CSCRF Compliance Guide for SEBI-Regulated Entities

SEBI's Cybersecurity and Cyber Resilience Framework, known as CSCRF, changes how regulated entities in India's securities market must protect their systems and data. This guide explains what CSCRF compliance means, who it applies to, and how to build a practical roadmap to meet it.

What is CSCRF?

SEBI issued CSCRF in August 2024. It replaces a patchwork of earlier cybersecurity circulars with a single framework built around five resilience goals: anticipate, withstand, contain, recover and evolve. Instead of one rulebook for everyone, it sets requirements proportionate to each entity's size and risk.

The framework is organised around familiar security functions: governance, identify, protect, detect, respond and recover. Each comes with standards and, for larger entities, measurable expectations.

Who must achieve CSCRF compliance?

CSCRF applies to SEBI-regulated entities, including stock exchanges, clearing corporations and depositories, stock brokers, depository participants, mutual funds and asset management companies, portfolio managers, investment advisers, research analysts, KYC registration agencies and registrars.

Entities are grouped into categories: market infrastructure institutions, qualified regulated entities, mid-size, small-size and self-certification entities. The category decides how deep the requirements go and which deadlines apply, so the first step is to confirm yours against SEBI's latest circulars.

Key requirements at a glance

• Governance: a board-approved cybersecurity policy, a designated CISO or equivalent, and an IT committee that reviews cyber risk.
• Identify: an up-to-date inventory of hardware, software and data, with critical systems clearly marked.
• Protect: multi-factor authentication, privileged access management, network segmentation, patching and encrypted backups.
• Detect: continuous monitoring through a security operations centre, with logs retained as required.
• Respond and recover: a cyber crisis management plan, tested incident response, and timely reporting to CERT-In and SEBI.
• Assurance: periodic VAPT and cyber audits, with findings tracked to closure.

A practical roadmap to CSCRF compliance

1. Gap assessment: compare your current controls with the requirements for your category and list what is missing.
2. Prioritise: fix the high-risk gaps first, usually access control, monitoring and backups.
3. Policies and governance: write or update the policies, assign owners and take them to the board.
4. Implement controls: deploy MFA, PAM, firewalls, endpoint protection and logging.
5. Monitor: connect systems to a SOC so threats are detected around the clock.
6. Test: run VAPT, rehearse the crisis plan and fix what the tests reveal.
7. Evidence: keep reports, logs and sign-offs ready for auditors.

Timelines and staying current

SEBI has issued clarifications and adjusted timelines for different categories since CSCRF was first published, and it is likely to keep refining the framework. Treat your compliance plan as a living document: assign someone to track SEBI and CERT-In circulars, review your category each year as your business grows, and update policies and controls when requirements change. Building controls that genuinely reduce risk, rather than ticking boxes, also makes each future change easier to absorb.

How TM Solutech helps

We work with regulated entities end to end, from the first gap assessment to ongoing monitoring:

• Governance and access control: multi-factor authentication, privileged access management and zero-trust policies.
• Continuous monitoring: our managed SOC with SIEM and 24/7 analysts.
• Network defence: next-generation firewalls, web application firewalls and VLAN segmentation.
• Data protection: encrypted backups, email authentication and mobile device management.
• Assurance: scheduled VAPT, automated patching and a tested cyber crisis management plan.

Common CSCRF mistakes to avoid

The most common problem we see is treating CSCRF as a documentation exercise. Policies matter, but auditors look for evidence that controls actually work: alerts investigated, patches applied, backups restored in tests. Other pitfalls include an incomplete asset inventory, shared admin accounts, and third-party vendors with broad access that nobody reviews.

CSCRF compliance is a continuous programme, not a one-time project. Need help finding where you stand? Contact us for a CSCRF gap assessment.