Compliance of Cyber Security Policy by Point of Presence (PoPs) and Non-Individual Retirement Advisers (RAs) · 21 Apr 2020

Page 1 of 3 PENSION FUND REGULATORY AND DEVELOPMENT AUTHORITY CIRCULAR CIR No.: PFRDA/2020/13/SUP-POP/2 Date: April 21, 2020 To Point of Presence (PoPs) / Non-Individual Retirement Advisers (RAs) Subject: Compliance of Cyber Security Policy by Point of Presence (PoPs) and Non-Individual Retirement Advisers (RAs) PFRDA (Authority) has received in past, various queries from the stakeholders regarding scope and applicability of Circular no. PFRDA/2017/31/CRA/5 dated 04.10.2017 and Circular no. PFRDA/2019/2/REG dated 07.01.2019. 2. In this regard, it is clarified that: – (i) All PoPs and Non-Individual RAs are required to adhere to the cyber security measures and compliances as mentioned in the Cyber Security Policy of the Authority, as detailed in Circular PFRDA/2017/31/CRA/5 dated 04.10.2017 and also as mandated by their principal regulator (as applicable). (ii) In compliance to (i) above, the PoPs and Non-Individual RAs are hereby advised to submit the Compliance certificate with respect to cyber security for respective Financial Year (FY) as per Annexure I (enclosed) within 30 days from the end of the said FY. They are also advised to submit the report on cyber-attacks incident pertaining to NPS activities, if any, as per Annexure II (enclosed) immediately on occurrence of such incident. (iii) Accordingly, the PoPs may submit Certificate as per Annexure I for FY 2018-19 and FY 2019-20 instead of half-yearly basis Certificate as per Annexure A of Circular no. PFRDA/2019/2/REG dated 07.01.2019. (iv) Circular no. PFRDA/2019/2/REG dated 07.01.2019 therefore stands superseded with respect to PoPs. 3. This circular is issued under Section 14 of PFRDA Act, 2013 and is available in Circulars section of Regulatory Framework at PFRDA’s website. Yours Sincerely, (Sumeet Kaur Kapoor) Chief General Manager Page 2 of 3 (To be submitted on letterhead within 30 days from the end of the Financial Year) Annexure I To Head of Department Supervision Department – PoPs and RAs, Pension Fund Regulatory and Development Authority, B-14/A, Chatrapati Shivaji Bhawan, Qutab Institutional Area, Katwaria Sarai, New Delhi -110016 Subject: Compliance certificate with respect to cyber security for FY _________ This is to certify that _________________________________ (Name of PoP/non- individual RA) registered vide Reg. No. __________________with Pension Fund Regulatory and Development Authority (Authority) is adhering to the cyber security measures as mentioned in the cyber security policy of the Authority and also as mandated by our principal regulator (as applicable). Name of CISO/ Compliance officer : Designation : Signature of CISO/Compliance officer along with office seal. Mobile No./Landline No:. Email id : Date : Place: Page 3 of 3 (To be submitted on letterhead immediately on occurrence of cyber-attacks) Annexure II To Head of Department Supervision Department – PoPs and RAs, Pension Fund Regulatory and Development Authority, B-14/A, Chatrapati Shivaji Bhawan, Qutab Institutional Area, Katwaria Sarai, New Delhi -110016 Subject: Reporting of cyber-attacks incident. Sr. No. Cyber security parameter Details 1 Details of cyber security attack/ breaches including the nature, severity and the steps taken for rectification. 2 Whether all the incidents of cyber security attacks have been reported to CERT-In, as prescribed under section 70B of the Information Technology Act, 2000 and the Rules made thereunder (Details to be provided). 3 Whether a definite response plan defining responsibilities and actions to be performed by the employees and support/outsourced staff in the event of cyber-attacks or breach of cyber security mechanism is in place. Was the same effective during the cyber- attack? Improvements proposed post cyber attack may be highlighted. Name of CISO/Compliance officer : Designation : Signature of CISO/ Compliance officer along with office seal. Name of PoP/ Non-Individual RA: Reg. No.: Mobile No./Landline No:. Email id : Date : Place: