Under Circular No. HO/47/18/11(1)2026-MRD-TPD1/I/19509/2026 dated 24 August 2026, MIIs must operationalize an IT Resilience Index (ITRI), an Early Warning System and real-time monitoring of service delivery by 28 February 2027.
SEBI IT Resilience Index (ITRI) for Market Infrastructure Institutions: What Changes for MIIs?
SEBI has introduced an IT Resilience Index (ITRI) framework for Market Infrastructure Institutions (MIIs), requiring systematic measurement of the robustness and resilience of critical IT systems. The framework covers nine parameters, requires half-yearly computation, introduces an Early Warning System for deterioration in IT resilience, and requires continuous visibility into service delivery to market participants.
The circular is addressed to all Stock Exchanges, all Clearing Corporations and all Depositories, except AMC Repo Clearing Ltd. SEBI has framed the measure around the role of MII technology systems in maintaining the smooth, orderly and uninterrupted functioning of the securities market.
What Is the SEBI IT Resilience Index (ITRI)?
The IT Resilience Index (ITRI) is a system-driven index designed to capture the functioning and resilience of IT systems of Market Infrastructure Institutions. SEBI states that the index has been introduced following discussions with its Technical Advisory Committee and its consultation paper dated 25 March 2026 on the framework of IT Resilience Index for MIIs.
ITRI is intended to provide MIIs with a measurable view of the health and resilience of their important technology systems instead of relying only on isolated IT assessments. The model is designed to identify weaknesses early and support timely corrective action.
Why Has SEBI Introduced the ITRI Framework?
SEBI describes the IT systems of MIIs as the backbone of the smooth and uninterrupted functioning of the securities market. A disruption, degradation in performance or compromise of those systems may affect critical market operations and create risks to confidence in the securities market.
The framework is intended to strengthen oversight of IT resilience, identify emerging weaknesses at an early stage and initiate corrective measures in a timely manner. SEBI also links the framework to the need for robust governance, proactive monitoring and timely action.
Who Is Covered by the ITRI Circular?
The circular is addressed to:
The circular expressly excludes AMC Repo Clearing Ltd. from the addressee list.
What Systems Are Covered Under ITRI?
ITRI is intended to measure the robustness of the Critical Systems of MIIs. The circular identifies the relevant Critical Systems by reference to the applicable SEBI Master Circulars:
- Clause 9.1.2.3 of the Master Circular dated 30 December 2024 for Stock Exchanges and Clearing Corporations;
- Clause 4.31.2.3 of the Master Circular dated 3 December 2024 for Depositories; and
- Clause 16.4.3(c) of the Master Circular dated 4 August 2023 for the Commodity Derivatives Segment.
The scope also includes other systems feeding into or related to those Critical Systems.
ITRI Parameters and Weightage
SEBI has prescribed nine parameters for computing ITRI, with a total weightage of 100. The largest individual weights are assigned to Availability and Security, at 20 each.
The nine parameters and their weightages are expressly specified in paragraph 5.2 of the circular. The descriptions in the table above are plain-English explanations for reader guidance and are not presented as separate definitions prescribed by SEBI.
When Will the Detailed ITRI Criteria Be Finalized?
The nine high-level parameters are already prescribed, but the detailed sub-parameters and measurement criteria are to be finalized by the Industry Standards Forum (ISF) of MIIs by 30 November 2026.
The ISF is also required to formulate baseline parameters, acceptable threshold scores, an SOP for calculating ITRI and an objective system-driven scoring methodology intended to improve comparability across MIIs.
SEBI has already fixed the nine parameters and their weightages, but the circular leaves the detailed sub-parameters and measurement criteria to the ISF. The final scoring mechanics therefore depend on the subsequent framework work required under the circular.
How Often Must MIIs Compute ITRI?
MIIs must compute ITRI on a half-yearly basis. The computation must be completed within 60 days from the end of each half-year.
MIIs must also submit a comparative analysis of two consecutive half-years on a rolling basis, along with corrective actions taken or proposed to be taken, to their Standing Committee on Technology (SCOT) and Governing Board.
Will ITRI Be Calculated Manually?
No. The framework is expressly designed to be system-driven. SEBI requires ITRI to be computed automatically from IT systems or data extracted from those systems, without manual intervention.
The objective is to make the computation non-discretionary and fool proof. Where a parameter cannot be computed automatically and manual intervention is necessary, the MII may carry out manual data retrieval only after discussing the exception with its SCOT in advance.
The requirement moves ITRI away from a purely manual assessment model. MIIs will need reliable system data and an architecture capable of generating the index consistently and repeatedly.
ITRI as a Self-Operating Model
SEBI states that the framework is intended to operate as a self-operating model. MIIs are expected to periodically compute ITRI and provide their Governing Boards with insights into the overall health of IT systems and areas requiring improvement.
This is significant because the index is not described merely as a compliance score. It is intended to become part of ongoing governance and oversight of the MII's IT environment.
What Is the Early Warning System Under ITRI?
MIIs must develop an Early Warning System to detect possible deterioration in ITRI parameters. The objective is to identify conditions that may lead to performance issues, slowness or other deterioration in systems and to establish a mechanism for remedial action.
The Early Warning System therefore connects the index to operational action: declining resilience indicators are intended to trigger attention before a technology problem becomes a larger service disruption.
Continuous Monitoring of Service Delivery to Market Participants
The circular builds on existing requirements for MIIs to continuously monitor process and application performance and system-resource utilization at the level of each IT component for early detection of performance issues and slowness.
In addition, MIIs must build systems that provide continuous visibility into service delivery to market participants. These systems must include consolidated dashboards for monitoring system and application performance, continuous service delivery and deviations or anomalies.
MIIs must also formulate SOPs to monitor system availability and continuity of service delivery to all market participants and to flag any disruption or deviation.
ITRI Implementation Timeline: Key Dates
These deadlines are expressly set out in paragraph 10 of the circular.
What Is the First ITRI Reporting Period?
The first submission of ITRI computation under the new framework will be for the half-year ending 31 March 2027. The circular therefore identifies the half-year ending 31 March 2027 as the first period for which ITRI computation is to be submitted under the framework.
What Should MIIs Do Now?
The circular requires MIIs to take the necessary steps to put systems in place for implementation, including necessary amendments to relevant bye-laws, rules and regulations, if any.
Compliance Action Plan
Map Critical Systems and the other systems feeding into or related to those Critical Systems.
Determine how current system information can support Availability, Security, Integrity, Governance, Reliability and Monitoring, Business Continuity, Modularity and Flexibility, Scalability and other parameters.
Build or adapt systems so that ITRI can be calculated automatically without routine manual intervention.
Define the process for reviewing manual-data exceptions, comparative half-year results and corrective actions with the Standing Committee on Technology.
Create mechanisms to identify deterioration in ITRI parameters and trigger remedial action.
Establish consolidated dashboards covering system/application performance, service delivery and anomalies or deviations.
The detailed SOP must be submitted to SEBI after SCOT review by 31 January 2027.
Make necessary amendments to relevant bye-laws, rules and regulations where required for implementation.
What Is the Practical Impact of ITRI on MIIs?
The framework makes IT resilience a more visible and measurable governance issue. The index is designed to be computed periodically, compared across consecutive half-years and presented together with corrective actions to the SCOT and Governing Board.
For technology functions, the system-driven requirement means that data quality, system integration and automated measurement become important implementation considerations. For governance functions, the reporting structure creates a recurring mechanism to review IT resilience, emerging weaknesses and remedial action.
For market participants, the broader objective is continuity and visibility of service delivery. SEBI's framework links IT resilience not only to system health but also to the continuity and quality of services provided to market participants.
Does ITRI Replace Existing IT Resilience or Monitoring Requirements?
The circular does not state that existing requirements are replaced. Instead, it refers to the applicable Critical Systems provisions in earlier Master Circulars and specifically notes existing requirements for continuous monitoring under SEBI's 10 December 2024 circular on Revised Guidelines for Capacity Planning and Real Time Performance Monitoring Framework of MIIs.
The new ITRI framework therefore adds an index-based resilience measurement and governance structure to the wider IT oversight framework.
Frequently Asked Questions
1. What is the SEBI IT Resilience Index?
The SEBI IT Resilience Index (ITRI) is a system-driven framework for measuring the robustness and resilience of the Critical Systems of Market Infrastructure Institutions and related systems.
2. Which entities are covered by the ITRI circular?
The circular is addressed to stock exchanges, clearing corporations and depositories, except AMC Repo Clearing Ltd.
3. How many parameters are used to calculate ITRI?
ITRI uses nine parameters: Availability, Security, Integrity, Governance, Reliability and Monitoring, Business Continuity, Modularity and Flexibility, Scalability, and Others including Incident Handling.
4. Which ITRI parameters have the highest weightage?
Availability and Security carry the highest individual weightage at 20 each. The total weightage across all nine parameters is 100.
5. When will the detailed ITRI measurement criteria be finalized?
The Industry Standards Forum of MIIs is required to finalize the sub-parameters and detailed measurement criteria by 30 November 2026.
6. How often must MIIs calculate ITRI?
MIIs must compute ITRI half-yearly within 60 days from the end of each half-year and submit a rolling comparative analysis of two consecutive half-years along with corrective actions.
7. Can ITRI be calculated manually?
ITRI must be computed automatically from IT systems or data extracted from those systems. Manual data retrieval is permitted for exceptions only after prior discussion of those exceptions with SCOT.
8. What is the Early Warning System under ITRI?
It is a mechanism MIIs must develop to detect possible deterioration in ITRI parameters that could lead to performance issues or slowness and to support remedial action.
9. When must the ITRI framework be operationalized?
The complete framework, including the Early Warning System and Real Time Monitoring of Service Delivery, must be operationalized by 28 February 2027.
10. When is the first ITRI computation due?
The first submission under the framework will relate to the half-year ending 31 March 2027.
11. When must the detailed ITRI SOP be submitted to SEBI?
The detailed SOP must be submitted to SEBI after review by the MII's SCOT by 31 January 2027.
12. Does the circular require amendments to internal rules?
Yes. MIIs are required to take necessary implementation steps, including necessary amendments to relevant bye-laws, rules and regulations, if any.
CorpLawUpdates Analysis
The significance of the ITRI framework lies in the combination of measurement, automation, early warning and governance oversight. SEBI is not merely asking MIIs to assess whether their technology is resilient. It is establishing a recurring system by which resilience can be measured, compared and acted upon.
The weighting also signals where the framework places the greatest measurement emphasis. Availability and Security together account for 40 out of 100 points, while five other core parameters carry 10 points each. That makes operational availability and security the most heavily weighted individual dimensions under the framework, although the detailed scoring methodology is still to be finalized.
The system-driven requirement is equally important. A manually prepared index can introduce discretion and inconsistency. SEBI has instead stipulated automatic computation, with manual retrieval treated as an exception requiring prior discussion with SCOT. For MIIs, this makes data architecture and system integration part of the compliance implementation itself.
The framework is also closely tied to governance. Half-yearly results must be compared on a rolling basis, corrective actions must be reported, and the information is intended to provide insight to both SCOT and the Governing Board. The index therefore has the potential to become a recurring board-level technology resilience metric rather than a one-time regulatory exercise.
The implementation schedule is compressed. The ISF's detailed criteria are due by November 2026, the SOP must reach SEBI after SCOT review by January 2027, and the full framework must be operational by February 2027, ahead of the first reporting period ending March 2027. MIIs will therefore need to prepare their data, governance, monitoring and system architecture before the first formal submission.
Source Note
Document: SEBI Circular — “IT Resilience Index for Market Infrastructure Institutions (MIIs)”
Issuing authority: Securities and Exchange Board of India (SEBI), Market Regulation Department
Reference: HO/47/18/11(1)2026-MRD-TPD1/I/19509/2026
Legal authority: Issued under Section 11(1) of the Securities and Exchange Board of India Act, 1992.
Date: 24 August 2026
Addressees: Stock Exchanges, Clearing Corporations and Depositories, except AMC Repo Clearing Ltd.
Signatory: Darshil D. Bhatt, Deputy General Manager, Division of Policy and Development – 4, Market Regulation Department
The regulatory framework, weightages, computation requirements, Early Warning System, monitoring obligations and implementation deadlines stated above are based on the uploaded SEBI circular.
This article is for informational and educational purposes only and does not constitute legal or regulatory advice. Readers should verify the applicable primary regulatory source before taking action.
