SEBI CSCRF Compliance for Stock Brokers and Trading Members: The Complete 2026 Audit Guide

The June 2026 Deadline Is Not Soft

SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) — issued in August 2024 — represents the most comprehensive cybersecurity mandate ever issued to India's capital markets ecosystem. The final compliance deadline for implementation across all Regulated Entities (REs) is June 2026. SEBI has already conducted preliminary CSCRF compliance reviews with select intermediaries and signalled that findings will be treated as enforcement-worthy deficiencies.

If you are a stock broker, depository participant, registrar and transfer agent, asset management company, investment adviser, or research analyst with a SEBI registration — this framework applies to you.

Who Must Comply and at What Tier

CSCRF categorises all SEBI-regulated entities into five tiers based on technology risk profile and market criticality:

CSCRF Framework Architecture

SEBI structured CSCRF around five functions — borrowed from the NIST Cybersecurity Framework but adapted for Indian capital markets:

Function 1: Identify — Governance and Asset Management

Governance Controls

1. Cybersecurity policy approved by the Board of Directors — not the management committee, the Board. Policy must be reviewed annually and be available for SEBI inspection on request.
2. Board-level accountability — at least one Board member or Trustee designated as responsible for cybersecurity oversight. For listed entities, this may align with the Audit Committee mandate.
3. CISO appointment — a Chief Information Security Officer (or equivalent) with direct access to the Board. SEBI is explicit that the CISO cannot report to the CTO for independence.
4. Cybersecurity budget reported to the Board as a line item — evidence of investment proportionate to technology risk.
5. Third-party risk management policy — covers all technology vendors, cloud providers, and outsourced operations (trading platforms, back-office systems, KYC vendors).

Asset Management Controls

1. Technology asset inventory — every server, endpoint, network device, application, and cloud resource documented with owner, criticality, and data classification
2. Data classification policy — Customer PII, trading data, financial records, and regulatory filings each classified and handled with corresponding controls
3. Critical asset identification — order management systems (OMS), trading platforms, risk management systems, and customer-facing portals designated as critical; enhanced controls applied

Function 2: Protect — Security Controls Implementation

Access Management

1. Multi-factor authentication (MFA) mandatory on all systems that handle client data or trading functions — no exceptions, no time-limited exemptions
2. Privileged access management — dedicated PAM solution or equivalent for administrator access to trading systems, risk engines, and customer databases
3. Least privilege enforced — trading desk staff cannot access back-office systems; compliance staff cannot access trading systems without documented business justification
4. Remote access — all remote access through VPN with MFA; no direct RDP or SSH from the internet

Data Protection

1. Encryption at rest for all customer data — PAN, Aadhaar (masked), bank account details, portfolio holdings, transaction history
2. Encryption in transit — TLS 1.2 minimum; legacy TLS disabled on all trading and customer-facing endpoints
3. Data Loss Prevention (DLP) — controls on email, cloud storage, and USB to prevent exfiltration of client data or trading positions
4. Mobile device management (MDM) for any device used to access trading systems or client data — BYOD policy documented with minimum security baselines

Network Security

1. Network segmentation — trading network, internet-facing applications, back-office systems, and administrative networks are separated by firewalls with documented rulesets
2. WAF (Web Application Firewall) on all internet-facing trading portals and client applications
3. DDoS protection — documented capability to absorb or mitigate DDoS attacks on trading infrastructure; this is non-negotiable given the market stability implications

VAPT Requirements

This is where CSCRF is explicit in a way most SEBI circulars are not:

1. Annual VAPT mandatory for all tiers — scope includes internet-facing trading applications, APIs, mobile apps, and network perimeter
2. VAPT must be conducted by a CERT-In empanelled vendor — internal testing does not satisfy the CSCRF requirement
3. Re-testing within 3 months of critical finding remediation — open critical findings are a SEBI examination red flag
4. VAPT report must be presented to the Board — not just filed with IT; the Board must be informed of the security posture

Function 3: Detect — Monitoring and Threat Detection

Security Operations

1. Security logging — all access to trading systems, customer data, and administrative functions logged with user, timestamp, action, and source IP. Minimum retention: 5 years (aligns with SEBI record-keeping requirements).
2. SIEM or equivalent — log correlation with alert rules for: off-hours access, bulk data exports, failed authentication spikes, privilege escalation
3. 24/7 monitoring for Qualified REs and above — either in-house SOC or outsourced MSSP. Small REs need at minimum automated alerts reviewed the next business day.
4. Dark web monitoring — for Qualified REs and above, SEBI expects active monitoring for leaked credentials or client data on underground forums

Market Manipulation Detection

CSCRF has a capital-markets-specific addition most generic cybersecurity frameworks lack: cyber threat intelligence applied to market manipulation detection. Unusual trading patterns that coincide with system access anomalies must be flagged and investigated.

Function 4: Respond — Incident Response for Capital Markets

SEBI-Specific Incident Reporting

Capital markets incidents have two audiences: CERT-In (6-hour window) and SEBI. SEBI's CSCRF requirements:

1. Report to designated SEBI department within 6 hours of a cybersecurity incident affecting trading operations or client data
2. Preliminary incident report within 24 hours — nature, scope, impact on markets/clients, containment status
3. Final investigation report within 21 days — full RCA, regulatory impact assessment, remediation plan

Crisis Communication

1. Client communication plan — how and when are clients notified if their trading account or data is affected?
2. SEBI liaison — a designated point of contact who can speak to SEBI during an active incident
3. Media policy — who speaks to the press, what can be said, what cannot be said until SEBI clearance

Function 5: Recover — Business Continuity for Trading Operations

1. RTO for trading systems — SEBI expects trading operations to resume within defined windows; MIIs have the strictest requirements (minutes), while broker platforms have more latitude (hours)
2. DR drill for trading systems — annual drill with documented results; SEBI examiners will ask for the last drill report
3. Client data backup — recovery point objective (RPO) of ≤ 24 hours for client portfolios and transaction history
4. Cyber insurance — CSCRF recommends (does not mandate) cyber insurance proportionate to technology risk; for Qualified REs this is de facto expected

SEBI CSCRF vs. Other Frameworks: What's New

Your CSCRF Compliance Timeline — June 2026 Sprint

Book your SEBI CSCRF compliance VAPT at bachao.ai/sebi-audit. We deliver CERT-In aligned VAPT reports with a SEBI CSCRF control mapping section, structured for direct submission to your Board and compliance team. Turnaround: 7–10 business days. Capacity is limited — book now for pre-June delivery.

Written by Shouvik Mukherjee, Founder, Bachao.AI. 15+ years in software engineering, now building AI-powered security products. Fourth-time founder. DPIIT Recognised Startup. Serving SEBI-registered intermediaries, stock brokers, and AMCs across India.