A cyber incident used to belong to the CIO. Increasingly, it belongs in the boardroom.
SEBI’s recent circular aligning its Cyber Incident Reporting Portal with the FIRE format may look like a reporting-system change. But there is a larger governance message here.
When a cyber incident has to be identified, classified, contained, documented and reported within defined timelines, it stops being an IT problem alone. It becomes a business event.
Because the questions quickly move beyond: “What happened to the system?”
They become: What was the financial impact? Which customers or investors were affected? Was critical data compromised? How quickly did management respond? Did the incident expose a weakness in controls? And perhaps the uncomfortable one: “Could the board have known about this risk earlier?”
SEBI’s cybersecurity framework already places time-bound reporting obligations on regulated entities, including reporting certain incidents to SEBI and CERT-In.
That changes how boards should look at cyber risk. Not as an annual IT presentation. Not as a technical issue delegated entirely to the CIO. But as part of the organisation’s risk, controls and resilience conversation.
The technology team may detect the breach. But management owns the response. And the board owns the oversight.
