📡 SEBI CSCRF — Cyber Security & Cyber Resilience Framework  ·  Circular SEBI/HO/ITD-1/ITD_CSC_EXC/P/CIR/2024/113  ·  Talk to a CSCRF specialist →
📡 SEBI CSCRF 2024 · MANDATORY FOR REGULATED ENTITIES

SEBI CSCRF Compliance in 30 Days For Stock Brokers · AMCs · Mutual Funds · Depositories · Exchanges · KRAs · RTAs

⚠️ Compliance Deadlines Have Passed for Categories 1–3. Category 4 deadline: January 1, 2026. Non-compliance attracts SEBI enforcement action.

SEBI's Cyber Security and Cyber Resilience Framework is not optional — it is mandatory for every Regulated Entity operating in Indian capital markets. Our 30-day structured plan covers all 6 CSCRF functions with ready-to-use templates, evidence checklists, and audit documentation.

6 Functions (GOVERN–RECOVER)
30 Day Programme
30 Tasks with Templates
SEBI 2024 Circular
NIST CSF Aligned
CERT-In Compatible
Start CSCRF Journey → Book Free Consultation

🎉 Free for your first 7 days · No credit card required

Already registered? Log in

Why CSCRF is Non-Negotiable

SEBI CSCRF 2024 is a binding regulatory obligation — not a best-practice guideline. Here's what's at stake.

The Regulatory Mandate

SEBI issued Circular SEBI/HO/ITD-1/ITD_CSC_EXC/P/CIR/2024/113 on August 20, 2024, replacing all earlier cyber security circulars. It mandates a comprehensive, NIST CSF-aligned cyber security and resilience framework for all SEBI Regulated Entities (REs).

The framework covers the entire lifecycle of cyber risk management — from governance and asset identification to incident response, recovery, and regulatory reporting. Compliance is tracked through mandatory self-certification and periodic cyber audits.

The 6-hour incident reporting requirement means your organisation must have a tested, documented response capability — not just a policy on paper. SEBI expects audit trail evidence, board-level oversight, and CERT-In empanelled audit reports.

⚡ Consequences of Non-Compliance

🚫Registration suspension — SEBI can suspend or cancel RE registration for persistent non-compliance
💰Monetary penalties — Up to ₹25 crore per violation under SEBI Act Section 15HB
📋Adjudication proceedings — Show-cause notices, adjudication orders, and public disclosure
🔍SEBI inspection — On-site inspection of cyber security infrastructure with no advance notice
🏦Client trust damage — Mandatory disclosure of cyber incidents may trigger client flight and reputational harm

📅 Compliance Deadlines

🔴Category 1 (Exchanges, Clearing Corps, Depositories) — January 1, 2025
🔴Category 2 (Large Brokers >50K clients, AMCs) — April 1, 2025
🟡Category 3 (Mid-size Brokers, RTAs, KRAs) — July 1, 2025
🟢Category 4 (Small entities) — January 1, 2026

Which Entities Are Covered?

If you hold a SEBI registration, CSCRF applies to you. Here's the category breakdown.

Category Type of Entity Deadline Cyber Audit Frequency SOC Required
Cat 1Stock Exchanges, Clearing Corporations, DepositoriesJan 1, 2025Half-yearly (CERT-In empanelled)✅ Mandatory
Cat 2Stock Brokers (>50K clients), Merchant Bankers, AMCs, MF Trustees, Portfolio ManagersApr 1, 2025Half-yearly✅ Mandatory
Cat 3Stock Brokers (≤50K clients), RTAs, KRAs, Custodians, Debenture TrusteesJul 1, 2025Annual⚠️ Recommended
Cat 4Investment Advisers, Research Analysts, Crowdfunding Platforms, Small REsJan 1, 2026Annual➖ Optional

The 6 CSCRF Functions

Aligned to NIST Cyber Security Framework (CSF). Every function maps to specific sub-categories with compliance evidence requirements.

GV · GOVERN

Govern

Board-level cyber governance, risk appetite, CISO appointment, policies, roles & responsibilities, and third-party oversight. Sets the tone for the entire programme.

Covers: Policy, Risk Management, Roles, Oversight, Culture
ID · IDENTIFY

Identify

Asset inventory, data classification, supply chain risk, enterprise risk assessment, and business environment mapping. Know what you have before you protect it.

Covers: Asset Mgmt, Risk Assessment, BCP/DR, Supply Chain
PR · PROTECT

Protect

Access control, IAM, network segmentation, encryption, patch management, secure configuration, DLP, and staff awareness training.

Covers: Access Control, Data Security, Platform Security, Awareness
DE · DETECT

Detect

SOC, SIEM, log management, VAPT (CERT-In empanelled), anomaly detection, continuous monitoring, and threat intelligence. Detect threats before they become incidents.

Covers: Monitoring, Anomalies, VAPT, Continuous Detection
RS · RESPOND

Respond

Incident response plan, 6-hour SEBI reporting, severity classification, forensics, communication to regulators, and post-incident review.

Covers: IRP, SEBI Reporting, Forensics, Communication
RC · RECOVER

Recover

BCP/DR testing, recovery planning, lessons learned, self-certification preparation, and submission to SEBI. Demonstrate resilience — not just security.

Covers: Recovery Planning, DR Drills, Self-Certification, Audit

30-Day Task Plan with Templates

Every task has a named downloadable template. Download, complete, and upload the evidence — the platform tracks your compliance score automatically.

GOVERN (Days 1–6)
IDENTIFY (Days 7–11)
PROTECT (Days 12–18)
DETECT (Days 19–23)
RESPOND (Days 24–27)
RECOVER (Days 28–30)
Day 1
GOVERN
Cyber Security Policy — Board Approval
📄 Cyber Security Policy Document v1.0
Day 1
GOVERN
CSCRF Gap Assessment
📄 CSCRF Compliance Gap Assessment Checklist
Day 2
GOVERN
CISO / Nodal Officer Appointment
📄 CISO Appointment Letter & Role Charter
Day 3
GOVERN
Board Cyber Risk Committee
📄 Board Cyber Risk Committee Terms of Reference
Day 4
GOVERN
Cyber Risk Appetite Statement
📄 Cyber Risk Appetite Statement
Day 5
GOVERN
Cyber Security RACI Matrix
📄 Cyber Security RACI Matrix
Day 6
GOVERN
Cyber Awareness Training Programme
📄 Training Calendar & Attendance Register
Day 7
IDENTIFY
Critical Information Asset Inventory
📄 Critical Information Asset Register (CIAR)
Day 8
IDENTIFY
Data Classification & Labelling
📄 Data Classification Policy & Sensitivity Register
Day 9
IDENTIFY
Third-Party Supply Chain Risk
📄 Vendor Cyber Risk Assessment Register
Day 10
IDENTIFY
Enterprise Cyber Risk Assessment
📄 Enterprise Cyber Risk Assessment Report
Day 11
IDENTIFY
BCP / Disaster Recovery Plan
📄 Business Continuity & DR Plan (BCP/DRP)
Day 12
PROTECT
Access Control Policy & IAM
📄 Access Control Policy & IAM Audit Evidence
Day 13
PROTECT
Privileged Access Management (PAM)
📄 PAM Procedure & Privileged Account Audit Log
Day 14
PROTECT
Network Architecture & Segmentation
📄 Network Architecture Diagram & Segmentation Policy
Day 15
PROTECT
Cryptography & Key Management
📄 Cryptography & Encryption Policy
Day 16
PROTECT
Vulnerability Management & Patching
📄 Vulnerability Mgmt Policy & Patch Status Report
Day 17
PROTECT
Secure Configuration Baselines
📄 CIS Benchmark Configuration Checklist
Day 18
PROTECT
Data Loss Prevention (DLP) Controls
📄 DLP Policy & Endpoint Control Evidence
Day 19
DETECT
SOC / MSSP Establishment
📄 SOC Charter & MSSP SLA Agreement
Day 20
DETECT
Log Management & SIEM Configuration
📄 Log Mgmt Policy & SIEM Use-Case Register
Day 21
DETECT
VAPT Engagement & Scope
📄 VAPT Scope of Work & Engagement Letter
Day 22
DETECT
VAPT Findings & Remediation Tracker
📄 VAPT Report & Remediation Status Tracker
Day 23
DETECT
Cyber Security Monitoring Dashboard
📄 Cyber KPI Monitoring Dashboard Template
Day 24
RESPOND
Cyber Incident Response Plan
📄 Cyber Security Incident Response Plan (IRP)
Day 25
RESPOND
SEBI 6-Hour Incident Reporting SOP
📄 SEBI Cyber Incident Reporting SOP
Day 26
RESPOND
Incident Severity Classification
📄 Incident Classification & Escalation Matrix
Day 27
RESPOND
Digital Forensics Procedure
📄 Digital Forensics Procedure & Chain of Custody
Day 28
RECOVER
BCP / DR Drill & Recovery Test
📄 BCP/DR Drill Report & RTO/RPO Evidence
Day 29
RECOVER
Internal CSCRF Compliance Audit
📄 Internal CSCRF Compliance Audit Report
Day 30
RECOVER
Self-Certification & SEBI Submission
📄 CSCRF Self-Certification Declaration Form

Ongoing Compliance Frequency

CSCRF compliance is not a one-time exercise. Once implemented, these recurring obligations must be managed continuously.

🔍

Cyber Security Audit (VAPT)

Mandatory VAPT by a CERT-In empanelled agency. Categories 1 & 2 require half-yearly audits. Categories 3 & 4 require annual audits. Reports submitted to SEBI.

Half-yearly (Cat 1 & 2) · Annual (Cat 3 & 4)
📋

CSCRF Self-Certification

Annual self-certification declaration submitted to SEBI confirming compliance status across all 6 functions. Must be signed by CISO and countersigned by MD/CEO.

Annual · via SEBI SCORES/REG Portal
📊

Board / Risk Committee Reporting

Quarterly cyber risk report to the Board or Cyber Risk Committee covering: open vulnerabilities, incidents, KPIs, VAPT status, and third-party risk updates.

Quarterly
⚡

Cyber Incident Reporting to SEBI

Any material cyber incident must be reported to SEBI within 6 hours of discovery. Followed by a detailed incident report within 24 hours. Also report to CERT-In as required.

Within 6 Hours of Discovery
🔄

Policy Review & Update

All cyber security policies must be reviewed at least annually or whenever there is a significant change in the threat landscape, regulatory requirement, or business operations.

Annual (or on material change)
🧪

BCP / DR Drill

Business Continuity and Disaster Recovery drills must be conducted and documented. Results — including actual RTO/RPO vs targets — must be reported to the Board and to SEBI on request.

Half-yearly (Cat 1 & 2) · Annual (Cat 3 & 4)

CSCRF Pricing

One fixed platform fee. Consultants bring SEBI regulatory expertise — tier determines depth of engagement.

CertCanvas Platform Fee
🎉 First 7 days completely free · No credit card needed to start
Contact for Pricing
  • ✓ 30-day CSCRF compliance programme
  • ✓ All 6 functions (Govern to Recover)
  • ✓ 30 tasks with audit-ready templates
  • ✓ SEBI self-certification documentation
  • ✓ CSCRF consultant unlocked at 90%
Consultant Fee (Separate — Your Choice)
⭐⭐⭐ Emerging
SEBI compliance, 3-5 years
₹28K–₹70K
⭐⭐⭐⭐ Experienced
CERT-In auditor background, 8+ years
₹70K–₹1.8L
⭐⭐⭐⭐⭐ Expert
Ex-SEBI / CERT-In, 12+ years
₹1.8L–₹4.5L

Platform fee is the same regardless of consultant tier. For Category 1 & 2 entities, an Expert tier consultant is strongly recommended for CERT-In empanelled audit coordination.

Your CSCRF Consultant

CSCRF consultants step in at 90% readiness to finalise your self-certification declaration, coordinate VAPT, and prepare SEBI audit documentation.

Kavita Nair
Kavita Nair
SEBI CSCRF Compliance Specialist
★★★★☆

Compliance specialist for SEBI-regulated entities. Extensive experience with CERT-In audits, SOC establishment, 6-hour incident reporting SOPs, and SEBI self-certification for Category 2–4 entities.

SEBI Compliance CERT-In Audits IRP Design
🔓
Consultant Unlocked at 90% Readiness
Complete the 30-day CSCRF programme first. Once you reach 90%, choose a CSCRF specialist to review your evidence portfolio, coordinate VAPT scheduling, and finalise the self-certification declaration.
Start Now →

Talk to a CSCRF Specialist

Whether you're starting from scratch or addressing audit gaps — tell us your category and we'll customise the compliance plan for your entity.

Our SEBI CSCRF specialist responds within 24 hours. Confidential.