What Is SEBI CSCRF?
The Cybersecurity and Cyber Resilience Framework (CSCRF) is SEBI's comprehensive cybersecurity mandate for all market intermediaries. Released in 2024 and with final compliance deadlines in 2026, it replaces earlier, fragmented cybersecurity circulars.
Apr 2026Final compliance deadline for all market intermediaries (SEBI Circular SEBI/HO/ITD/ITD-SEC-1/P/CIR/2024/113)
₹25 CrMaximum penalty for non-compliance with SEBI cyber regulations (SEBI Act, Section 15HB)
47Specific security controls mandated by CSCRF (SEBI CSCRF Document)
5,000+SEBI-registered intermediaries required to comply (SEBI Annual Report)
Who Must Comply?
| Entity Type | CSCRF Applies? | Deadline |
|---|---|---|
| Stock brokers | Yes | Apr 2026 |
| Depository participants | Yes | Apr 2026 |
| Mutual fund AMCs | Yes | Apr 2026 |
| Registrar & transfer agents | Yes | Apr 2026 |
| Investment advisers | Yes | Apr 2026 |
| Research analysts | Yes | Apr 2026 |
| Portfolio managers | Yes | Apr 2026 |
| Alternative investment funds | Yes | Apr 2026 |
| Credit rating agencies | Yes | Apr 2026 |
| KYC registration agencies | Yes | Apr 2026 |
DANGER
SEBI has made it clear: non-compliance is not an option. Penalties can include monetary fines up to ₹25 crore, suspension of registration, and debarment from the securities market. Several entities have already received show-cause notices for inadequate cybersecurity practices.
The 5 Pillars of CSCRF
graph TD
A[SEBI CSCRF
Compliance] --> B[1. Governance
Board-level cyber oversight] A --> C[2. Identify
Asset inventory, risk assessment] A --> D[3. Protect
Access controls, encryption, VAPT] A --> E[4. Detect
SOC, log monitoring, alerting] A --> F[5. Respond & Recover
Incident response, BCP, DR] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style D fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
Compliance] --> B[1. Governance
Board-level cyber oversight] A --> C[2. Identify
Asset inventory, risk assessment] A --> D[3. Protect
Access controls, encryption, VAPT] A --> E[4. Detect
SOC, log monitoring, alerting] A --> F[5. Respond & Recover
Incident response, BCP, DR] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style D fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
Pillar 1: Governance
- Board-approved cybersecurity policy
- Designated CISO or equivalent
- Annual cybersecurity audit by CERT-In empanelled auditor
- Cyber risk as a standing Board agenda item
Pillar 2: Identify
- Complete IT asset inventory (hardware, software, data)
- Risk assessment covering all critical systems
- Data classification and sensitivity mapping
- Third-party risk assessment
Pillar 3: Protect
| Control | Requirement | Frequency |
|---|---|---|
| VAPT | Comprehensive vulnerability assessment and penetration testing | Quarterly |
| Access control | Role-based, MFA mandatory for privileged access | Continuous |
| Encryption | AES-256 at rest, TLS 1.2+ in transit | Continuous |
| Patch management | Critical patches within 30 days | Monthly review |
| Network segmentation | Separate zones for trading, client data, internet | One-time + review |
| Email security | SPF, DKIM, DMARC, advanced threat protection | Continuous |
| Endpoint security | EDR/XDR on all endpoints | Continuous |
Pillar 4: Detect
- Security Operations Centre (SOC) — 24x7 monitoring
- SIEM deployment with correlation rules
- Network traffic analysis
- User behaviour analytics
- Log retention for minimum 5 years
Pillar 5: Respond & Recover
- Documented incident response plan (tested quarterly)
- Report to CERT-In within 6 hours
- Report to SEBI within 6 hours
- Business continuity plan with RTO < 4 hours
- Disaster recovery with RPO < 2 hours
- Annual DR drill
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanVAPT Requirements Under CSCRF
SEBI CSCRF has specific and detailed VAPT requirements:
| Aspect | CSCRF Requirement |
|---|---|
| Scope | All internet-facing and internal critical systems |
| Frequency | Quarterly for external, semi-annual for internal |
| Standards | Must follow OWASP, SANS, NIST methodologies |
| Auditor | Must be CERT-In empanelled or equivalent |
| Report | Must include severity ratings, CVSS scores, remediation |
| Remediation | Critical/High within 30 days, Medium within 60 days |
| Re-testing | Mandatory after remediation to verify fixes |
| Board reporting | VAPT summary must be presented to Board quarterly |
Key Takeaway
VAPT is not just a checkbox — it's the most scrutinized control in SEBI audits. SEBI examiners look at VAPT report quality, scope coverage, remediation timelines, and whether findings are actually being fixed. Having a reliable VAPT partner is essential for CSCRF compliance.
Common Compliance Gaps We See
- VAPT scope too narrow — Only testing the website, not APIs, mobile apps, or internal systems
- No re-testing after fixes — Fixing vulnerabilities but not verifying the fixes work
- Board not informed — VAPT results not reaching the Board as required
- Patch management delays — Critical patches taking months instead of 30 days
- SOC is a checkbox — Having a SOC contract but no real monitoring or alerting
How Bachao.AI Supports CSCRF Compliance
- Quarterly VAPT scans covering web, API, and network
- OWASP-aligned reports with CVSS scores and remediation steps
- Board-ready summaries — Executive summary suitable for Board presentation
- Re-testing included — Verify fixes after remediation
- Continuous monitoring — Ongoing vulnerability detection between quarterly scans
INFO
Start with a free external VAPT scan to assess your current security posture. Visit bachao.ai — the report includes SEBI CSCRF control mapping.
Written by Shouvik Mukherjee, Founder of Bachao.AI. Contact: ceo@bachao.ai. Follow me on LinkedIn for SEBI compliance and cybersecurity insights.
