SEBI CSCRF
Compliance

SEBI's CSCRF (August 2024) sets unified cybersecurity obligations across every market intermediary, from MIIs to Self-Certification REs. The January 2025 deadline has passed. Get tier-matched remediation in place now.

Board-Approved IS Policy Annual VAPT 2-Hour SEBI Notification India Data Localization
Market Surveillance Radar
CSCRF Framework Mapping
IS Policy & Governance
CERT-In Empanelled VAPT
Data Localisation Compliance
2-Hour Incident Reporting
SEBI Compliant
Market Secure
CSCRF Ready
Audited

SEBI CSCRF Compliance Across All Entity Tiers

SEBI's CSCRF (August 20, 2024) supersedes all prior SEBI cybersecurity circulars and applies to every regulated entity, from exchanges and depositories to stock brokers, AMCs, and KRAs. Built on five resiliency goals, requirements are tiered by entity size. All entities need a board-approved IS Policy, annual VAPT by CERT-In empanelled auditors, India data localization compliance, and 2-hour incident reporting.

CSCRF Gap Assessment

Tier-specific gap assessment against CSCRF controls per Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2024/85, producing a prioritised remediation roadmap.

IS Policy and BCP Documentation

Board-approved IS Policy, IRP, BCP, and Cyber Crisis Management Plan per CSCRF Paragraphs 8-11 for your entity tier.

Entity Tier Classification

Determine CSCRF entity tier (MII, QRE, Mid-size RE, Self-Cert RE) per Paragraph 4 and identify applicable requirements.

Data Localization Assessment

Evaluate data residency and cross-border flows against CSCRF Paragraph 24, identifying non-compliant storage and processing.

VAPT Programme Design

Design annual VAPT per CSCRF Paragraph 20, scoped to cover trading systems, client portals, APIs, and internal networks.

Third-Party Risk Evaluation

Assess IT vendors against CSCRF Paragraphs 25-27 third-party risk requirements for market intermediaries.

SOC and Market SOC (MIIs/QREs)

Design or source 24x7 SOC for MIIs/QREs per CSCRF Paragraph 16. Mid-size and smaller REs may use M-SOC from NSE/BSE.

Annual VAPT by CERT-In Empanelled Auditors

Annual VAPT per CSCRF Paragraph 20 by CERT-In empanelled firms, covering trading systems, portals, and APIs.

Annual Cyber Audit Preparation

Prepare evidence for mandatory annual cyber audit per CSCRF Paragraph 21, including control rationale and auditor liaison.

2-Hour Incident Reporting

Implement 2-hour SEBI and CERT-In notification per CSCRF Paragraph 22 with classification criteria and escalation runbooks.

Data Localization Implementation

Implement India data localization per CSCRF Paragraph 24 for all market data, client data, and transaction records.

Security Controls Deployment

Deploy access management, encryption, network security, and vulnerability controls aligned to your CSCRF entity tier requirements.

Annual Audit Submission

Prepare and submit annual cyber audit per CSCRF Paragraph 21 with evidence packages and empanelled auditor coordination.

Quarterly Compliance Review

Quarterly review of CSCRF controls and regulatory developments to maintain continuous compliance per entity tier.

Threat Intelligence Monitoring

Ongoing threat intelligence covering capital market APT campaigns and emerging cyber risk to trading platforms.

Incident Response Drills

Periodic tabletop exercises testing 2-hour SEBI/CERT-In notification per CSCRF Paragraph 22 and escalation workflows.

Regulatory Update Tracking

Track SEBI circulars, CSCRF amendments, and CERT-In directions, implementing changes within regulatory timelines.

Market SOC Integration Review

Periodic review of M-SOC integration, alert coverage, and incident escalation effectiveness for entities using exchange-provided SOC.

Does SEBI CSCRF Apply to Your Organisation?

Stock Brokers and Trading Members

All SEBI-registered stock brokers and trading members must comply with CSCRF. Large brokers qualify as Qualified REs (requiring 24x7 SOC), while smaller regional brokers may fall under Mid-size or Self-Certification RE tiers with proportionate requirements.

Market Infrastructure Institutions (MIIs)

Stock exchanges (NSE/BSE), depositories (NSDL/CDSL), and clearing corporations face the highest-tier CSCRF obligations including 24x7 SOC, advanced persistent threat (APT) monitoring, red teaming, and the most stringent data localization requirements.

AMCs, Mutual Funds and KRAs

Asset Management Companies, mutual fund houses, and KYC Registration Agencies (KRAs) are covered by SEBI CSCRF with annual audit obligations, IS Policy requirements, VAPT by CERT-In empanelled firms, and 2-hour incident reporting mandates.

How We Build Your SEBI CSCRF Programme

A structured six-phase process from entity tier classification through to ongoing annual audit submission and incident reporting readiness.

Phase 01
Entity Tier Classification and Gap Assessment

Determine your CSCRF entity tier and gap-assess current controls against the applicable requirement set, producing a prioritised remediation roadmap ahead of your audit deadline.

01
02
Phase 02
IS Policy and BCP Documentation

Develop board-approved IS Policy, Incident Response Plan, Business Continuity Plan, and Cyber Crisis Management Plan per CSCRF tier-specific requirements.

Phase 03
SOC and Security Controls Implementation

Deploy or source 24x7 SOC capability (own SOC or M-SOC), implement security controls, access management, encryption, and network security aligned to your entity tier.

03
04
Phase 04
VAPT and Annual Audit Preparation

Execute annual VAPT by CERT-In empanelled auditors and prepare evidence packages for empanelled auditor annual cyber audit submission to SEBI.

Phase 05
Incident Reporting and Data Localization

Implement 2-hour SEBI incident notification procedures, CERT-In reporting workflows, and India data localization controls for all market and client data.

05
06
Phase 06
Ongoing Compliance and Audit Submission

Quarterly compliance reviews, annual audit submissions, regulatory update tracking, incident response drills, and continuous monitoring to sustain CSCRF compliance year-round.

Questions We Get Asked Often

SEBI CSCRF (Cyber Security and Cyber Resilience Framework) issued August 2024 covers 5 cyber resiliency goals across all entity tiers, applicable to stock brokers, MIIs, AMCs, depositories, and market intermediaries.

All SEBI-regulated entities including stock brokers, market infrastructure institutions (MIIs), asset management companies (AMCs), depositories, and market intermediaries must comply.

SEBI CSCRF requires IS policy, SOC setup, annual VAPT by CERT-In empanelled auditors, data localization, 2-hour incident reporting, and compliance across 5 cyber resiliency goals for all entity tiers.

SEBI can levy monetary penalties, issue directions for remediation, and in severe cases suspend trading permissions. The 2-hour incident reporting window is enforced with strict compliance expectations.

Qualified Regulated Entities typically achieve baseline compliance in 3 to 6 months. MIIs and QREs with complex market infrastructure may need 9 to 12 months for full SOC and Market SOC implementation.

Meet SEBI CSCRF Compliance

Start with a tier-specific CSCRF gap assessment and get a compliance roadmap aligned to your audit submission timeline.