Meet SEBI CSCRF standards and stay ready for every cyber audit

SEBI CSCRF is the Cybersecurity and Cyber Resilience Framework issued by the Securities and Exchange Board of India on 20 August 2024 under circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113. It replaces SEBI's earlier cybersecurity circulars with one framework of 128 standards and supporting guidelines, organised under five cyber resilience goals and six cybersecurity functions, and applies to all SEBI-regulated entities.

All SEBI-regulated entities must comply with CSCRF. That includes stock exchanges, clearing corporations, depositories, stockbrokers, depository participants, mutual funds and AMCs, portfolio managers, AIFs, RTAs, KRAs, custodians, credit rating agencies, merchant bankers, investment advisers and research analysts. Each entity is placed in one of five categories, MII, Qualified, Mid-size, Small-size or Self-certification, and the standards that apply depend on that category.

For most regulated entities the CSCRF compliance deadline was 31 August 2025, after SEBI extended the original dates of 1 January 2025 and 1 April 2025 twice. The extensions did not cover Market Infrastructure Institutions, KYC Registration Agencies and Qualified RTAs, which had to meet the earlier timelines. Ongoing obligations such as periodic cyber audits, VAPT and policy reviews continue every year.

CSCRF compliance is assessed through a cyber audit carried out by a CERT-In empanelled IS auditing organisation. MIIs and Qualified REs are audited at least twice a year and most other REs at least once a year. Reports go to SEBI with a declaration from the MD or CEO. Self-certification REs only need a VAPT by a CERT-In empanelled auditor plus a signed self-certification.

Under CSCRF, cyber incidents covered by the CERT-In cybersecurity directions must be notified to SEBI and CERT-In within 6 hours of being noticed, with details then reported on SEBI's incident reporting portal within 24 hours. Stockbrokers and depository participants also report to the stock exchanges or depositories. Other incidents are reported to SEBI, CERT-In and NCIIPC, as applicable, within 24 hours.

CSCRF and ISO 27001 overlap heavily, since both cover risk management, access control, logging, supplier security, incident management and continuity. Under the CSCRF standards, MIIs must obtain ISO 27001 certification, while SEBI's August 2025 clarification made it recommended rather than mandatory for Qualified REs. An existing ISO 27001 programme gives a strong head start, but CSCRF adds India-specific rules such as CERT-In audits, SOC monitoring and data localisation.

Non-compliance with CSCRF is a breach of a SEBI circular issued under the SEBI Act, so SEBI can take regulatory action through its inspection and enforcement powers. Audit findings must be closed within set timelines, and open observations after three months need IT Committee approval. SEBI's June 2025 extension circular said no action would be taken during that extension if REs showed meaningful progress.

Yes. OneClickComply supports SEBI CSCRF today with a control set mapped to the framework's standards, automated evidence collection from more than 13,000 integrations, AutoComplete policy generation and continuous monitoring. Evidence collected once also counts towards ISO 27001 and other frameworks you hold. OneClickComply does not perform the CERT-In empanelled cyber audit itself, but it prepares the evidence your auditor needs.