SEBI's technology supervision of the securities market began with a cyber security and cyber resilience framework for Market Infrastructure Institutions in 2015, which was later extended in similar form to stock brokers, depository participants, mutual funds, asset management companies, KYC registration agencies, registrars and share transfer agents and portfolio managers. In August 2024 SEBI replaced that patchwork with a single Cybersecurity and Cyber Resilience Framework (CSCRF) covering all regulated entities, applying a graded approach that sorts them into five categories by size and scale, with MIIs at the top. The ITRI extends this from cyber security alone to overall operational resilience, and converts it into a single comparable number rather than a compliance checklist. On the same day SEBI also aligned its Incident Reporting Portal with the Format for Incident Reporting Exchange (FIRE) developed by the Financial Stability Board, so that cyber incident reporting follows an internationally recognised template.

An exchange or depository outage is not an ordinary IT failure: trading halts, price discovery stops and settlement obligations pile up across the market at once. Until now SEBI's supervision of this risk was largely event-driven, acting after an incident was reported. A standing index changes the direction of supervision - it makes each institution measure its own resilience on the same nine parameters, twice a year, and hands the regulator a number it can compare across institutions and across time. The Early Warning System requirement pushes this further, asking institutions to flag deterioration in a parameter before it becomes an outage. The design choice SEBI stresses is that computation must be system-driven and non-discretionary, so that a score cannot be talked up by the institution producing it.