Cyber incident? RAs must report it — SEBI's portal now uses the FIRE format

Many Research Analysts assume cyber rules are only for big firms. They're not. RAs and IAs are Regulated Entities under SEBI's Cybersecurity & Cyber Resilience Framework (CSCRF), and reporting a cyber incident is a real obligation. SEBI has now aligned its Cyber Incident Reporting Portal with the FIRE format — here's what that means for you.

⬇ Download banner 🟢 Share on WhatsApp ✈ Share on Telegram

Yes — this applies to Research Analysts

• RAs & IAs are Regulated Entities (REs) under SEBI's CSCRF. The framework applies to you, in a category proportionate to your size.
• Cyber-incident reporting is central to CSCRF. If you suffer a cyber incident (breach, ransomware, data leak, account compromise, etc.), you're expected to report it to SEBI — via SEBI's Cyber Incident Reporting Portal — and to CERT-In, and then do a root-cause analysis once contained.
• This new circular is about how those reports are captured — SEBI's portal is now aligned to the FIRE format (a standardised incident-report format), so reporting is consistent across entities.

The two reporting “clocks”

What RAs should do

• Know your CSCRF category and the baseline requirements that apply to you.
• Keep a simple incident-response plan: who detects, who reports, and where (SEBI portal + CERT-In), so you can act within hours — not days.
• Practise basic cyber hygiene: MFA on email/portals, strong unique passwords, updated devices, backups, and access control for client data.
• If your KYC/records/website are run through a vendor, confirm they support timely incident detection & reporting.
• When you report, use the current portal / FIRE format as specified in the circular.

References & official sources

More for SEBI Research Analysts