Cyber security obligations for stock brokers and depository participants require mandated resilience, governance and reporting under SEBI framework. SEBI requires all registered Stock Brokers and Depository Participants to adopt a board approved Cyber Security and Cyber Resilience policy setting out identification, protection, detection, response and recovery processes, appoint a Designated Officer and Technology Committee, implement access controls, strong authentication and data encryption, conduct regular VAPT and continuous monitoring, report quarterly threats to exchanges/depositories, and undergo annual independent audits, with vendors and market infrastructure institutions required to follow or assume responsibility for applicable controls.