SEBI CSCRF

What is SEBI CSCRF?

The CSCRF is SEBI’s single framework for cybersecurity and cyber resilience across the Indian securities market. Issued in August 2024, it replaced a set of earlier, entity-specific SEBI cyber circulars. It applies requirements in proportion to the size and criticality of each regulated entity.

Who does it apply to?

SEBI regulated entities (REs), grouped into five categories:

• market infrastructure institutions, such as stock exchanges, clearing corporations and depositories;
• qualified REs;
• mid-size REs;
• small-size REs;
• self-certification REs.

Stockbrokers, depository participants, mutual funds and asset management companies, portfolio managers, KYC registration agencies and others are covered in the category that matches their size.

Key duties

• Governance: board-approved cybersecurity and cyber resilience policies, a designated CISO for most categories, and technology committees.
• Cyber resilience goals: anticipate, withstand, contain, recover and evolve. These are mapped to functions similar to NIST CSF: govern, identify, protect, detect, respond and recover.
• Security operations: continuous monitoring through the RE’s own SOC, a group SOC or a market SOC provided by market infrastructure institutions for smaller entities.
• Testing and audit: periodic vulnerability assessment and penetration testing and cybersecurity audits by CERT-In-empanelled auditors, with a cyber capability index for the largest entities.
• Data and cloud: data classification and localisation expectations, and conditions for using cloud services.
• Incident reporting: report cyber incidents to SEBI and CERT-In within the required timelines.

How does it relate to other frameworks?

The CSCRF borrows the structure of NIST CSF and aligns with CERT-In’s Directions. Entities already working to ISO/IEC 27001 will find much of the control content familiar. Check SEBI’s later circulars for updated compliance dates.