Nepal Securities Board Enforces IT Policy After Ransomware Attack

The Nepal Securities Board has brought an information technology (IT) policy into effect from Wednesday to strengthen cybersecurity in the country’s share market, following a ransomware attack on a data centre that forced the market to shut down on Ashoj 5. The new policy places IT security in focus after the incident disrupted market operations.

Policy follows market shutdown

The policy’s implementation comes after a ransomware attack affected a data centre and led to the share market’s closure on Ashoj 5. The shutdown underscored the potential for a cyber incident affecting a data centre to interrupt trading operations. The Board’s stated aim in implementing the policy is to strengthen cybersecurity in the share market.

The Board has not provided further details in the information available about the policy’s specific provisions, the systems it covers or how compliance will be monitored. The announcement establishes that the policy is now in force, but does not describe technical requirements or other measures required of market participants.

Cybersecurity in focus

The attack and subsequent shutdown place digital security among the concerns facing the share market. Data centres support the systems on which market operations depend, and an interruption can affect the ability to keep those operations running. In this case, the ransomware incident was followed by a shutdown on Ashoj 5.

The Board’s action is intended to strengthen the market’s cybersecurity through an IT policy. Its implementation marks a response following the disruption, although the available details do not specify whether the policy introduces new procedures, technical safeguards or reporting obligations.

Policy takes effect from Wednesday

The policy took effect from Wednesday, according to the announcement. No calendar date or year was specified in the information provided. The key development is that the Board has moved from announcing an IT policy to putting it into effect after the ransomware-related disruption.

For the share market, the policy’s significance will depend on the provisions it sets out and how they are applied. Those details were not included in the available information. What is clear is that the Board has identified cybersecurity as an area requiring stronger attention and has implemented a policy after an attack led to the market’s shutdown.