SEBI CSCRF: Cybersecurity Rules for Brokers, Funds and Market Entities

The SEBI CSCRF, the Cybersecurity and Cyber Resilience Framework issued by the Securities and Exchange Board of India on 20 August 2024, replaced a patchwork of separate cyber circulars for different market participants with one framework. It covers stock exchanges, depositories, brokers, mutual funds, portfolio managers, investment advisers and other SEBI-regulated entities, and scales requirements to each entity's size and importance to the market.

The framework is built around the familiar identify, protect, detect, respond and recover structure, with Indian specifics: a mandatory CISO, regular VAPT and cyber audits, a Cyber Capability Index, a market-wide security operations centre for smaller entities, recovery of critical systems within two hours, and cloud use with encryption keys held in India. SEBI has issued clarifications and FAQs since 2024. This guide explains the categories, core requirements, audits and what technology vendors need to deliver.

What is the SEBI CSCRF?

Before 2024, SEBI had issued separate cybersecurity circulars for market infrastructure institutions, brokers, depository participants, mutual funds and others, with different requirements and timelines. The CSCRF consolidated these into one framework that applies to all SEBI-regulated entities (REs), aligned with international practice such as the NIST Cybersecurity Framework and IOSCO principles for financial market infrastructures.

It has two main objectives: cybersecurity, meaning protection against threats, and cyber resilience, meaning the ability to anticipate, withstand, contain and recover from incidents. It works with SEBI's separate Framework for Adoption of Cloud Services by SEBI REs (March 2023), and SEBI answers common questions on both in published FAQs.

Who must comply?

The framework applies to SEBI-regulated entities, which it groups into five categories:

Category	Typical entities
Market Infrastructure Institutions (MIIs)	Stock exchanges, clearing corporations, depositories.
Qualified REs	Large brokers, AMCs and other entities above size thresholds.
Mid-size REs	Medium entities between the thresholds.
Small-size REs	Smaller entities above the self-certification level.
Self-certification REs	The smallest entities, such as many investment advisers and research analysts.

Thresholds differ by entity type and use measures such as assets under management, client numbers, trading volumes or collateral with clearing corporations. SEBI revised the stock broker thresholds in a clarification circular dated 30 April 2025; for proprietary trading members, for example, the FAQs set categories by the amount of collateral with clearing corporations. An entity's category is fixed at the start of each financial year based on the previous year's data.

Is it mandatory or voluntary?

Mandatory for SEBI-regulated entities. Compliance is monitored through cyber audit reports, VAPT reports, Cyber Capability Index scores and incident reports, submitted to SEBI or to the stock exchange or depository that supervises the entity. Non-compliance can lead to supervisory action under SEBI regulations. There is no certification.

Governance and the CISO

• Board-approved cybersecurity and cyber resilience policy, reviewed periodically.
• A mandatory CISO with appropriate level, grade and standing. The FAQs allow a group-level CISO to act for several group entities and allow remote CISOs dedicated to the entity, but do not allow part-time CISOs shared with unrelated organisations.
• A technology committee or equivalent oversight for larger entities, and risk management that covers cyber risk.
• Roles and responsibilities documented across management, IT, security and business.
• Third-party and supply chain risk management, including software bills of materials for critical systems at larger entities.

Core standards by function

• Identify: asset inventory, classification of critical systems, risk assessment, and data classification.
• Protect: access control with MFA, privileged access management, network segmentation, encryption, secure configuration, patch management, application security, data leak prevention, and security awareness training.
• Detect: continuous monitoring through a security operations centre, log collection and retention, and anomaly detection.
• Respond: incident response plans, classification of incidents by severity, reporting to SEBI and CERT-In, and forensic investigation for high and critical incidents.
• Recover: recovery plans, backups, golden images, drills and post-incident improvement.

Software supply chain and third parties

Many incidents in financial markets start with a vendor: a compromised software update, an exposed API at a service provider, or weak access by an outsourced support team. The framework therefore expects entities to assess and monitor third-party risk, include security requirements in contracts, restrict and log vendor access, and, for critical systems at larger entities, obtain software bills of materials so they can respond quickly when a vulnerable component is disclosed. Entities should also confirm that vendors patch known vulnerabilities promptly, follow secure development practices, and allow security testing of delivered software. These expectations apply to cloud providers, trading platform vendors, KYC providers and any other supplier with access to systems in SEBI's purview.

Security operations: SOC and Market SOC

Larger entities must run or subscribe to a security operations centre that monitors their systems continuously, and must measure SOC efficacy. Because many small brokers and advisers cannot run their own SOC, the framework provides for a Market SOC (M-SOC) operated by market infrastructure institutions, which smaller entities can use. Whatever the model, logs must be collected and retained, alerts reviewed, and incidents escalated quickly.

VAPT and cyber audits

The framework sets VAPT and cyber audit frequencies by category, with more frequent testing for MIIs and Qualified REs. According to SEBI's FAQs, Qualified Stock Brokers must conduct VAPT and cyber audits half-yearly regardless of their CSCRF category, and vulnerabilities found during VAPT should be closed within three months of the VAPT report, with closure validated. Audits must be performed by CERT-In empanelled auditors or as the framework specifies, and audit coverage extends to systems connected to those in SEBI's purview. Entities had flexibility on the first audit periods during transition, as set out in the April 2025 clarifications.

Cyber Capability Index

The Cyber Capability Index (CCI) is a scoring model with weighted parameters, such as patching performance, vulnerability closure, training coverage and SOC effectiveness, that measures an entity's cyber resilience. MIIs assess their CCI half-yearly, and Qualified REs self-assess yearly. Scores feed into supervisory attention and help entities track improvement.

Incident handling, recovery time and forensics

Entities must classify cybersecurity incidents by severity, report them to SEBI and CERT-In within the required timelines, and investigate root causes. For incidents classified as high or critical, a forensic audit or investigation report by a third-party auditor is required; for low and medium incidents, a forensic report is required if the root cause analysis is inconclusive or SEBI directs it. In practice, entities report incidents to SEBI by email within six hours of detection and file on SEBI's cyber incident reporting portal within 24 hours, alongside CERT-In's own six-hour requirement. By a circular dated 24 August 2026, SEBI aligned its portal with the Format for Incident Reporting Exchange (FIRE) developed by the Financial Stability Board, allowing staged reports from initial notification through updates to closure. Published summaries indicate the existing timelines continue.

For recovery, if one or more critical systems are disrupted, the entity must declare a disaster within 30 minutes based on its business impact analysis, and the framework sets a recovery time objective of two hours for resumption of critical operations, in line with IOSCO guidance, and a recovery point objective of 15 minutes. MIIs and Qualified REs must also maintain regularly updated golden images of critical systems and spare hardware in an isolated environment, though the FAQs accept cloud-based high availability as an alternative to physical spares where all cloud requirements are met.

Cloud adoption and data sovereignty

SEBI's Framework for Adoption of Cloud Services by SEBI REs works with the CSCRF. Key points include using cloud providers empanelled by MeitY, keeping regulated data in India, a full understanding of shared responsibility, audit rights over the provider, and exit plans. The FAQs state that encryption keys and key management operations must be handled within India, so routing key management requests through another country may breach SEBI's expectations, and they encourage bring-your-own-key solutions. SEBI also noted that it was consulting on detailed data localisation guidelines.

How regulated entities comply, step by step

1. Determine your category for the financial year from the previous year's data.
2. Appoint a CISO and approve the cyber policy.
3. Inventory assets and classify critical systems.
4. Gap-assess controls against the standards for your category.
5. Set up or subscribe to a SOC, or join the Market SOC.
6. Schedule VAPT and cyber audits at the required frequency, with closure tracking.
7. Calculate the Cyber Capability Index where applicable.
8. Design recovery for a two-hour RTO and 15-minute RPO and test it in drills.
9. Review cloud and vendor arrangements for data location, key management and audit rights.
10. Prepare incident reporting and forensic arrangements.

What vendors must deliver

Trading platforms, back-office systems, mutual fund software, KYC and onboarding tools, and investor apps are usually provided or built by technology vendors. SEBI-regulated clients will expect vendors to:

• Host data in India with keys managed in India.
• Support MFA, role-based access and detailed audit logs.
• Provide security testing evidence and fix VAPT findings within the client's timelines.
• Provide software bills of materials for critical software.
• Send logs to the client's SOC or support Market SOC integration.
• Design for failover that meets a two-hour RTO and 15-minute RPO.
• Report incidents quickly enough for the client to meet SEBI and CERT-In deadlines.
• Accept audits by the client, its auditors and SEBI.

Documentation you will need

• Board-approved cyber policy and CISO appointment.
• Asset inventory and critical system list.
• Risk assessments and control mapping to CSCRF standards.
• SOC reports and efficacy measures.
• VAPT reports and closure evidence.
• Cyber audit reports and compliance submissions.
• Cyber Capability Index assessments.
• Incident reports, root cause analyses and forensic reports.
• Recovery plans and drill results.
• Cloud and vendor contracts and assessments.

Timeline and cost considerations

SEBI phased implementation through 2025 with extensions and clarifications, and the framework is now in effect, with periodic audits running. Costs scale with category: MIIs and Qualified REs need in-house SOCs, frequent testing and extensive recovery infrastructure, while small entities can rely on the Market SOC and simpler controls. Vendors that build to these requirements from the start help clients avoid costly retrofits.

Common mistakes

• Using the wrong category or not recalculating it each year.
• Part-time or shared CISOs not permitted by the FAQs.
• VAPT findings left open beyond three months.
• Cloud key management outside India.
• Recovery plans that cannot meet two hours in a real drill.
• Audits that exclude connected systems.

Best practices, tools and technologies

• Map CSCRF standards to NIST CSF and ISO/IEC 27001 controls to reuse evidence.
• Use infrastructure as code and automated failover to meet the two-hour RTO.
• Use customer-managed keys in Indian cloud regions.
• Automate vulnerability tracking with SLA dashboards.
• Run tabletop and live drills that include vendors.

We build trading, investment and onboarding software with MFA, audit logs, secure APIs and tested failover through our web application, API integration and maintenance and support services.

How CSCRF relates to other frameworks

Framework	Relationship
RBI cybersecurity directions	Equivalent framework for banks and NBFCs; entities regulated by both must meet both.
CERT-In Directions	National incident reporting and log retention rules.
IRDAI cyber guidelines	Equivalent framework for insurers.
NIST CSF	Structure CSCRF is aligned with.
DPDP Act	Personal data duties for investor data.

Real-world example

A mid-size stock broker uses an Indian fintech vendor for its mobile trading app and back office. The broker joins the Market SOC, and the vendor forwards application and authentication logs to it. The vendor hosts in two Indian cloud regions with customer-managed keys, supports half-yearly VAPT by the broker's CERT-In empanelled auditor, closes findings within agreed timelines, provides an SBOM for each release, and demonstrates failover within two hours in the broker's annual drill.

Next steps

1. Confirm your category for this financial year.
2. Check CISO and governance arrangements against the FAQs.
3. Close open VAPT findings.
4. Test recovery against the two-hour RTO.
5. Review cloud key management and vendor contracts.

Frequently asked questions

What is SEBI CSCRF?

SEBI's Cybersecurity and Cyber Resilience Framework, issued on 20 August 2024, setting cyber requirements for all SEBI-regulated entities.

Who does CSCRF apply to?

Stock exchanges, clearing corporations, depositories, brokers, depository participants, AMCs, portfolio managers, investment advisers, research analysts and other SEBI-regulated entities.

What are the CSCRF categories?

Market Infrastructure Institutions, Qualified REs, Mid-size REs, Small-size REs and Self-certification REs.

Is a CISO mandatory under CSCRF?

Yes. Group-level and dedicated remote CISOs are allowed, but part-time CISOs shared with other organisations are not.

What RTO and RPO does CSCRF require?

A two-hour RTO for critical operations and a 15-minute RPO, with a disaster declared within 30 minutes of disruption.

What is the Market SOC?

A security operations centre run by market infrastructure institutions that smaller regulated entities can use.

How often must VAPT be done?

It depends on category; Qualified Stock Brokers must do VAPT and cyber audits half-yearly.

Can SEBI-regulated entities use the cloud?

Yes, under SEBI's cloud framework, with data in India, MeitY-empanelled providers and encryption keys managed in India.

What is the Cyber Capability Index?

A weighted scoring model of cyber resilience, assessed half-yearly by MIIs and yearly by Qualified REs.

When is a forensic audit required?

For high and critical incidents, and for others if root cause analysis is inconclusive or SEBI directs it.

Does CSCRF apply to software vendors?

Indirectly, through the regulated entities' third-party and outsourcing controls and contracts.

How quickly must incidents be reported to SEBI?

By email within six hours of detection and on SEBI's incident reporting portal within 24 hours, with CERT-In also notified within six hours.

Can an entity's category change?

Yes. The category is set at the start of each financial year based on the previous year's data, so growing entities should check it every April.