{"id":1255,"date":"2026-09-14T12:19:11","date_gmt":"2026-09-14T12:19:11","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1255"},"modified":"2026-09-14T12:20:41","modified_gmt":"2026-09-14T12:20:41","slug":"sebi-cscrf-compliance","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/sebi-cscrf-compliance\/","title":{"rendered":"SEBI CSCRF Compliance: A Complete Guide for Regulated Entities"},"content":{"rendered":"\n\n\n\n\n\n\n\n<style>\n  :root{\n    --ink:#0e1330;\n    --brand:#1c267a;\n    --brand-2:#3a46c0;\n    --accent:#00c2a8;\n    --accent-soft:#e6f7f4;\n    --paper:#ffffff;\n    --mist:#f4f6fb;\n    --line:#e3e7f2;\n    --muted:#5a6284;\n    --danger:#e2564d;\n    --radius:16px;\n    --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n    --maxw:860px;\n  }\n  *{box-sizing:border-box}\n  html{scroll-behavior:smooth}\n  body{\n    margin:0;\n    font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n    color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n  }\n  a{color:var(--brand-2);text-decoration:none}\n  a:hover{text-decoration:underline}\n\n  .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n  .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n  .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n  .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n  .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n  .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n  .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n  .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n  .breadcrumb a{color:var(--muted)}\n  .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n  h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n  .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n  .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n  .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n  .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n  .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n  .tldr p{margin:0 0 10px;font-size:16.5px}\n  .tldr p:last-child{margin:0}\n\n  h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n  h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n  p{margin:0 0 16px;font-size:16.5px}\n  .lead-in{color:var(--muted)}\n  em{font-style:italic}\n\n  .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n  .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n  .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n  .jump li{margin:6px 0;font-size:15px}\n  @media(max-width:560px){.jump ol{columns:1}}\n\n  .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n  .analogy strong{color:var(--brand)}\n\n  ul.clean{padding-left:0;list-style:none;margin:16px 0}\n  ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n  ul.clean li:last-child{border-bottom:none}\n  ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n  ul.warn li::before{background:var(--danger)}\n\n  \/* TSC cards *\/\n  .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n  .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n  .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n  .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n  .tsc-card.req .tag{color:var(--brand)}\n  .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n  .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n  @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n  @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n  \/* stat band *\/\n  .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n  .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n  .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n  .fig-head .src{font-size:11.5px;color:#b9c0f0}\n  .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n  .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n  .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n  .stat-cell:last-child{border-right:none}\n  .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n  .stat-cell .num.accent{color:var(--accent)}\n  .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n  @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n  \/* timeline *\/\n  .timeline{padding:8px 24px 4px}\n  .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n  .tl-item:last-child{border-bottom:none}\n  .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n  .tl-what{font-size:14.5px}\n  .tl-what b{display:block;margin-bottom:2px}\n  @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n  .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n  table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n  thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n  thead th.osto{background:var(--brand);color:#fff}\n  tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n  tbody tr:last-child td{border-bottom:none}\n  tbody td:first-child{font-weight:600;color:var(--ink)}\n  td.osto{background:#f6f8ff;font-weight:600}\n  .yes{color:var(--accent);font-weight:700}\n  .no{color:var(--danger);font-weight:700}\n\n  .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n  .callout h3{margin:0 0 8px;color:#fff}\n  .callout p{color:#cfd4f5;margin:0 0 18px}\n  .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n  .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n  .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n  .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n  details{border-bottom:1px solid var(--line);padding:6px 0}\n  summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n  summary::-webkit-details-marker{display:none}\n  summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n  details[open] summary::after{content:\"\u2013\"}\n  details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n  footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n  .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n  .foot-inner .logo{font-size:17px}\n\n  .related{margin:42px 0 0}\n  .related h3{margin-bottom:14px}\n  .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n  .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n  .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n  .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n  @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n  \/* --- bright, clean additions --- *\/\n  .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n  .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n  .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n  .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n  .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n  .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n  .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n  @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n  .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n  .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n  .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n  .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n  .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n  .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n  .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n  .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n  @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n  .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n  .keyrow>div{padding:20px 22px}\n  .keyrow .k1{background:#eef0ff}\n  .keyrow .k2{background:var(--accent-soft)}\n  .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n  .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n  .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n  .keyrow .sm{font-size:13.5px;color:var(--muted)}\n  @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n  .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n  .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n  .flow .step .t{font-weight:800;font-size:14px}\n  .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n  .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n  .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n  .bbox strong{color:var(--brand)}\n  .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n  .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n  .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n  .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n  .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n  .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n  .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n  .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n  .checkarea ul{margin:0;padding:0;list-style:none}\n  .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n  .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n  @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n  .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n  .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n  .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n  .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n  .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n  .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n  @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n  .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n  .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n  .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n  .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n  \/* Osto branded comparison table *\/\n  .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n  table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n  table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n  table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n  table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n  table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n  table.regtable tr:last-child td{border-bottom:none}\n  table.regtable td:first-child{font-weight:700;color:#0e1330}\n  table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n  table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n  table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n\n\n<div class=\"wrap\">\n  <p class=\"dek\">SEBI CSCRF compliance now binds every entity in the Indian securities market, at a standard set by which category it falls into. This guide explains who is covered, the core obligations, and how a regulated entity can meet them without a large security team.<\/p>\n\n  <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>11 min read<\/span><span class=\"dot\"><\/span><span>SEBI Compliance<\/span><\/div>\n\n  <div class=\"tldr\">\n    <h2>TL;DR<\/h2>\n    <p>SEBI CSCRF compliance is governed by SEBI&#8217;s Cybersecurity and Cyber Resilience Framework, which replaced a patchwork of older circulars with one standard for the whole securities market. It applies to every regulated entity, tiered across five categories re-fixed each April. The core obligations are governance, a Security Operations Centre, VAPT, six-hour incident reporting to SEBI, an annual CERT-In empanelled audit, and controls like data classification and API security. The principal deadline has passed, so the live duty is now the recurring audit-and-reporting cycle.<\/p>\n  <\/div>\n\n  <div class=\"jump\">\n    <h4>On this page<\/h4>\n    <ol>\n      <li><a href=\"#what\">What CSCRF is<\/a><\/li>\n      <li><a href=\"#categories\">The five categories<\/a><\/li>\n      <li><a href=\"#obligations\">The core obligations<\/a><\/li>\n      <li><a href=\"#audit\">The audit cycle<\/a><\/li>\n      <li><a href=\"#multi\">Multi-regulated entities<\/a><\/li>\n      <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n    <\/ol>\n  <\/div>\n\n  <h2 class=\"sec\" id=\"what\">What SEBI CSCRF compliance is<\/h2>\n  <p>SEBI CSCRF compliance means meeting the Cybersecurity and Cyber Resilience Framework that the <a href=\"https:\/\/www.sebi.gov.in\/\" target=\"_blank\" rel=\"noopener\">Securities and Exchange Board of India<\/a> introduced to cover the entire securities market. Before it, cyber rules were scattered across separate circulars, one for stock brokers, one for portfolio managers, one for KYC registration agencies, and more. CSCRF consolidated them into a single, standardised framework aligned to recognised standards like ISO 27000, CIS, and NIST, and organised around cyber-resilience goals: govern, identify, protect, detect, respond, and recover. In short, SEBI CSCRF compliance turns a fragmented set of obligations into one coherent, board-level programme.<\/p>\n\n  <h2 class=\"sec\" id=\"categories\">The five categories that decide your standard<\/h2>\n  <p>The first thing to understand is that the framework is proportionate, not uniform. Every regulated entity is in scope, but the standard depends on which of five categories it occupies, and the category is decided at the start of each financial year using the previous year&#8217;s data.<\/p>\n\n  <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n  <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Who is covered<\/div>\n  <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Five categories, different standards<\/div>\n  <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">CSCRF is not one uniform bar. Every regulated entity in the securities market is covered, but the standard it must meet depends on which of five categories it falls into, and that category is re-fixed each April on the prior year data.<\/div>\n  <svg viewBox=\"0 0 800 240\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The five SEBI CSCRF categories of regulated entities\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"30\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Your category sets your obligations<\/text>\n <text x=\"400\" y=\"52\" text-anchor=\"middle\" fill=\"#8a90a6\" font-size=\"11.5\">Five tiers, re-fixed each April on the prior year&#8217;s data<\/text>\n <rect x=\"16\" y=\"70\" width=\"150\" height=\"150\" rx=\"14\" fill=\"#1c267a\"\/>\n <text x=\"30\" y=\"100\" fill=\"#fff\" font-size=\"12.5\" font-weight=\"800\">MIIs<\/text>\n <text x=\"30\" y=\"120\" fill=\"#c3c9ee\" font-size=\"10\">Exchanges,<\/text><text x=\"30\" y=\"134\" fill=\"#c3c9ee\" font-size=\"10\">depositories,<\/text><text x=\"30\" y=\"148\" fill=\"#c3c9ee\" font-size=\"10\">clearing corps<\/text>\n <text x=\"30\" y=\"176\" fill=\"#8fa0e8\" font-size=\"10\">Heaviest<\/text><text x=\"30\" y=\"190\" fill=\"#8fa0e8\" font-size=\"10\">obligations<\/text>\n <rect x=\"176\" y=\"70\" width=\"150\" height=\"150\" rx=\"14\" fill=\"#26308f\"\/>\n <text x=\"190\" y=\"100\" fill=\"#fff\" font-size=\"12.5\" font-weight=\"800\">Qualified REs<\/text>\n <text x=\"190\" y=\"120\" fill=\"#c3c9ee\" font-size=\"10\">Large brokers,<\/text><text x=\"190\" y=\"134\" fill=\"#c3c9ee\" font-size=\"10\">KRAs, big<\/text><text x=\"190\" y=\"148\" fill=\"#c3c9ee\" font-size=\"10\">AMCs<\/text>\n <text x=\"190\" y=\"176\" fill=\"#8fa0e8\" font-size=\"10\">SOC, ISO 27001,<\/text><text x=\"190\" y=\"190\" fill=\"#8fa0e8\" font-size=\"10\">HSM<\/text>\n <rect x=\"336\" y=\"70\" width=\"150\" height=\"150\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.4\"\/>\n <text x=\"350\" y=\"100\" fill=\"#1c267a\" font-size=\"12.5\" font-weight=\"800\">Mid-size<\/text>\n <text x=\"350\" y=\"120\" fill=\"#5b6178\" font-size=\"10\">Mid-tier by<\/text><text x=\"350\" y=\"134\" fill=\"#5b6178\" font-size=\"10\">AUM, clients,<\/text><text x=\"350\" y=\"148\" fill=\"#5b6178\" font-size=\"10\">or volume<\/text>\n <text x=\"350\" y=\"176\" fill=\"#2b3596\" font-size=\"10\">Core controls<\/text><text x=\"350\" y=\"190\" fill=\"#2b3596\" font-size=\"10\">and audit<\/text>\n <rect x=\"496\" y=\"70\" width=\"150\" height=\"150\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.4\"\/>\n <text x=\"510\" y=\"100\" fill=\"#1c267a\" font-size=\"12.5\" font-weight=\"800\">Small-size<\/text>\n <text x=\"510\" y=\"120\" fill=\"#5b6178\" font-size=\"10\">Smaller REs<\/text><text x=\"510\" y=\"134\" fill=\"#5b6178\" font-size=\"10\">above the<\/text><text x=\"510\" y=\"148\" fill=\"#5b6178\" font-size=\"10\">exempt line<\/text>\n <text x=\"510\" y=\"176\" fill=\"#2b3596\" font-size=\"10\">Lighter but<\/text><text x=\"510\" y=\"190\" fill=\"#2b3596\" font-size=\"10\">real duties<\/text>\n <rect x=\"656\" y=\"70\" width=\"128\" height=\"150\" rx=\"14\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.4\"\/>\n <text x=\"670\" y=\"100\" fill=\"#0a6558\" font-size=\"12.5\" font-weight=\"800\">Self-cert<\/text>\n <text x=\"670\" y=\"120\" fill=\"#5b6178\" font-size=\"10\">Smallest REs<\/text><text x=\"670\" y=\"134\" fill=\"#5b6178\" font-size=\"10\">in scope<\/text>\n <text x=\"670\" y=\"176\" fill=\"#0a6558\" font-size=\"10\">Self-<\/text><text x=\"670\" y=\"190\" fill=\"#0a6558\" font-size=\"10\">certification<\/text>\n<\/g><\/svg>\n  \n<\/div>\n\n  <p>At the top are Market Infrastructure Institutions, the exchanges, depositories, and clearing corporations, which carry the heaviest obligations. Below them sit Qualified regulated entities, then Mid-size, Small-size, and a Self-certification tier for the smallest entities in scope. Some very small entities are exempt entirely, for example stock brokers below both a client-count and a trading-volume threshold. Because the category is re-fixed each April, an entity that grows across a threshold inherits a heavier standard the next year, so compliance planning has to look ahead, not just at today&#8217;s tier.<\/p>\n\n  <div class=\"bbox teal\"><div class=\"bt\">Your category has an expiry date<\/div>The category is fixed for the financial year, then re-assessed each April on the prior year&#8217;s numbers. A plan built on this year&#8217;s category has a scheduled expiry, cross a threshold and next April&#8217;s standard steps up. Build for where you are heading, not only where you are.<\/div>\n\n  <h2 class=\"sec\" id=\"obligations\">The core obligations of SEBI CSCRF compliance<\/h2>\n  <p>While depth scales with category, a common set of controls runs through the framework. These are the pillars most regulated entities have to address in some form.<\/p>\n\n  <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n  <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The obligations<\/div>\n  <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What the framework asks of you<\/div>\n  <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Depth varies by category, but a recognisable core runs through the framework. These are the obligations most regulated entities have to meet in some form to comply.<\/div>\n  <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core SEBI CSCRF compliance obligations\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core CSCRF obligations<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"4\" width=\"18\" height=\"13\" rx=\"2\"\/><path d=\"M8 21h8M12 17v4\"\/><path d=\"M7 12l2.5-3 2 2L15 8\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Governance<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Cyber committee and board<\/text><text x=\"136\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">oversight<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"4\" width=\"18\" height=\"14\" rx=\"2\"\/><path d=\"M6 14l3-4 2 2 3-5 4 7\"\/><path d=\"M8 21h8\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">SOC \/ Market-SOC<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Monitoring with measured<\/text><text x=\"394\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">efficacy<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"7\"\/><path d=\"M12 2v4M12 18v4M2 12h4M18 12h4\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">VAPT<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Testing across critical systems<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Six-hour reporting<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Incidents to the SEBI portal<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">CERT-In audit<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Empanelled auditor, annual cycle<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M8 8l-4 4 4 4M16 8l4 4-4 4M13 6l-2 12\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Data and API security<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Classification, localisation,<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">SBOM<\/text><\/svg>\n  \n<\/div>\n\n  <p>In practice that means board-level governance with a cyber committee, a Security Operations Centre or Market-SOC with measured efficacy, a vulnerability assessment and penetration testing programme across critical systems, incident reporting to SEBI within six hours, an annual audit by a CERT-In empanelled organisation, and supporting controls including data classification and localisation, API security, and a Software Bill of Materials. A structured <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">VAPT programme<\/a> is usually the quickest way to evidence the testing pillar.<\/p>\n\n  <div class=\"bbox indigo\"><div class=\"bt\">Cyber resilience, not just cyber security<\/div>The second C in CSCRF is resilience. SEBI does not only ask whether you can prevent an incident, but whether you can detect, respond to, and recover from one. That is why monitoring, incident reporting, and tested recovery sit at the centre of the framework alongside preventive controls.<\/div>\n\n  <h2 class=\"sec\" id=\"audit\">The audit and reporting cycle<\/h2>\n  <p>With the principal implementation deadline now passed, the live duty is the recurring cyber-audit cycle, and this is where compliance is proven year after year.<\/p>\n\n  <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n  <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Audit and reporting<\/div>\n  <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">A recurring cycle, not a one-off<\/div>\n  <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The live obligation now is the recurring audit-and-reporting cycle. Audits must be done by CERT-In empanelled organisations and submitted to SEBI, which is where compliance is proven year after year.<\/div>\n  <svg viewBox=\"0 0 800 172\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The SEBI CSCRF cyber-audit and reporting cycle\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">The recurring cyber-audit cycle<\/text>\n <line x1=\"110\" y1=\"104\" x2=\"690\" y2=\"104\" stroke=\"#d7dcf2\" stroke-width=\"3\"\/>\n <circle cx=\"170\" cy=\"104\" r=\"12\" fill=\"#1c267a\"\/><circle cx=\"400\" cy=\"104\" r=\"12\" fill=\"#3a46c0\"\/><circle cx=\"630\" cy=\"104\" r=\"12\" fill=\"#0a7d6c\"\/>\n <g text-anchor=\"middle\" font-size=\"13\" font-weight=\"800\" fill=\"#0e1330\">\n  <text x=\"170\" y=\"72\">Audit period<\/text><text x=\"170\" y=\"88\">ends<\/text>\n  <text x=\"400\" y=\"72\">CERT-In empanelled<\/text><text x=\"400\" y=\"88\">audit<\/text>\n  <text x=\"630\" y=\"72\">Report to SEBI<\/text><text x=\"630\" y=\"88\">with action taken<\/text>\n <\/g>\n <g text-anchor=\"middle\" font-size=\"11\" fill=\"#5b6178\">\n  <text x=\"170\" y=\"134\">Annual for most,<\/text><text x=\"170\" y=\"150\">half-yearly for QSBs<\/text>\n  <text x=\"400\" y=\"134\">100% of critical systems,<\/text><text x=\"400\" y=\"150\">25% of non-critical<\/text>\n  <text x=\"630\" y=\"134\">Findings, responses,<\/text><text x=\"630\" y=\"150\">and remediation timelines<\/text>\n <\/g>\n<\/g><\/svg>\n  \n<\/div>\n\n  <p>Audits must be conducted by CERT-In empanelled information-security auditing organisations, not just any firm, and they run after the end of each audit period, annually for most regulated entities and half-yearly for Qualified Stock Brokers. The scope must cover all critical systems and a sample of non-critical ones, and the findings, management responses, and remediation timelines are submitted to SEBI through the prescribed channel. Handling this cycle cleanly, with evidence, is the ongoing substance of the framework. The dynamic mirrors what vendors face preparing for a <a href=\"https:\/\/www.osto.one\/resources\/blog\/soc-2-for-startups\/\">SOC 2 audit<\/a>, where evidence and remediation matter as much as the controls themselves.<\/p>\n\n  <h2 class=\"sec\" id=\"multi\">Multi-regulated entities<\/h2>\n  <p>A useful clarification helps entities regulated by more than one body, such as an NBFC that is also a stock broker. SEBI introduced a Principle of Exclusivity and Equivalence: where another regulator&#8217;s framework is equivalent, compliance with it may be deemed to satisfy the corresponding CSCRF requirement, avoiding duplicate work. This makes compliance more workable for firms already meeting a comparable standard under another regulator, though the equivalence has to be genuine and demonstrable.<\/p>\n\n  <h2 class=\"sec\" id=\"osto\">The lean-team path to SEBI CSCRF compliance<\/h2>\n  <p>Meeting all of this, governance, a SOC, VAPT, six-hour-ready incident reporting, data and API controls, and audit-ready evidence, is a heavy lift for a regulated entity without a large security function. Assembling it from separate tools and consultants is slow and hard to keep current. The efficient path is a single platform that runs the security work and organises the evidence together.<\/p>\n\n  <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups and lean financial teams. It runs VAPT across your systems and APIs, correlates security events for monitoring and fast incident reporting, supports data classification and encryption, aligns to ISO 27001, and keeps organised, audit-ready evidence, mapped across the SEBI CSCRF expectations, DPDP, and 200+ frameworks on one platform. Meeting the framework at a continuously-evidenced standard, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n  <div class=\"callout\">\n    <h3>Meet SEBI CSCRF compliance without a big team.<\/h3>\n    <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean financial teams. Run VAPT, stand up monitoring, secure your data and APIs, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n    <a href=\"https:\/\/www.osto.one\/book-demo\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo &rarr;<\/a>\n  <\/div>\n\n  <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n  <details><summary>What is SEBI CSCRF compliance?<\/summary><p>It is meeting SEBI&#8217;s Cybersecurity and Cyber Resilience Framework, which consolidated older cyber circulars into one standard for the whole securities market. It applies to every regulated entity, at a level set by which of five categories it falls into.<\/p><\/details>\n  <details><summary>Who has to comply with CSCRF?<\/summary><p>Every SEBI regulated entity in the securities market, from Market Infrastructure Institutions down to the smallest self-certification tier, across around twenty-two entity types. Some very small entities, such as stock brokers below both a client and volume threshold, are exempt.<\/p><\/details>\n  <details><summary>How are CSCRF categories decided?<\/summary><p>SEBI fixes each entity&#8217;s category at the start of the financial year based on the previous year&#8217;s data, and it stays fixed for that year. If you grow across a threshold, you move to a heavier category the following April.<\/p><\/details>\n  <details><summary>What is the CSCRF incident reporting timeline?<\/summary><p>Regulated entities must report cyber incidents to the SEBI incident reporting portal within six hours of detection, in line with CERT-In expectations. The clock runs from detection, so fast monitoring is essential.<\/p><\/details>\n  <details><summary>Who can conduct a CSCRF audit?<\/summary><p>Only a CERT-In empanelled information-security auditing organisation. Audits run after each audit period, annually for most entities and half-yearly for Qualified Stock Brokers, and must cover all critical systems and a sample of non-critical ones.<\/p><\/details>\n  <details><summary>What if my firm is regulated by both SEBI and RBI?<\/summary><p>SEBI&#8217;s Principle of Exclusivity and Equivalence allows a genuinely equivalent framework under another regulator to be deemed to satisfy the corresponding CSCRF requirement, which reduces duplicate work for multi-regulated entities such as an NBFC-cum-broker.<\/p><\/details>\n<\/div>\n\n\n","protected":false},"excerpt":{"rendered":"<p>SEBI CSCRF compliance now binds every entity in the Indian securities market, at a standard set by which category it\u2026<\/p>\n","protected":false},"author":8,"featured_media":1256,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[648,492,647,649],"class_list":["post-1255","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-sebi-cscrf-categories","tag-sebi-cscrf-compliance","tag-sebi-cyber-security-framework","tag-sebi-cybersecurity-audit"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1255","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1255"}],"version-history":[{"count":2,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1255\/revisions"}],"predecessor-version":[{"id":1258,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1255\/revisions\/1258"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1256"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1255"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1255"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1255"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}