SEBI CSCRF Compliance: What Regulated Entities Must Know

Most regulated entities discovered SEBI's CSCRF the same way: an email from their designated Stock Exchange or Depository, forwarding a circular, with a compliance date already in the past. The panic that followed was less about the controls and more about a single word buried in the framework — auditability. SEBI did not just ask you to be secure. It asked you to prove it, on a schedule, in a format its examiners can read.

The Cyber Security and Cyber Resilience Framework — CSCRF — consolidated a decade of scattered SEBI cyber circulars into one document in August 2024. If you are a stockbroker, depository participant, mutual fund, KRA, RTA, portfolio manager or any of the twenty-two-odd regulated entity categories, this is now the ceiling and the floor of what SEBI expects. The trouble is that it borrowed heavily from NIST, wrapped it in SEBI's own maturity model, and then bolted on reporting timelines that catch most teams flat-footed.

The first mistake teams make is assuming CSCRF applies uniformly. It does not. SEBI graded its regulated entities — REs, in the framework's language — into five categories, and the depth of obligation scales with that grade. A large stockbroker and a small research analyst do not carry the same load, and pretending otherwise wastes budget or, worse, leaves you exposed.

Your category is not something you choose. SEBI defines the thresholds — typically on number of clients, trading volume, or assets under management — and your exchange or depository will tell you where you sit. What you can control is how honestly you read the obligation that follows. A Qualified RE that self-assesses as Mid-size to dodge a SOC requirement is buying a finding, not saving money.

CSCRF is organised around the NIST Cybersecurity Framework's functions, which SEBI calls Cyber Resilience Goals. If you have ever run a NIST assessment, the spine will feel familiar. What is different is that SEBI made each goal measurable through a Cyber Capability Index — CCI — and, for the larger REs, mandated a minimum maturity score you must hit and evidence.

The CCI is where CSCRF stops being a checklist and becomes an audit instrument. SEBI publishes a scoring methodology across roughly two dozen parameters. MIIs must achieve and maintain a defined maturity band; Qualified REs a lower but still substantial one. Your auditor does not tick boxes — they score you, and that number goes to SEBI. Get it wrong by inflating your self-score and the gap between your claim and the auditor's finding becomes the story.

CSCRF requires larger REs to have Security Operations Centre coverage — either their own SOC, a shared C-SOC provided by an MII or an approved market SOC, or a managed SOC from an empanelled provider. The word most teams miss is continuous. A SOC that only reviews alerts during business hours does not meet Contain. SEBI's examiners ask for the shift roster, the mean time to detect, and the alerts closed over the last quarter. If your SOC is a dashboard nobody watches after 6pm, that surfaces immediately.

CSCRF's teeth are in its timelines. Two of them matter most, and confusing them is a classic error. Incident reporting to SEBI and to CERT-In are separate obligations with separate clocks. CERT-In's Directions of April 2022 require reporting of listed cyber incidents within six hours of detection. SEBI, through CSCRF, layers its own reporting to your exchange or depository on top.

Separate from the incident clocks is the date CSCRF itself became binding, and most write-ups still quote a superseded one. SEBI issued the framework by circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 on 20 August 2024, then moved the compliance date twice. Circular 2025/45 of 28 March 2025 pushed it out three months to 30 June 2025. Circular 2025/96 of 30 June 2025 pushed it a further two months to 31 August 2025. Both extensions applied to every regulated entity except Market Infrastructure Institutions, KYC Registration Agencies and Qualified RTAs, which stayed on the original timeline throughout.

That final date has passed. CSCRF is fully in force, which changes the question an examiner opens with: not whether you are ready, but what your evidence shows for the period since. Two extensions in a row taught a lot of firms to wait for a third. There was not one.

The most recent amendment is circular 2025/119 of 28 August 2025, and nothing has superseded it. It matters most if you answer to more than one regulator. It introduces a Principle of Exclusivity and a Principle of Equivalence, so a custodian, depository participant or merchant banker that is also a bank under RBI supervision can demonstrate compliance once instead of running two parallel control sets and two evidence trails. It also re-categorises Portfolio Managers and Merchant Bankers, so if your category was settled before September 2025 it is worth re-checking against Part C rather than assuming it still holds.

One line in the framework decides who may sign the work. Unless otherwise specified, all audits mentioned in CSCRF have to be conducted by a CERT-In empanelled information security auditing organisation, and the same expectation is repeated for the VAPT and cyber audit that the Market SOC provides to small and mid-size entities. An internal team or a non-empanelled consultancy can help you prepare and can dry-run the evidence, but it cannot produce the audit SEBI expects to receive.

The six-hour CERT-In window is the one that ruins weekends. Detection, not confirmation, starts the clock. Teams waste hours deciding whether an anomaly is real before reporting; by the time they do, they have already breached. The right posture is to report on reasonable suspicion and refine later — CERT-In accepts follow-up updates. A late first report is a finding. An over-cautious early report is not.

Picture the second morning of a CSCRF cyber audit at a mid-size broking house. The CISO has produced a clean policy pack — access control, IR, BCP-DR — all board-approved, all recently dated. The auditor nods, then asks one question: show me the last time you restored a backup and how long it took. Silence. The backups run nightly, monitored, green ticks everywhere. Nobody has ever restored one. The DR drill on paper says RTO of four hours; the team has never measured it.

So the auditor asks for a live restoration of a non-production dataset. Ninety minutes in, it is still running, because the backups are full-image and the storage is throttled. The RTO claim collapses in real time. This is the CSCRF finding that recurs more than any other — not missing controls, but untested ones. SEBI's framework specifically calls for tested recovery, and testable is the operative word. A control you have never exercised is a hypothesis, not a safeguard.

The other question that lands hard is on log retention. CSCRF and CERT-In together expect logs — including for critical systems — to be retained and available, with CERT-In mandating a rolling 180-day retention within Indian jurisdiction. Auditors ask to see logs from a date five months ago. If your SIEM only holds 90 days hot and archives nothing, the finding writes itself.

Across CSCRF assessments the same five gaps account for most non-compliances. Fix these before your auditor arrives and you have handled the bulk of your exposure.

CSCRF carries data localisation expectations consistent with SEBI's broader stance: regulatory and transaction data, and the systems processing it, should reside in India. If your CRM, your email security, or your log analytics runs on infrastructure hosted abroad, that is a live question. It intersects with the DPDP Act, 2023, which governs personal data of your clients. CSCRF is a cyber framework; DPDP is a privacy law. They overlap on breach notification and on data handling, and a mature RE treats them as one programme rather than two silos.

The other overlooked piece is API security. Brokers and depository participants expose trading and account APIs, and CSCRF's Protect and Detect goals apply directly to them. Rate limiting, authentication, and monitoring of these interfaces is not optional; a compromised API on a broking platform is exactly the incident CERT-In wants reported within six hours.

Budgets vary enormously by RE category, but treating CSCRF as a one-off audit spend is the fastest way to overrun. It is an operating cost. Below is a realistic annual range for a mid-size to Qualified RE that does not already have a mature security function.

The instinct to compress this — skip the managed SOC, self-certify a higher CCI, defer the DR test — is understandable and almost always regretted. The cost of a SEBI observation is not the remediation; it is the enhanced monitoring, the repeat audit, and the reputational drag with your exchange. Spend the money once, correctly.

If you do nothing else this quarter, work through this list. It maps directly to the findings SEBI examiners raise most often, and every item produces an artefact you can hand over.

CSCRF is not asking whether you have controls. Every RE has a firewall and an antivirus and a policy PDF. It is asking whether those controls work under pressure, whether you can prove it on a timeline, and whether your recovery is real rather than aspirational. The framework's genius is that it made evidence the currency. The entities that struggle are not the insecure ones — they are the ones who never tested what they built.

Go back to that first panicked email forwarding the circular. The entities that handled CSCRF well treated it not as a deadline but as the moment to finally restore a backup, watch a SOC alert at midnight, and time their incident response. If your programme needs a hard, hands-on read before SEBI gives you one, our CERT-In empanelled auditors at CyberSigma do exactly this work — sitting in the room, scoring the CCI, and testing the controls that matter.