Achieving the SEBI's Cybersecurity and Cyber Resilience Framework with workforce password management

Cyber resilience goal: ANTICIPATE

Cybersecurity control: GOVERNANCE

GV.OC.S2

GV.OC.S3

Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners.

To ensure the goal of cybersecurity, REs shall define responsibilities of its own employees, third-party service providers’ employees, and other entities, who may have privileged access or use their systems and/or networks.

All REs except small, self-certification REs

Zoho Vault assigns exclusive permissions to administrative accounts so they can configure, customize, and monitor sensitive information effectively. There are two default admin roles: Super Admin and Admin. Super Admins wield complete control, including user management, while Admins function as moderators, assisting with high-level tasks but without user management rights. A user, however, will not be able to perform any admin operations.

For emergencies, Zoho Vault has break-glass permissions, which temporarily provide trusted users with full access to all resources. This feature is strictly intended for urgent administrative interventions and should be assigned only when necessary.

Role customization options and limited time access control help administrators grant more granular access to third-party users based on the operation to be performed, ensuring confidential resources remain protected.

Cyber resilience goal: ANTICIPATE

Cybersecurity control: PROTECT

PR.AA.S1

PR.AA.S2

PR.AA.S3

PR.AA.S7

PR.AA.S9

PR.MA.S2

Any access to REs’ systems, applications, networks, databases, etc., shall be for a defined purpose and for a defined period. Access granted to IT systems, applications, databases, and networks shall be on a need-to-use basis and based on the principle of least privilege. Such access shall be given for a specific duration and using effective authentication mechanisms.

REs shall ensure that records of user access to critical systems, wherever possible, are uniquely identified and logged for audit and review purposes.

Existing user accounts and access rights shall be periodically reviewed by the owner of the system to detect dormant accounts, accounts with excessive privileges, unknown accounts, or any type of discrepancy.

Proper “end of life” mechanisms shall be adopted for user management to deactivate access privileges of users who are leaving the organization or whose access privileges have been withdrawn. This includes named user IDs, default user IDs, and generic email IDs.

All critical systems accessible over the internet shall have multifactor security (such as VPNs, firewall controls, etc.) and MFA. MFA shall be enabled for all users and systems that connect using online/internet facilities and also particularly for VPNs, webmail, and accounts that access critical systems from non-trusted environments to trusted environments.

All REs (mandatory)

Zoho Vault enforces the principle of least privilege by granting users access to sensitive information strictly based on their roles and operational needs. When sharing credentials, administrators can assign granular access levels:

• One-click login only: Users can auto-log into websites without viewing the password in plain text.
• View: Grants visibility of the password in plain text.
• Modify: Allows users to view and edit the password.
• Manage: Provides full control, including the ability to edit, delete, and share the password with others.

Access permissions can be swiftly revoked when no longer required, helping minimize potential security risks and ensuring tight control over sensitive data.

Zoho Vault implements access control measures and ensures that all attempts to access financial data are monitored, audited, and documented. Beyond just implementing role-based access control, all access requests are directed through an administrator before being approved, which enhances responsibility and decreases the likelihood of unauthorized access and supply chain risks.

Zoho Vault simplifies the periodic review of user accounts and access rights by providing centralized management and clear visibility into all user activities and privileges. It helps system owners easily identify excessive or unauthorized access through comprehensive reports. With role-based access controls and integrations with identity providers like Zoho Directory, Google Workspace, Microsoft 365, Active Directory, Microsoft Entra ID, and Okta, Zoho Vault ensures that access is always aligned with user roles and organizational policies.

Zoho Vault ensures secure employee offboarding by enabling administrators to swiftly revoke all shared credentials, folder access, and user-specific permissions, eliminating any residual access that could pose a security risk. Additionally, passwords can be temporarily shared with third parties, such as contractors or freelancers, even if they don’t have a Zoho Vault account or aren’t part of your organization. Access is granted for a specified period and automatically revoked after that.

Zoho Vault collaborates with leading MFA vendors to offer secure authentication based on every organization’s requirements. This includes methods like SMS-based one-time passwords (OTP), third-party authenticator apps like Google Authenticator and Microsoft Authenticator, security keys, passkeys, and Zoho OneAuth. By adding an extra layer of verification beyond passwords, Zoho Vault strengthens protection against cyber threats, reduces the risk of unauthorized access, and ensures robust access control.

PR.AA.S4

PR.AA.S5

REs shall follow zero-trust security models in such a way that access (from within or outside REs’ network) to their critical systems is denied by default and allowed only after proper authentication and authorization.

MIIs and Qualified REs (mandatory)

Zoho Vault enables a zero-trust approach by denying default access and allowing it only after strict authentication and authorization. With role-based permissions, MFA, and detailed audit logs, Vault ensures that only verified users can access confidential data.

PR.AA.S6

REs shall implement strong password controls for users’ access to systems, applications, networks, databases, etc. Password controls shall include (but are not limited to) a change of password upon first login, minimum password length and history, password complexity, as well as a maximum validity period.

The user credential data shall be stored using strong hashing algorithms.

All REs except small-size, self-certification REs (mandatory)

Zoho Vault's password policies define the required strength of user passwords and the frequency of renewal. Restrictions on allowed IP addresses and geo locations help prevent sign-in attempts from unauthorized locations.

By default, Zoho Vault encrypts passwords using the AES-256 symmetric encryption algorithm. It serves as a centralized, tamper-proof space to store and manage shared sensitive information such as passwords, passkeys, documents, bank account details, payment card details, and digital certificates of a regulated entity, ensuring secure access to financial information.

PR.DS.S4

REs shall enforce effective data protection, backup, and recovery measures

All REs (mandatory)

Zoho Vault supports effective data protection and recovery by periodically sending encrypted backups of stored confidential information to your preferred email or cloud account. This ensures that critical data remain secure and accessible, enabling swift recovery during cybersecurity incidents.