TaxTMI 
TaxTMI 
System and Network Audit of Market Infrastructure Institutions (MIIs)
X X X X Extracts X X X X
X X X X Extracts X X X X
....he Technical Advisory Committee (TAC) of SEBI, the existing System Audit Framework has been reviewed. 3. MIIs are required to conduct System and Network Audit as per the framework enclosed as Annexure 1 and Terms of Reference (TOR) enclosed as Annexure 2. MIIs are also required to maintain a list of all the relevant SEBI circulars/ directions/ advices, etc. pertaining to technology and compliance thereof, as per format enclosed as Annexure 3 and the same shall be included under the scope of System and Network Audit. 4. MIIs are also required to submit information with regard to exceptional major Non-Compliances (NCs)/ minor NCs observed in the System and Network audit as per format enclosed as Annexure 4 and are required to categorically highlight those observations/NCs/suggestions pointed out in the System and Network audit (current and previous) which remain open. 5. The Systems and Network audit Report including compliance with SEBI circulars/ guidelines and exceptional observation format along with compliance status of previous year observations shall be placed before the Governing Board of the MII and then the report along with the comments of the Management of the MI....
X X X X Extracts X X X X
X X X X Extracts X X X X
....nsidered in order to ensure that the audit is comprehensive and effective: a. The Audit shall be conducted according to the Norms, Terms of Reference (TOR) and Guidelines issued by SEBI. b. The Governing Board of the Market Infrastructure Institution (MII) shall appoint the Auditors based on the prescribed Auditor Selection Norms and TOR. c. An Auditor can perform a maximum of 3 successive audits. However, such auditor shall be eligible for re-appointment after a cooling-off period of two years. d. Further, during the cooling-off period, the incoming auditor may not include: (i) Any firm that has common partner(s) with the outgoing audit firm; and ii) Any associate / affiliate firm(s) of the outgoing audit firm which are under the same network of audit firms wherein the term "same network" includes the firms operating or functioning, hitherto or in future, under the same brand name, trade name or common control. e. The number of years an auditor has performed an audit prior to this circular shall also be considered in order to determine its eligibility in terms of sub-clause c above. f. The scope of th....
X X X X Extracts X X X X
X X X X Extracts X X X X
.... within 1 month from the date of completion of verification by the Auditor. The report shall include updated Issue-Log to indicate the corrective actions taken and specific comments of the auditor on the ATR. m. The overall timeline from the last date of the audit period till completion of final compliance by MII, including follow-on audit, if any, should not exceed one year/6 months(as applicable). In exceptional cases, if MII is of the view that compliance with certain observations may extend beyond said period, then the concerned MII shall seek specific approval from the Governing Board. Auditor Selection Norms 2. MII shall ensure compliance with the following norms while appointing Auditor: a. The Auditor must have minimum 3 years of demonstrable experience in IT audit of securities market participants e.g. stock exchanges, clearing corporations, depositories, intermediaries, etc. and/ or financial services sector i.e. banking, insurance, Fin-tech etc. b. The team performing system and network audit must have experience in / direct access to experienced resources in the areas covered under TOR. It is recommended that resources deployed by the Au....
X X X X Extracts X X X X
X X X X Extracts X X X X
....compliance of areas prescribed in Terms of Reference (TOR) and areas emanating from relevant SEBI circulars/directions/advices along with any accompanying evidence. 7. Evidences should be specified in the audit report while reporting/ closing an issue. 8. A detailed report with regard to the system and network audit shall be submitted to SEBI. The report shall include an Executive Summary as per the following format: Issue Log Column Heading Description Responsibility Major Area Comprehensive identification of major areas in compliance with various SEBI circulars / norms and internal policies of MII Auditor/Auditee Point wise Compliance Point-wise list of areas/relevant clauses in TOR against which compliance is being audited (in tabular format). Auditor Description of Finding/ Observation Describe the findings in sufficient detail, referencing any accompanying evidence (e.g. procedure manual, interview notes, reports etc.) Auditor Reference Reference to the section in detailed report - where full background information about the findings are available Auditor Process/ Unit Process or unit where the audit is conducted and ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ssets Acquisition ii. Access Management iii. Change Management iv. Backup and Recovery v. Incident Management vi. Problem Management vii. Patch Management viii. Data Centre Operations ix. Operating Systems and Database Management x. Network Management xi. DRS Operations xii. Data Retention and Disposal xiii. Asset Inventory xiv. IT asset refresh/replacement policy xv. Database security xvi. Interface Security xvii. Application Security xviii. Password Security xix. Archived and backed up data security 3.3. Whether the above mentioned SOPs is reviewed at periodic intervals or upon the occurrence of any major event? In this regard, whether any organization policy has been formulated by the MII? 4. Business Controls 4.1. General Controls for Data Centre Facilities a. Application Access - segregation of duties, database and application access etc. (Approved Policy clearly defining roles and responsibilities of the personnel handling business operations) b. Maintenance Access - vendor engi....
X X X X Extracts X X X X
X X X X Extracts X X X X
.... h. Any other controls, as deemed fit, by the MII 4.4. Security Controls a. Secured e-mail with other entities such as SEBI, other partners b. Email Archival Implementation 4.5. Access Policy and Controls a. Defined and documented policies and procedures for managing access to applications and infrastructure -PDC, DRS, NS, branches (including network, operating systems and database) and approved by relevant authority b. Review of access logs c. Access rights and roles review procedures for all systems d. Segregation of Duties (SOD) matrix describing key roles e. Risk acceptance for violation of SOPs and alternate mechanism put in place f. Privileged access to system and record of logs, g. Periodic monitoring of access rights for privileged users h. Authentication mechanisms used for access to systems including use of passwords, One Time Passwords (OTP), Single Sign on, etc. i. Any other controls, as deemed fit, by the MII 4.6. Electronic Document Controls 4.7. General Access Controls 4.8. Performance Audit a. Comparison of ch....
X X X X Extracts X X X X
X X X X Extracts X X X X
....) and relevant records related to it. f. Insurance g. Disposal - Equipment, media, etc. 5. Entity Specific Software used for or in support of trading/clearing systems / peripheral systems and critical processes 6. Human Resources Management 6.1. Screening of Employee, Third party vendors / contractors 6.2. Onboarding 6.3. Offboarding 6.4. Consequence Management (Incident / Breach of policies) 6.5. Awareness and Trainings 6.6. Non-Disclosure Agreements (NDAs) and confidentiality agreement 7. Network audit 7.1 The audit shall cover entire network infrastructure which shall inter-alia includes physical verification and tracing of the connectivity paths, server configuration, physical checking wire to wire connectivity and configurations of computer networking devices etc. 7.2 The audit shall require tracing of the connectivity and network diagram based on the physical audit. 7.3 The audit shall cover the link, the path, device-level redundancy, no single-point failures, high availability, and fault tolerance aspects in the network. 7.4 The audit shall cover entire netwo....
X X X X Extracts X X X X
X X X X Extracts X X X X
....e Management Time-line for taking corrective action in case of open observations Annexure 4 Exception Observation Reporting Format Note: MIIs are expected to submit following information with regard to exceptional major non-compliances (NCs) / minor NCs observed in the System and Network Audit. MIIs should also categorically highlight those observations/NCs/suggestions pointed out in the System and Network Audit (current and previous) which are not yet complied with. Name of the MII: ___________________ Name of the Auditor: _________________ Systems and Network Audit Report Date: _________________ Table 1: For preliminary audit Audit Perio....