SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) is a mandatory compliance framework that consolidates all prior SEBI cybersecurity circulars into a single, graded set of obligations for India's capital-market Regulated Entities. If your organisation is a stock broker, depository participant, asset management company, KRA, or any other SEBI-registered entity, CSCRF applies to you — and non-compliance is a regulatory risk you cannot afford to ignore.
What Is the SEBI CSCRF?
SEBI issued the Cybersecurity and Cyber Resilience Framework in 2023, superseding a patchwork of earlier circulars on IT security, cyber-incident reporting, and SOC requirements that had accumulated over the preceding decade. The goal was to give Regulated Entities (REs) one authoritative, technology-neutral playbook aligned to globally recognised security standards — specifically the NIST Cybersecurity Framework (CSF).
At its core, CSCRF maps every obligation to five cyber-resilience goals:
- Anticipate — identify assets, risks, and threats before they materialise
- Withstand — implement controls that protect systems even under attack
- Contain — limit the blast radius of an incident once it begins
- Recover — restore services and data with defined RTO/RPO targets
- Evolve — continuously improve posture using lessons learned and threat intelligence
Who Does CSCRF Apply To?
CSCRF applies to all SEBI Regulated Entities, including but not limited to:
- Stock Brokers (full-service and discount)
- Depository Participants (DPs)
- Asset Management Companies (AMCs) and Mutual Funds
- KYC Registration Agencies (KRAs)
- Stock Exchanges and Clearing Corporations
- Registrars and Transfer Agents (RTAs)
- Investment Advisers and Research Analysts (subject to thresholds)
- Portfolio Managers
- Alternative Investment Funds (AIFs) and Venture Capital Funds
The Control Domains: What CSCRF Actually Requires
CSCRF organises obligations across several interconnected domains. The table below maps the key domain, its core obligation, and the entity-size sensitivity.
| Domain | Core Obligation | Size Sensitivity |
|---|---|---|
| Governance | Board-level oversight, CISO appointment, policy documentation | All tiers |
| Asset Management | Inventory of critical systems, data classification | All tiers |
| VAPT | Periodic Vulnerability Assessment & Penetration Testing by CERT-In empanelled organisation | All tiers; frequency scales with size |
| SOC | Security Operations Centre — own SOC or market-SOC (third-party) | Mandatory for larger REs; market-SOC option for smaller |
| Cyber Audit | Annual cyber audit by qualified auditor | All tiers |
| Incident Reporting | Report to SEBI and CERT-In within prescribed timeframes | All tiers |
| Third-Party / Vendor Risk | Security assessment of critical technology service providers | Larger tiers |
| Business Continuity | BCP/DR with defined RTO, periodic drills | All tiers |
| Awareness & Training | Board-level, staff-level security awareness programmes | All tiers |
Governance and Board Oversight
CSCRF places cybersecurity governance firmly at the board level. REs are required to designate a CISO (or equivalent), ensure board-level reviews of the cyber-risk posture at defined intervals, and maintain a cyber-risk policy approved at the highest governance tier. This is not a checkbox — SEBI expects evidence of active board engagement, not just a signed policy document gathering dust.
VAPT: The Most Operationally Demanding Obligation
Vulnerability Assessment and Penetration Testing (VAPT) is one of the most actionable and recurring requirements under CSCRF. The framework mandates that VAPT be conducted by an organisation empanelled by CERT-In — India's national cybersecurity agency. The cadence (annual, semi-annual, or more frequent) depends on the RE's tier and the nature of its internet-facing and critical systems.
VAPT scope under CSCRF typically covers:
- Internet-facing applications and APIs
- Internal network and infrastructure
- Trading systems and client-facing portals
- Cloud and data-centre environments
Bachao.AI helps REs automate vulnerability discovery and evidence collection as part of VAPT readiness. Since CSCRF mandates the final certification by a CERT-In empanelled organisation, Bachao.AI's free VAPT scan is positioned as pre-audit intelligence — helping security teams identify and fix issues before the formal empanelled audit begins. The empanelled audit itself is delivered through a CERT-In empanelled partner. Dhisattva AI Pvt Ltd (the company behind Bachao.AI) is a DPIIT Recognised Startup.
Security Operations Centre (SOC)
Larger REs must establish and operate a SOC capable of 24x7 monitoring, threat detection, and incident triage. CSCRF recognises that not every RE can afford its own SOC infrastructure and explicitly permits the use of a market-SOC — a third-party SOC service offered by authorised providers. Smaller REs may use the market-SOC option to meet this obligation without standing up dedicated infrastructure.
Incident Reporting: Dual Obligation to SEBI and CERT-In
A cyber incident at a SEBI RE triggers a dual reporting obligation:
- Report to SEBI within the timeframes specified in the CSCRF circular (initial report, detailed report, closure report)
- Report to CERT-In in accordance with CERT-In's own incident-reporting directions (which mandate initial reporting within six hours of detection for prescribed incident categories)
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanCompliance Decision Flow for a Regulated Entity
The diagram below shows how a Regulated Entity determines its applicability category and the control domains it must then implement, culminating in SEBI submission.
by size and
systemic importance} B --> C[MII
Exchanges and
Clearing Corps] B --> D[Qualified RE
Large Brokers
AMCs and DPs] B --> E[Mid-size or Small RE
market-SOC eligible] C --> F[Full CSCRF Controls
Own SOC mandatory] D --> G[Full CSCRF Controls
Own or market-SOC] E --> H[Baseline Controls
market-SOC permitted] F --> I[Governance
and Board Oversight] G --> I H --> I I --> J[VAPT by CERT-In
Empanelled Org] J --> K[SOC Monitoring
24x7] K --> L[Cyber Audit
Annual] L --> M[Incident Reporting
SEBI and CERT-In] M --> N[Evidence Package
Submission to SEBI] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style B fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style D fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style E fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style F fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style G fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style H fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style I fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style J fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style K fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style L fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style M fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style N fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
Distribution of CSCRF Cyber-Resilience Goal Coverage
The five NIST-aligned goals are not evenly weighted in practice. Anticipate (Identify) and Withstand (Protect) together account for the largest share of prescribed controls in the CSCRF annexures, reflecting SEBI's emphasis on proactive risk management over reactive response. The chart below is an illustrative representation of relative control emphasis as distributed across the five goals in the framework.
Key Statistics
The Cyber Audit Requirement
Beyond VAPT, CSCRF mandates a broader cyber audit at least annually. The cyber audit covers governance, policy implementation, access controls, change management, vendor risk, and business continuity arrangements. The auditor must be independent and qualified; SEBI may specify categories of accepted auditors. Findings are graded by severity, and REs must submit a compliance certificate along with the audit report.
ISO 27001 and CSCRF: Complementary, Not Redundant
CSCRF does not mandate ISO 27001 certification, but the two frameworks share substantial common ground — asset management, risk assessment, access control, incident management, business continuity, and supplier security. REs pursuing ISO 27001 will find that CSCRF compliance becomes considerably more tractable once the ISMS is in place. Conversely, REs building CSCRF compliance from scratch are effectively building the operational foundation for ISO 27001.
A Practical Compliance Roadmap
| Phase | Action | Timeline |
|---|---|---|
| 1 — Gap Assessment | Map current controls against CSCRF domains; identify tier | Month 1 |
| 2 — Governance | Board approval of cyber-risk policy; CISO designation | Month 1–2 |
| 3 — Asset Inventory | Critical system and data classification exercise | Month 2–3 |
| 4 — Pre-Audit VAPT | Automated vulnerability scan + manual testing to find gaps | Month 3–4 |
| 5 — Empanelled VAPT | Formal VAPT by CERT-In empanelled organisation | Month 4–5 |
| 6 — SOC Setup | Establish own SOC or contract market-SOC | Month 3–6 |
| 7 — IR Playbook | Draft and test incident-response and SEBI/CERT-In reporting workflow | Month 4–5 |
| 8 — Cyber Audit | Annual audit; submission to SEBI | Month 6+ (annually) |
| 9 — Continuous | Patch management, threat intel, training, evolve loop | Ongoing |
What Happens If You Are Not Compliant?
SEBI has broad enforcement powers over REs, including the ability to issue directions, impose restrictions on operations, and initiate adjudication proceedings. CSCRF non-compliance — particularly failure to conduct mandatory VAPT, failure to establish SOC capability, or failure to report incidents — can surface during SEBI inspections or following a breach. The reputational and operational cost of a significant cyber incident at a capital-market entity is also severe: investor trust, market integrity, and client data are all at stake.
The framework is not a static audit — it is designed to evolve with the threat landscape. SEBI has signalled that CSCRF will be periodically updated, and REs that treat it as a one-time exercise rather than a continuous programme will find themselves out of step with each revision.
External References
- SEBI CSCRF Circular: https://www.sebi.gov.in — search "Cybersecurity and Cyber Resilience Framework"
- CERT-In Incident Reporting Directions: https://www.cert-in.org.in
- NIST Cybersecurity Framework: https://www.nist.gov/cyberframework