Dheeraj Bhat

SEBI’s New Cybersecurity Update is Here! Deadline: June 30, 2025 ⏳ SEBI has issued an important circular on Cybersecurity & Cyber Resilience for regulated entities (REs). Here’s what’s new: 🔐 Updated categorization for Stock Brokers, DPs, KRAs, IAs, RAs, AIFs, VCFs, Merchant Bankers & Portfolio Managers 📊 Based on client size, trading volume & AUM ⚖️ Lighter rules for smaller players 🛡️ HSM now mandatory for large/qualified entities 📝 BSE is now the reporting authority for IAs & RAs (for 5 years) ✅ Compliance due by June 30, 2025 This is a big step toward strengthening cybersecurity in capital markets while keeping it practical for smaller firms! #SEBI #CyberSecurity #Compliance #Finance #CapitalMarkets #Regulation

8

1 Comment

“The risk wasn’t in what we missed — it was in what we trusted.” — CISO, JPMorgan AI agents. APIs. Automation. System-level trust is granted once… and rarely questioned again. As CSU Team observed in a recent audit: “60% of enterprise APIs had no lifecycle policy. That’s not an error — that’s inherited risk.” Rethink trust. Review SaaS. Because in the cloud, the breach starts where the trust ends. Refer - https://lnkd.in/dR_jqXaj #SaaSSecurity #ZeroTrust #SajidSaiyed #Cybersecurityumbrella #CISOInsights #EnterpriseRisk #Infosec2025

4

This is a MUST-READ for all SaaS providers and those who buy from SaaS providers. The JP Morgan Chase security chief Pat Opet called on software vendors to prioritize secure-and-resilient-by-default architectures, provable controls, and richer authorization models. David Moskowitz and Rick Lemieux from the DVMS Institute wrote articles on this topic last week. Why Adaptive Cyber Resilience Must Be Baked Into All Digital Service Providers (DSP) Offerings https://lnkd.in/gpEVmMmn Why Digital Service Providers Need the NIST Cybersecurity Framework and a Digital Value Management System® To Enable Cyber Resilience https://lnkd.in/dGaNec2Y https://lnkd.in/gNSxdTpt

13

A CIO in Pune told me his NAC was "working."   I asked to see the dashboard.   What I found:   → 847 devices discovered → 0 devices profiled → Enforcement: Disabled → Last policy update: 14 months ago   "Working" meant: no alerts, no complaints.   Not: secured, enforced, operational.   The NAC was technically running. It just wasn't doing anything.   When I asked who owned the system:   → Network team: "Security bought it" → Security team: "Network should manage it"  → Vendor: "We delivered what was scoped"   Classic ownership vacuum.   ₹22 lakhs spent. 11 months since go-live. Zero security value.   3 weeks later:   → Device profiling: 100% → Policies: Aligned to business units → Enforcement: Phased rollout started → Owner: Named. Accountable. Empowered.   Same product. Different outcome.   ---   The difference between "working" and "securing" is one question:   "Show me what it's actually doing." Who owns NAC at your organisation? Network? Security? "Both"? (That usually means nobody.) #NAC #cybersecurity #manufacturing #networksecurity #ownership

44

8 Comments

# CISO , TISO , BISO & DPO Deep Insight post once Again on very hot demand from my mentees, colleagues, seminars & conferences for segregation of CISO, TISO, BISO & DPO roles so its rightly understood for right reasons for right execution for right outcomes. Chief Information Security Officer (CISO) 1 Security Policy : Develop and implement a robust information security policy aligned with the organization's goals. 2. Risk Management : Identify, assess, and mitigate information security risks across the organization including all vendors as any cyber security or data breach of Business or any non business vendors is the core primary responsibility of CISO. 3. Compliance :Ensure compliance with relevant laws, regulations, and industry standards. 4. Cyber Incident Response : Lead the response to data breaches and security incidents, minimizing impact & remain focus on Information Security itself as that itself is 6 meters deep & 6 meters wide. 5. Security Awareness : Foster a culture of security awareness and training among employees. Technology Information Security Officer (TISO) 1 Technical Security Oversight : Ensure the implementation of technical security measures and tools & running Security Operations. 2. Vulnerability Management: Regularly conduct vulnerability assessments and manage remediation efforts. 3. Security Architecture : Design and maintain secure IT systems architecture. 4. Incident Analysis: Oversee user access management and authentication processes. 5. Security Tool Management: Oversee the selection , deployment & management of security tools & deployments . Business Information Security Officer (BISO) 1. Business Alignment : Align security initiatives with business objectives and processes. 2. Risk Assessment for Business Units: Conduct risk assessments tailored to specific business units. 3. Stakeholder Engagement Act as a liaison between IT security and business stakeholders. 4. Policy Implementation : Ensure the implementation of security policies within the business context. 5. Training and Communication : Develop and deliver security awareness programs relevant to business areas. Data Protection Officer (DPO) 1. Data Privacy Governance : Develop and oversee data protection strategies to ensure compliance with privacy regulations such as GDPR. 2. Policy Implementation : Implement and manage data protection policies and procedures. 3. Advise and Monitor Compliance : Advise on and monitor activities related to data processing compliance and strategies. 4. Data Breach Response : Coordinate the response and communication plan for data breaches. 5. Training and Awareness : Conduct training sessions to increase awareness of data protection and privacy issues. # V Imp - To understand above segregation & avoid sound like rookie to enter other’s domain as it needs perfect Orchestration of 4 roles

35

3 Comments

#GCC Success: Why Starting Right is the Only Way to Grow The audit flags raised against Apple’s Global Capability Center (GCC) in India offer a vital lesson: Foundational compliance is paramount. Even leading firms struggle with governance when establishing new global centers. The Core Audit Failures Apple Operations India was flagged for two simple yet critical lapses that point to "operational immaturity": Missing Data Backups: They failed to maintain daily electronic backups of financial records stored in India, violating local law. This exposes the company to catastrophic data loss. Weak Audit Trails: Their systems didn't properly track all changes, especially those made by administrators. This loss of verification makes data vulnerable to fraud and regulatory fines. My View: The Positive Path A well-governed GCC is a strategic shield against risk and a catalyst for growth. The cost of fixing these issues later far exceeds the cost of setting up controls correctly upfront. The goal is to build a secure, strategic extension of your headquarters, not a liability. Your Simple Checklist for GCC Inception To ensure a successful and compliant launch, focus on these three actions: Know the Local Rules First: DO: Design all systems to meet local statutory requirements (e.g., in-country data storage) before transacting. AVOID: Never assume global policies are sufficient for local legal compliance. Make Security Automatic (Audit Trails): DO: Implement an automatic, tamper-proof audit trail that logs every change made by all users, especially administrators. AVOID: Allowing any "administrator privilege" that lets a user bypass the tracking system. Prioritize Control Over Speed: DO: Hire experienced Compliance and IT Security leaders first. They must certify system security before the center goes live. AVOID: Rushing the launch. A delayed, secure operation is infinitely better than a fast, non-compliant one. In summary: Compliance is the ultimate enabler. Build your GCC on a rock-solid foundation, and you transform it into a powerful, trusted asset. #GCCBestPractices #Compliance #Governance #Strategy #OperationalExcellence #RiskManagement #GlobalOperations #DigitalTransformation #DataSecurity #DataIntegrity #IndiaGCC #DPDP https://lnkd.in/dWq3kirH

10

"Continuous monitoring" appears fourteen times in the Reserve Bank of India (RBI)'s cybersecurity framework for banks. Most compliance functions I've spoken to interpret this as "we run vulnerability scans regularly." That's not what it means. Continuous monitoring in the RBI context means ongoing visibility into your IT risk posture. Not a scan that runs weekly. A system that knows, at any given moment, which controls are working and which aren't. Network monitoring. Access review cycles. Patch compliance. Configuration drift. Incident detection. Log analysis. Third-party risk tracking. All of these are supposed to be continuous. Meaning the evidence should be current, not reconstructed before an inspection. Here's where it gets complicated for compliance teams. The CISO's team runs the actual monitoring tools. The compliance team is responsible for proving to RBI that monitoring happens. Two different functions. Two different systems. Often two different versions of reality. CISO says controls are in place. Compliance needs evidence that controls are in place. The evidence lives in security tools that compliance doesn't have access to. So compliance asks for screenshots. Exports. Summaries. The security team provides them when they have time. Which is usually right before the inspection. That's not continuous monitoring. That's periodic evidence collection dressed up as continuous monitoring. The banks getting this right have connected their security tooling to their compliance system. Evidence flows automatically. Gaps are visible without asking. The ones that haven't are running two parallel processes and hoping the numbers match when the inspector asks. How does your compliance team get evidence from your security tools today? #rbi #cybersecurity #compliance #banking

6