One framework for the capital market
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued in August 2024, replaced a patchwork of earlier circulars with a single framework covering SEBI-regulated entities (REs) — from market infrastructure institutions to brokers, depositories, mutual funds and portfolio managers.
Graded by category
CSCRF applies obligations proportionately. Entities are categorised by size and systemic importance, broadly from Market Infrastructure Institutions and Qualified REs down to mid-size, small and self-certification REs. The first step is confirming your category, because it determines the depth of controls, audit frequency and reporting.
Built around resilience goals
The framework is structured around cyber resilience goals — anticipate, withstand, contain, recover and evolve — with standards mapped to governance, identification, protection, detection, response and recovery.
What most entities must put in place
Governance
- A board-approved cybersecurity and cyber resilience policy
- A designated CISO and a technology committee overseeing the programme
- Defined risk appetite and periodic reporting
Security operations
- Continuous security monitoring through a Security Operations Centre — smaller entities may use a market-level or third-party SOC
- Log collection and retention to support investigations
Protection and testing
- Asset inventory and data classification
- Vulnerability assessment and penetration testing at the defined frequency
- Secure configuration, patching and access management
Response and recovery
- An incident response plan with regulatory reporting timelines
- Tested backups and recovery objectives aligned to business criticality
A pragmatic implementation sequence
- Confirm category and applicable standards
- Run a gap assessment against the CSCRF control set
- Fix governance documents and roles first — they unblock everything else
- Close monitoring and testing gaps
- Prepare the audit evidence pack and compliance submission
Key takeaways
- CSCRF replaces earlier SEBI cyber circulars with one graded framework.
- Your category decides control depth, audit frequency and reporting.
- Fix governance first, then monitoring, testing and recovery.
Frequently asked questions
Does CSCRF apply to small brokers?
Yes, but obligations are proportionate. Smaller regulated entities have a lighter set of controls and may use a market-level or third-party SOC.
Is a SOC mandatory?
Continuous monitoring is expected across categories. Larger entities typically run or contract a dedicated SOC; smaller ones can use shared options recognised under the framework.
How is compliance demonstrated?
Through periodic cyber audits and compliance submissions at the frequency set for your category, backed by documented evidence.
Proportionality cuts both ways: smaller entities have fewer controls, but less room to miss any of them.
Our GRC advisory helps SEBI-regulated entities with CSCRF gap assessments, SOC onboarding and audit readiness.
