SEBI CSCRF compliance now binds every entity in the Indian securities market, at a standard set by which category it falls into. This guide explains who is covered, the core obligations, and how a regulated entity can meet them without a large security team.
TL;DR
SEBI CSCRF compliance is governed by SEBI’s Cybersecurity and Cyber Resilience Framework, which replaced a patchwork of older circulars with one standard for the whole securities market. It applies to every regulated entity, tiered across five categories re-fixed each April. The core obligations are governance, a Security Operations Centre, VAPT, six-hour incident reporting to SEBI, an annual CERT-In empanelled audit, and controls like data classification and API security. The principal deadline has passed, so the live duty is now the recurring audit-and-reporting cycle.
On this page
What SEBI CSCRF compliance is
SEBI CSCRF compliance means meeting the Cybersecurity and Cyber Resilience Framework that the Securities and Exchange Board of India introduced to cover the entire securities market. Before it, cyber rules were scattered across separate circulars, one for stock brokers, one for portfolio managers, one for KYC registration agencies, and more. CSCRF consolidated them into a single, standardised framework aligned to recognised standards like ISO 27000, CIS, and NIST, and organised around cyber-resilience goals: govern, identify, protect, detect, respond, and recover. In short, SEBI CSCRF compliance turns a fragmented set of obligations into one coherent, board-level programme.
The five categories that decide your standard
The first thing to understand is that the framework is proportionate, not uniform. Every regulated entity is in scope, but the standard depends on which of five categories it occupies, and the category is decided at the start of each financial year using the previous year’s data.
At the top are Market Infrastructure Institutions, the exchanges, depositories, and clearing corporations, which carry the heaviest obligations. Below them sit Qualified regulated entities, then Mid-size, Small-size, and a Self-certification tier for the smallest entities in scope. Some very small entities are exempt entirely, for example stock brokers below both a client-count and a trading-volume threshold. Because the category is re-fixed each April, an entity that grows across a threshold inherits a heavier standard the next year, so compliance planning has to look ahead, not just at today’s tier.
The core obligations of SEBI CSCRF compliance
While depth scales with category, a common set of controls runs through the framework. These are the pillars most regulated entities have to address in some form.
In practice that means board-level governance with a cyber committee, a Security Operations Centre or Market-SOC with measured efficacy, a vulnerability assessment and penetration testing programme across critical systems, incident reporting to SEBI within six hours, an annual audit by a CERT-In empanelled organisation, and supporting controls including data classification and localisation, API security, and a Software Bill of Materials. A structured VAPT programme is usually the quickest way to evidence the testing pillar.
The audit and reporting cycle
With the principal implementation deadline now passed, the live duty is the recurring cyber-audit cycle, and this is where compliance is proven year after year.
Audits must be conducted by CERT-In empanelled information-security auditing organisations, not just any firm, and they run after the end of each audit period, annually for most regulated entities and half-yearly for Qualified Stock Brokers. The scope must cover all critical systems and a sample of non-critical ones, and the findings, management responses, and remediation timelines are submitted to SEBI through the prescribed channel. Handling this cycle cleanly, with evidence, is the ongoing substance of the framework. The dynamic mirrors what vendors face preparing for a SOC 2 audit, where evidence and remediation matter as much as the controls themselves.
Multi-regulated entities
A useful clarification helps entities regulated by more than one body, such as an NBFC that is also a stock broker. SEBI introduced a Principle of Exclusivity and Equivalence: where another regulator’s framework is equivalent, compliance with it may be deemed to satisfy the corresponding CSCRF requirement, avoiding duplicate work. This makes compliance more workable for firms already meeting a comparable standard under another regulator, though the equivalence has to be genuine and demonstrable.
The lean-team path to SEBI CSCRF compliance
Meeting all of this, governance, a SOC, VAPT, six-hour-ready incident reporting, data and API controls, and audit-ready evidence, is a heavy lift for a regulated entity without a large security function. Assembling it from separate tools and consultants is slow and hard to keep current. The efficient path is a single platform that runs the security work and organises the evidence together.
Meet SEBI CSCRF compliance without a big team.
Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean financial teams. Run VAPT, stand up monitoring, secure your data and APIs, and keep audit-ready evidence, on one platform. No security team required.
Book a Demo →Frequently asked questions
What is SEBI CSCRF compliance?
It is meeting SEBI’s Cybersecurity and Cyber Resilience Framework, which consolidated older cyber circulars into one standard for the whole securities market. It applies to every regulated entity, at a level set by which of five categories it falls into.
Who has to comply with CSCRF?
Every SEBI regulated entity in the securities market, from Market Infrastructure Institutions down to the smallest self-certification tier, across around twenty-two entity types. Some very small entities, such as stock brokers below both a client and volume threshold, are exempt.
How are CSCRF categories decided?
SEBI fixes each entity’s category at the start of the financial year based on the previous year’s data, and it stays fixed for that year. If you grow across a threshold, you move to a heavier category the following April.
What is the CSCRF incident reporting timeline?
Regulated entities must report cyber incidents to the SEBI incident reporting portal within six hours of detection, in line with CERT-In expectations. The clock runs from detection, so fast monitoring is essential.
Who can conduct a CSCRF audit?
Only a CERT-In empanelled information-security auditing organisation. Audits run after each audit period, annually for most entities and half-yearly for Qualified Stock Brokers, and must cover all critical systems and a sample of non-critical ones.
What if my firm is regulated by both SEBI and RBI?
SEBI’s Principle of Exclusivity and Equivalence allows a genuinely equivalent framework under another regulator to be deemed to satisfy the corresponding CSCRF requirement, which reduces duplicate work for multi-regulated entities such as an NBFC-cum-broker.
