KATHMANDU, Nov 4: The Securities Board of Nepal (SEBON) has considered developing a separate central data bank for the stock exchange market, aiming to ensure safety of the securities market data while storing them within Nepal.
Enforcing the Information Technology Policy 2026, the sector’s regulator has planned to implement a multilayered backup strategy to safeguard stocks trading system and related data from a number of softwares including ransomware and malware and other tools used for cyber attacks.
Last time, on September 20, the Nepali stock market sustained a cyber attack leading to a disruption of the secondary market trading for the next whole day. A ransomware virus struck 'Data Hub Pvt. Ltd.'—the private data center hosting Nepal Stock Exchange (NEPSE)’s trading platform, known as the TMS (Trading Management System).
Trading resumed only after switching to a secondary data center. In the wake of such a serious cyberattack in the stock exchange system, SEBON has introduced this policy to prevent future attacks.
Controlling cyber conflict
The policy states, "A central data bank for securities and commodities exchange—equipped with information technology for the recording and management of market-related statistics and information—will be improved and developed." It further underlines the purpose of issuing a data classification framework consisting of public data, sensitive trading data and individual investor data.
Under this initiative, the SEBON is set to introduce a policy mandating the use of both 'immutable snapshots', the ‘read only’ type of data that cannot be altered or deleted, and 'air-gapped backups' that features keeping backups offline and disconnected from the internet or the primary network.
SEBON has emphasized the necessity of an international-standard Disaster Recovery Mechanism (DRM) to safeguard critical records—pertaining to market trading, clearing and settlement, the central depository system, and warehouses—against technical failures or natural disasters.
Consequently, market infrastructure institutions such as NEPSE, CDS and Clearing Limited (CDSC), and the Clearing House will be required to establish a Disaster Recovery Site (DRS) located at least 25 kilometers away from their primary operational center, as per SEBON’s policy.
Furthermore, the policy will clearly define the Recovery Time Objective (RTO), the time required to restore the system following an interruption, and the Recovery Point Objective (RPO), that involves the specific point in time to which data must be restored.
To prevent related cyber attacks, SEBON has sought to introduce mandatory audits of the stock market system. The policy states, "Provisions will be made for conducting system audits of the market system and the central depository system. Market infrastructure institutions must undergo an annual information technology (IT) audit, while other market participants are required to conduct such audits biennially." It further specifies, "The audit must, at a minimum, cover the trading system, clearing and settlement, cybersecurity controls, and data management. The audit report must be submitted to the Board within three months."
If any sensitive findings emerge, they must be addressed and rectified within 30 days. Furthermore, to ensure the system audit process is more organized and effective, a framework for system auditing—including specific criteria for the selection of auditors—will be established, as per the SEBON’s new policy.
-1793781552.webp)
