Cyber security obligations: Market infrastructure institutions must conduct regular cyber audits and submit CEO certification of controls. MIIs must conduct comprehensive cyber audits at least twice each financial year and submit, with audit reports, an MD/CEO declaration certifying measures for vulnerability identification and closure (including incentive/disincentive structures), adequate Security Operations Center staffing, and compliance with SEBI cyber security circulars; MIIs identified as Critical Information Infrastructure must provide regular vulnerability update/closure status to the National Critical Information Infrastructure Protection Centre, implement necessary amendments to bye laws and systems, and report implementation status to SEBI within thirty days, effective immediately.