9911796707
TMI BlogGuidelines for Business Continuity Plan (BCP) and Disaster Recovery (DR) of Qualified RTAs (QRTAs)X X X X Extracts X X X X X X X X Extracts X X X X ..... y to provide essential facilities and perform systemically critical functions uninterruptedly in the securities market. 2. In view of the above, based on consultation with Technical Advisory Committee (TAC) of SEBI, it has been decided to issue guidelines for strengthening overall resiliency, the procedures at / governance of QRTAs for handling disruption, augmentation of systems and practices to achieve better Recovery Time Objective ( RTO ) and Recovery Point Objective ( RPO ), and to improve overall preparedness by conducting periodic announced / unannounced drills. Hence, QRTAs are required to comply with the following framework for BCP and DR: 3. Organizational Resilience and Documentation 3.1. QRTAs shall have in place Bus ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... The DRS should preferably be set up in different seismic zones and in case due to certain reasons such as operational constraints, change of seismic zones, etc., minimum distance of 500 kilometre shall be ensured between PDC and DRS so that both DRS and PDC are not affected by the same disaster. 4.2. Hardware, system software, application environment, network and security devices and associated application environments of DRS and PDC shall have one to one correspondence between them. 4.3. QRTAs should develop systems that do not require configuration changes at the end of AMCs/other regulatory entities for switchover from the PDC to DRS. 4.4. In the event of disruption of any one or more of the Critical Systems (an indicative lis ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... e, bandwidth and load consideration between the DRS / NS and PDC should be within stipulated RTO and ensure high availability, right sizing, and no single point of failure. 4.11. Replication between PDC and NS should be synchronous to ensure zero data loss whereas, the one between PDC and DRS and between NS and DRS may be asynchronous. 4.12. Adequate resources (with appropriate training and experience) should be available at all times to handle operations at PDC, NS or DRS, as the case may be, on a regular basis as well as during disasters. 5. DR drills/Testing 5.1. QRTAs shall conduct periodic training programs to enhance the preparedness and awareness level among its employees and outsourced staff, vendors, etc. as per BCP ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... ormal working days (i.e. not on weekends / trading holidays). The QRTA shall ensure that staff members working at DRS have the abilities and skills to run live operations session independent of the PDC staff. 5.10. QRTAs shall include a scenario of intraday shifting from PDC to DRS during the mock operation sessions in order to demonstrate its preparedness to meet RTO/RPO as stipulated above. 5.11. QRTA should undertake and document Root Cause Analysis (RCA) of their technical/ system related problems in order to identify the causes and to prevent reoccurrence of similar problems. 6. BCP DR Policy Document 6.1. QRTAs shall put in place a comprehensive BCP-DR policy document outlining the following: 6.1.1. Broad scenarios ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... with the QRTA. Further, QRTA should deploy necessary access controls to restrict access (including physical access) of such entities to its critical systems and networks. 6.4. In case a QRTA desires to lease a DR premise from other entities (MII / Other Regulated Entities / Service Providers) the QRTA should ensure that such arrangements do not compromise confidentiality, integrity, availability, targeted performance and service levels of the QRTA s systems at the DRS. QRTAs should also ensure that proper segregation and monitoring is undertaken so as to isolate cyber events in the systems 6.5. The QRTAs should execute appropriate agreements with the corresponding Service Providers entailing Service Level Agreements, segregation deta ..... X X X X Extracts X X X X X X X X Extracts X X X X
|
