SEBI IT Resilience Index for Market Infrastructure Institutions (MIIs): what the circular requires

SEBI's 24 August 2026 circular on the IT Resilience Index for Market Infrastructure Institutions sets out a system-driven resilience framework. The framework turns IT resilience from a periodic assertion into a measured, system-driven discipline. It applies to the stock exchanges, clearing corporations and depositories in the circular's scope, excluding AMC Repo Clearing Ltd. For security, risk and operations teams, the immediate task is not to buy a dashboard: it is to build an evidence map that can support half-yearly computation, comparative analysis and corrective action.

What the ITRI measures

The ITRI is built on nine weighted parameters. The weights in the SEBI circular, as set out in paragraph 5.2, are: Availability 20; Security 20; Integrity 10; Governance 10; Reliability and Monitoring 10; Business Continuity 10; Modularity and Flexibility 10; Scalability 5; Others 5. Security and Availability each carry 20, so controls that protect service and demonstrate recoverable, observable operation sit at the centre of the index. The remaining parameters prevent a narrow uptime-only reading: governance, integrity, business continuity, modularity, scalability and other measures all contribute.

The operating model the circular expects

SEBI requires MIIs to compute ITRI for each half-year within 60 days of its end. The scope includes the defined Critical Systems and systems feeding or related to them. Computation must be system-driven; any exception requiring manual data retrieval must first be discussed with SCOT. The calculation must support review and corrective action. MIIs must submit comparative analysis and corrective actions to the Standing Committee on Technology (SCOT) and Governing Board. They must also develop an Early Warning System, continuous service-delivery visibility dashboards and standard operating procedures. The framework is to be operationalised by 28 February 2027. The ISF is to finalise sub-parameters by 30 November 2026. A detailed SOP is to be submitted to SEBI by 31 January 2027. The first ITRI submission is for the half-year ending 31 March 2027. Those dates create a sequence: sub-parameters, SOP, operationalisation, first half-year.

What changes for exchanges, clearing corporations and depositories

The circular shifts the burden of proof. A policy statement that resilience is tested is not enough; the MII needs system-derived evidence, a repeatable calculation and a corrective-action trail that SCOT and the Governing Board can review. That means named metric owners, defined data sources and a clear link between a low or deteriorating parameter and an action. The Early Warning System adds a forward-looking requirement: thresholds, indicators and escalation paths must be defined and tested, not assembled after an incident. The dashboards add a visibility requirement: service-delivery status must be observable continuously, with an SOP that explains how data is collected, validated and escalated.

Where security testing contributes

Security testing can provide evidence about the controls actually assessed: access boundaries, exploitable weaknesses, configuration and remediation verification. Define the systems, methods and limitations in writing. Match each result to an applicable parameter only when the measurement criteria support that mapping.

An assessment report does not implement an ITRI calculation, an Early Warning System or service-delivery monitoring. Treat these as separate workstreams, with their own owners. Do not infer that a standard penetration test covers failover engineering, full business-continuity assurance or every part of the index.

Building the evidence map before the first half-year

Start with the nine parameters and assign an evidence owner for each. For every parameter, record the source system, the calculation or test method, the review frequency, the retention period and the approver. The map should distinguish three kinds of evidence: system-generated data for the ITRI computation; audit and test evidence that supports the design and operation of controls; and governance evidence that shows review, challenge and corrective action. This separation prevents an audit report being presented as an ITRI score.

The sub-parameters due from the ISF by 30 November 2026 will sharpen the map. Until they are finalised, teams can prepare by documenting existing metrics, identifying gaps in system-generated data and testing the escalation paths that an Early Warning System will need. The SOP due to SEBI by 31 January 2027 should define how data is collected, validated and reported. Operationalisation by 28 February 2027 leaves little room for manual workarounds before the first half-year ends on 31 March 2027.

A practical sequence is: inventory current evidence against the nine parameters; mark where evidence is system-driven, audit-derived or absent; assign owners and dates; run scoped testing for the parameters where independent evidence is weakest; and verify that corrective actions can be traced to SCOT and Governing Board reporting. Use that gap map to define the engineering, governance and assurance work required before selecting technology.

The decision to make now

The SEBI IT Resilience Index for Market Infrastructure Institutions (MIIs) makes resilience measurable and reportable on a half-yearly cycle. For exchanges, clearing corporations and depositories in scope, the work starts with the evidence map, the sub-parameter readiness and the corrective-action trail. A scoped audit and testing contribution can strengthen that evidence base for the parameters it covers. It cannot replace the system-driven ITRI, the Early Warning System or the continuous service-delivery dashboards that the circular requires.