reports to risk ED, three-level CSOC, half-yearly DR drills |
| IRDAI | Info & Cyber Security Guidelines, 6 Apr 2026 | CERT-In within 6h | CISO not under Head of IT, auditor rotated every 3 years, PT twice a year by a CERT-In empanelled auditor, MeitY-empanelled cloud |
| PFRDA | ICS Policy Guidelines 2024, updated 15 Jan 2026 | PFRDA email 6h + CERT-In | Separate report to PFRDA in addition to CERT-In |
| CERT-In | Directions, Apr 2022 | 6h | 180-day log retention in India, NTP sync. CSIRT-Fin coordinates for the financial sector |
An entity that is part of a financial conglomerate, such as a broker with an NBFC arm and an insurance distribution licence, can face three or four reports for one incident, each in a different format and to a different portal. Building one incident record that can be sent to each of them is now a basic operational requirement.
What MIIs, brokers and their technology partners should do
Before 2 October (MIIs)
- List every subsidiary and apply the function, data and infrastructure tests
- For infrastructure-only cases, document the segmentation and compensating controls you would rely on
- Send comments on the consultation, especially on the exemption process and timelines
This quarter (all regulated entities)
- Map incident fields to FIRE and rehearse a staged report: initial within 6h, portal within 24h
- Refresh SBOMs for critical applications. Ask COTS and SaaS vendors for machine-readable SBOMs and VEX
- Add AI-assisted vulnerability assessment alongside conventional VAPT, as the May 2026 advisory asks
- Check your M-SOC onboarding status and data feeds
- For MIIs: collect a baseline for the nine ITRI parameters ahead of 28 February 2027
Intellinative designs segmented, auditable cloud landing zones for regulated Indian platforms. See our GST platform security build and Red Hat OpenShift as a Service. For the SBOM side, read our software supply chain briefing and the Shift-Left Gap Report.
Frequently asked questions
What did SEBI propose on 11 September 2026?
That the IT and cyber security framework for market infrastructure institutions also apply to their subsidiaries, if a subsidiary performs an MII function, handles data the MII must protect, or shares technology infrastructure with the MII. Comments close on 2 October 2026. The proposal is not yet final.
What is the FIRE format for SEBI incident reporting?
FIRE is the Financial Stability Board's Format for Incident Reporting Exchange. Since 24 August 2026, SEBI's Cyber Incident Reporting Portal accepts staged reports (initial, intermediate and final) in this format. The 6-hour email and 24-hour portal deadlines are unchanged.
When did CSCRF compliance become due?
31 August 2025 for most SEBI regulated entities, after several extensions. MIIs, KYC registration agencies and qualified RTAs were held to the earlier 30 June 2025 deadline.
Does SEBI CSCRF require an SBOM?
Yes. CSCRF requires a software bill of materials for critical applications, including in-house, COTS and SaaS software. SEBI's May 2026 AI advisory also tells entities to keep SBOMs and asset inventories current.
What is SEBI's IT Resilience Index?
A nine-parameter weighted index for MIIs, with Availability and Security at 20% each. It becomes operational on 28 February 2027. Reports are half-yearly, due within 60 days of each period end, starting with the half-year ending 31 March 2027.
How fast must insurers report cyber incidents?
Within 6 hours to CERT-In, under IRDAI's revised Information and Cyber Security Guidelines of April 2026. PFRDA entities must also email PFRDA within 6 hours, in addition to reporting to CERT-In.
Sources
- Consultation paper on applicability of IT and cyber security framework of MIIs to their subsidiaries · SEBI · 11 Sep 2026
- Alignment of SEBI's Cyber Incident Reporting Portal with FIRE format · SEBI · 24 Aug 2026
- IT Resilience Index for Market Infrastructure Institutions · SEBI · 24 Aug 2026
- Advisory on emerging advanced AI tools for vulnerability detection · SEBI · 5 May 2026
- Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities · SEBI · 20 Aug 2024
- Technical clarifications to CSCRF · SEBI · 28 Aug 2025
- Key decisions taken in the SEBI Board meeting · SEBI · 24 Sep 2026
- SEBI IT & cyber security framework for MII subsidiaries · CorpLawUpdates · Sep 2026
- SEBI to introduce IT resilience index for market infra institutions · Business Standard · 24 Aug 2026
- SEBI chairman on AI, enforcement and adjudication · MediaNama · Sep 2026
- IRDAI issued the revised guidelines on information and cyber security · TeamLease RegTech · Apr 2026
- PFRDA updates cybercrime reporting requirement · Outlook Money · 16 Jan 2026
- NSE flags AI, cyber risks ahead of IPO · HDFC Sky · 18 Jun 2026
- CSIRT-Fin · CERT-In · —