SEBI CSCRF cyber security compliance audit

A SEBI cybersecurity compliance audit is a structured assessment that checks whether a SEBI-regulated entity — such as a stock broker, depository participant, mutual fund or market intermediary — meets the requirements set in SEBI's Cyber Security and Cyber Resilience Framework (CSCRF). The audit covers governance, asset management, access controls, incident response, third-party risk and business continuity, so you can identify, protect against, detect, respond to and recover from cyber threats.

SEBI's CSCRF applies to all SEBI-regulated entities (REs), including stock brokers, depository participants (DPs), depositories, stock exchanges, clearing corporations, mutual funds, asset management companies (AMCs), registrars and transfer agents (RTAs), KYC registration agencies (KRAs), portfolio managers and alternative investment funds (AIFs). SEBI tiers entities into Market Infrastructure Institutions (MIIs), Qualified REs, Mid-size REs, Small-size REs and Self-certification REs, each with its own compliance obligations.

SEBI released its unified Cyber Security and Cyber Resilience Framework (CSCRF) in August 2024 to consolidate and replace multiple earlier circulars issued between 2015 and 2023. The CSCRF takes a risk-based, tiered approach aligned to the NIST Cybersecurity Framework, introduces mandatory SOC (Security Operations Centre) requirements for larger entities and requires annual third-party audits. It is broader than the earlier directives and sets clearer timelines and accountability.

Yes. SEBI requires regulated entities to conduct a cybersecurity audit at least once a year. Larger entities classified as MIIs or Qualified REs may need to audit more frequently or on a continuous monitoring basis. You submit the audit report to your Market Infrastructure Institution (exchange, depository or clearing corporation) within SEBI's prescribed timelines, typically within six months of the financial year end.

A SEBI CSCRF audit covers five core functions: Identify (asset inventory, risk assessment, governance), Protect (access control, data security, awareness training, patch management), Detect (anomaly detection, SOC monitoring, log management), Respond (incident response plan, communication procedures) and Recover (business continuity plan, disaster recovery testing). It also covers third-party and vendor risk management, network security architecture review and compliance with SEBI's technology risk management guidelines.

The duration depends on your tier and complexity. For small-size or self-certification REs, the audit typically takes 2 to 4 weeks. For mid-size REs such as mid-tier stock brokers, it generally takes 3 to 6 weeks. For larger entities including MIIs and Qualified REs with complex IT environments, it can span 6 to 12 weeks. CyberSigma gives you a detailed project plan with milestones at the start, so you always know where you stand.

The main cost factors are your SEBI tier classification (MII, Qualified, Mid-size, Small-size or Self-certification), the number of IT systems, applications and data centres in scope, the complexity of your trading and back-office infrastructure, your geographic spread (single office, multi-branch or multi-country), the current maturity of your cybersecurity controls, and whether you need remediation support or a post-audit re-assessment. CyberSigma offers fixed-scope packages for smaller REs and tailored engagements for larger intermediaries — contact us for a quote.

Yes. CyberSigma is a CERT-In empanelled cybersecurity auditing firm, one of the credentials SEBI accepts for independent cybersecurity audits of regulated entities. Our audit team includes CISA, CISSP, CEH and ISO 27001 Lead Auditor certified professionals with hands-on experience auditing broking firms, AMCs and RTAs. We deliver reports in the format exchanges and depositories accept for SEBI submission.

You receive a detailed audit report mapped to SEBI CSCRF controls with findings, risk ratings and evidence; an executive summary for board and senior management review; a gap analysis with a prioritised remediation roadmap; a compliance status matrix showing which CSCRF requirements are met, partially met or not met; and an auditor's declaration letter for submission to SEBI or your market infrastructure institution. CyberSigma also gives you a management response template to speed up submission.

There is no binary pass-or-fail result. The audit produces a compliance status and risk rating for each control area. Non-compliant findings are documented with risk levels (critical, high, medium, low) and recommended remediation steps. SEBI expects you to acknowledge findings and submit a time-bound corrective action plan. Entities with significant gaps may face regulatory scrutiny, enhanced supervision or penalties. CyberSigma supports you through remediation and can run a follow-up re-assessment to confirm the gaps are closed before you submit your compliance report.

CyberSigma offers an end-to-end service: a pre-audit readiness assessment to find gaps before the formal audit begins, policy and procedure drafting aligned to CSCRF requirements, SOC setup advisory for entities that must establish a Security Operations Centre, technical control testing (VAPT, configuration reviews, log management review), incident response plan development, business continuity and disaster recovery plan review, staff awareness training, and the formal independent audit with report and submission support. You engage one firm across the whole cycle rather than managing multiple vendors.

CyberSigma serves SEBI-regulated entities across India from offices in major financial hubs. We conduct on-site assessments in Mumbai, Delhi NCR, Bengaluru, Chennai, Hyderabad, Pune, Kolkata, Ahmedabad and other cities, and remote assessments for entities in smaller locations. We also serve Indian-origin entities operating in the UAE from our Dubai presence. Contact us at tech@cybersigmacs.com to discuss your location and engagement model.