SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) is a unified compliance standard that requires stock brokers, asset management companies (AMCs), registered investment advisors (RIAs), depositories, and other SEBI-regulated entities to build cyber defenses across six functions — Govern, Identify, Protect, Detect, Respond, Recover — mapped to the NIST Cybersecurity Framework (CSF) 2.0. It consolidates earlier, fragmented SEBI circulars into one framework covering board-level governance, VAPT, SOC monitoring, and incident reporting to SEBI and CERT-In.
If you run compliance, IT, or security for a SEBI-regulated entity, CSCRF is not optional reading — it is the operating manual your regulator expects you to already be following.
What Is SEBI CSCRF and Why It Exists
Before CSCRF, SEBI-regulated entities operated under a patchwork of circulars — separate cybersecurity guidelines for stock brokers, depositories, mutual funds, and market infrastructure institutions (MIIs), each with its own cadence and reporting format. That fragmentation created inconsistent security postures across the market ecosystem and made it harder for SEBI to get a unified view of systemic cyber risk.
CSCRF replaces this patchwork with a single framework applicable across "Regulated Entities" (REs) — a category that spans stock brokers, depositories, clearing corporations, AMCs, RIAs, research analysts, KYC Registration Agencies, and other SEBI-registered intermediaries, with obligations scaled by entity size and systemic importance. The framework explicitly borrows the six-function structure of NIST Cybersecurity Framework (CSF) 2.0, which is itself widely referenced across financial-sector regulation globally.
The Six CSF-Aligned Functions
CSCRF structures every obligation under six functions borrowed from NIST Cybersecurity Framework (CSF) 2.0. Together they form a continuous cycle rather than a one-time checklist.
1. Govern
Governance is the foundation the other five functions sit on: a board-level cyber security committee, a designated Chief Information Security Officer (CISO) or equivalent, documented policy ownership, and clear escalation authority. SEBI expects this accountability structure to exist on paper and in practice — an entity cannot demonstrate Identify-through-Recover maturity without a named owner and a governing body signing off on the program.
2. Identify
This is asset and risk inventory: knowing what systems, data, third-party dependencies, and critical business processes exist, and what would break if each were compromised. Regulated entities are expected to maintain an updated asset register, classify data sensitivity, and map dependencies on outsourced IT and cloud vendors — because a vendor breach is treated as your breach for compliance purposes.
3. Protect
Protective controls cover access management, network segmentation, encryption, secure configuration, patch management, and employee security awareness. This is where baseline technical hygiene — least-privilege access, MFA, endpoint protection, secure SDLC for any in-house trading or client-facing systems — gets formalized into policy and evidenced during audits.
4. Detect
Detection obligations are where CSCRF gets operationally demanding: regulated entities above certain thresholds are expected to run continuous security monitoring, typically through a Security Operations Centre (SOC) — either built in-house or outsourced to a managed security service provider (MSSP). Log retention, anomaly detection, and threat intelligence feeds fall here.
5. Respond
This function requires a documented, tested incident response (IR) plan: escalation paths, containment procedures, forensic preservation steps, and — critically — timelines for reporting cyber incidents to SEBI and to CERT-In under India's incident reporting rules. Entities that discover an incident but delay notification are themselves a compliance failure, independent of the breach's technical severity.
6. Recover
Recovery obligations cover business continuity planning, disaster recovery testing, backup integrity verification, and post-incident review to close the loop back into the Identify function — updating the risk register based on what the incident revealed.
Key Obligations: SOC, VAPT, and Incident Reporting
Four obligations tend to dominate the actual compliance workload for mid-size regulated entities.
Governance structure. SEBI expects a named CISO or equivalent and a board-level cyber security committee with documented accountability — not just a policy document filed away. Auditors look for evidence that the governance function is active, not decorative.
SOC / MSSP monitoring. Continuous detection capability is not satisfied by a firewall and antivirus alone. Entities either stand up an internal SOC — expensive and talent-constrained for most mid-size firms — or contract a managed security service provider for 24x7 log monitoring and alerting. For most RIAs, smaller brokers, and AMCs, an MSSP arrangement is the realistic path.
VAPT cadence. Regular vulnerability assessment and penetration testing of critical systems — trading platforms, client portals, APIs, and infrastructure exposed to the internet — is a recurring obligation, not a one-time exercise. SEBI-regulated entities are expected to run VAPT on a defined periodic cycle and remediate findings within set timelines, with evidence retained for audit. Where a formal empanelled audit is required, this is typically done with a CERT-In empanelled partner, alongside continuous internal scanning between formal audit cycles.
Incident reporting. Cyber incidents affecting a regulated entity must be reported both to SEBI and to CERT-In, consistent with CERT-In's broader incident reporting directions that apply across Indian entities. The reporting obligation is time-bound from the point of detection, not from the point of confirmation — ambiguity about whether something "counts" as an incident is not a valid reason to delay reporting.
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanCompliance Approach for a Mid-Size Regulated Entity
Most mid-size brokers, AMCs, and RIAs don't have a large in-house security team. A practical build-out sequence looks like this:
| Step | Action | Primary CSF Function |
|---|---|---|
| 1 | Name a CISO or equivalent and stand up a board-level cyber security committee | Govern |
| 2 | Inventory assets, data flows, and third-party/cloud dependencies | Identify |
| 3 | Close baseline gaps — MFA, patching, access reviews, encryption at rest/transit | Protect |
| 4 | Stand up continuous monitoring via internal SOC or MSSP contract | Detect |
| 5 | Run periodic VAPT with a CERT-In empanelled partner and internal continuous scanning between cycles | Protect / Detect |
| 6 | Document and test an incident response plan with clear SEBI/CERT-In reporting timelines | Respond |
| 7 | Validate backups, run DR drills, and formalize business continuity plans | Recover |
| 8 | Review and update the risk register based on audit and incident findings | Identify (loop) |
Continuous vulnerability visibility between formal audit cycles is where automated platforms like Bachao.AI (built by Dhisattva AI Pvt Ltd, a DPIIT Recognized Startup) fit into the workflow — surfacing exposures on trading portals, client-facing APIs, and infrastructure so that the periodic VAPT engagement with a CERT-In empanelled partner starts from a cleaner baseline rather than discovering basic issues for the first time during a formal audit window.
Common Pitfalls Mid-Size Entities Should Avoid
Treating VAPT as a compliance checkbox. Running a scan once a year to generate a report for the file, without remediating findings or re-testing, defeats the purpose and leaves genuine exposure between cycles.
Underestimating third-party risk. Outsourced IT, cloud hosting, and fintech API integrations are frequently the weakest link, and CSCRF explicitly extends accountability to vendor relationships — an RE cannot outsource its compliance obligation along with the workload.
No tested reporting workflow. Knowing that incidents must be reported to SEBI and CERT-In is not the same as having a rehearsed, time-bound internal process for who reports, in what format, and within what window.
Effort Distribution Across the Six Functions
For most mid-size regulated entities building out CSCRF compliance from a limited baseline, effort and investment are not spread evenly across the six functions. Detect (SOC/MSSP monitoring) and Protect (baseline controls) typically consume the largest share of early build-out effort, since most mid-size REs start with weak continuous-monitoring capability and governance structures are comparatively quicker to formalize on paper.
Frequently Asked Questions
Frequently Asked Questions
Which entities does SEBI CSCRF apply to?
Does CSCRF replace earlier SEBI cybersecurity circulars?
How often does VAPT need to be conducted under CSCRF?
Do incidents need to be reported to both SEBI and CERT-In?
Can a small RIA or brokerage rely on a managed security service provider instead of building an in-house SOC?
How does CSCRF relate to the DPDP Act?
Sources: SEBI Cybersecurity and Cyber Resilience Framework circulars (sebi.gov.in), CERT-In incident reporting directions (cert-in.org.in), NIST Cybersecurity Framework (nist.gov).
Ready to strengthen your compliance posture before your next audit cycle? Book a free VAPT scan.