Kathmandu, November 5
The Securities Board of Nepal (SEBON) has introduced an information technology (IT) policy aimed at strengthening cybersecurity in the country’s capital market.
The move follows a ransomware attack on a data centre that forced the stock market to shut down on September 21. The policy, which came into effect on Wednesday, covers information technology security and emerging technologies across the securities market.
The policy requires the establishment and management of a standardised disaster recovery mechanism in line with international practices to ensure the sustainable, reliable and secure use of trading systems, clearing and settlement mechanisms, the central depository system and warehouse-related records.
“The main objective of the policy is to make the overall functioning of the securities and commodity exchange markets results-oriented, effective, measurable and accountable through the development and expansion of information technology infrastructure,” the board said.
The policy also seeks to bring IT outsourcing by the board, market infrastructure institutions and market participants within a clear legal and technical framework to make their digital infrastructure secure, reliable and accountable.
Contracts with external service providers will be required to include service-level agreements (SLAs), provisions on data security and confidentiality, liability arrangements, audit and inspection rights, and exit strategies.
The board will also establish minimum IT standards for systems used by licensed markets, businesses, institutions and funds, and make compliance with those standards mandatory.
To improve the security and reliability of IT systems used in the capital market, the policy proposes security measures based on international standards. Relevant institutions will be required to obtain ISO/IEC 27001 certification, conduct annual vulnerability assessments and penetration testing, and carry out regular system audits.
The policy also proposes establishing an integrated cyber incident reporting portal to monitor, manage and control cybersecurity incidents in the capital market.
Market institutions will be required to report cyberattacks and other security incidents through the portal. They will also have to promptly notify the authorities when an incident occurs, contain the risk, restore affected systems and take corrective measures to prevent similar incidents.
The policy requires critical market infrastructure and businesses to have business continuity plans and disaster recovery plans.
It also proposes developing the concept of e-SEBON to transform institutional performance through the use of information technology.
In addition, the board plans to move towards establishing a shared data centre with the participation of market infrastructure institutions and market participants. The data centre is considered a critical part of the securities market’s infrastructure.
The policy further proposes more efficient management and use of the board’s existing IT resources.
To strengthen the skills of IT personnel, the board plans to provide training, study opportunities and exposure visits. It will also prioritise areas such as artificial intelligence (AI), regulatory technology (RegTech), supervisory technology (SupTech), electronic governance and cybersecurity.
