In short
The Cybersecurity and Cyber Resilience Framework (CSCRF) is SEBI’s single cyber security rulebook for the securities market. Issued on 20 August 2024, it replaced earlier circulars that covered only some entity types. It sorts regulated entities into five categories and scales the rules to each. For software, the core change is that every critical system must be inventoried, tested and monitored. That includes the website, trading app and back office. Each must also be recoverable within two hours and documented down to its components. This article describes the CSCRF as clarified up to SEBI’s circular of 24 August 2026 on incident reporting.
Who it applies to
The CSCRF covers 19 types of regulated entity. They include exchanges, clearing corporations, depositories, brokers, depository participants, mutual funds and AMCs, and portfolio managers. Alternative investment funds, KYC registration agencies, registrars, merchant bankers, credit rating agencies and custodians are also covered.
Each entity falls into one of five categories, decided at the start of each financial year on the previous year’s data:
- Market infrastructure institutions (MIIs): exchanges, clearing corporations and depositories.
- Qualified REs: for example, brokers with more than 10 lakh registered clients, KYC registration agencies, and depository participants that are banks, NBFCs or similar institutions.
- Mid-size REs: for example, brokers with more than 1 lakh and up to 10 lakh clients, and portfolio managers with ₹10,000 crore or more in assets under management.
- Small-size REs: for example, brokers with more than 10,000 and up to 1 lakh clients, and all active merchant bankers.
- Self-certification REs: for example, brokers with more than 1,000 and up to 10,000 clients, and portfolio managers with ₹3,000 crore or less.
Brokers are also graded on yearly clientele trading volume, and the higher category applies. An entity with several SEBI registrations follows its highest category.
Exempt: brokers with under ₹1,000 crore clientele trading volume a year and under 1,000 registered clients; investment advisers and research analysts with no other SEBI registration; and inactive merchant bankers.
Banks and others with a primary regulator apply the CSCRF only to systems used exclusively for SEBI-regulated activity. For items such as IT committees and patch policy, they may show equivalent compliance with their main regulator’s rules.
Timeline. The original deadlines were 1 January 2025 for six entity types with an earlier SEBI cyber circular, and 1 April 2025 for the rest. SEBI then extended these. Its circular of 30 June 2025 set 31 August 2025 for all entities except MIIs, KYC registration agencies and qualified registrars. Cyber audits from financial year 2025-26 onwards follow the CSCRF.
What it means for your website
The CSCRF has no rules on website content, but it treats your website and app as critical systems. SEBI’s technical clarification of 28 August 2025 lists internet-facing and client-facing applications as critical. That brings the website, investor portal, trading app and their APIs into the full scope of VAPT, cyber audit, monitoring and recovery planning. SEBI made its mobile application security guidelines recommendatory in the same clarification. For what SEBI requires investors to see on your site, read SEBI rules for websites and apps.
What it means for your software
Critical systems and asset inventory
Each entity must list its critical systems, approved by its board, partners or proprietor. Under the 2025 clarification, critical systems include any system whose compromise would hurt core operations, and systems that store or send regulatory data. Internet-facing and client-facing systems count too, as does any system on the same network segment. Small entities may keep the IT asset inventory in a spreadsheet if it is kept current. The CSCRF also asks for an inventory of cryptographic assets, such as keys, certificates and algorithms, to prepare for post-quantum cryptography.
Governance and the CISO
Every entity needs a Chief Information Security Officer (CISO). A remote CISO is allowed if dedicated to one organisation, but a part-time CISO shared between entities is not. A group-level CISO may cover entities in the same group. For MIIs and Qualified REs, the CISO must rank at least equal to the CTO or CIO. An IT Committee for the entity approves VAPT and audit reports and tracks findings to closure.
VAPT
Vulnerability assessment and penetration testing (VAPT) must be done by a CERT-In empanelled auditing organisation, planned at the start of each financial year.
- Frequency: at least once a year, starting in the first quarter; at least twice a year, one in each half, for systems notified by NCIIPC as protected systems or critical information infrastructure. Qualified Stock Brokers test half-yearly.
- Report: within one month of completing the VAPT, after IT Committee approval.
- Closure: findings closed within 3 months of the report, and revalidation done within 5 months of the VAPT.
- Submission: only a summary in SEBI’s format. Entities must not send detailed vulnerabilities unless SEBI asks.
Patches should be tested in a non-production environment before going to the main and disaster recovery sites. Where a patch is slow, the CSCRF allows compensating controls such as virtual patching. Read more in our VAPT guide.
Cyber audit
A cyber audit checks compliance with the CSCRF. It covers all critical systems and 25% of non-critical systems on a sample basis. MIIs and Qualified REs are audited at least twice a year, and most other entities at least once. Self-certification REs are exempt from the periodic audit by a CERT-In empanelled auditor. The report is due within one month of the audit, findings must close within 3 months, and any follow-on audit must finish within 5 months. Brokers and depository participants report to the exchanges and depositories; investment advisers and research analysts report to BSE. Since August 2025, audits must also follow CERT-In’s Cyber Security Audit Policy Guidelines.
Security operations centre and logging
All entities need security monitoring through a security operations centre (SOC): their own, a group SOC, or the Market SOC set up by NSE and BSE for smaller entities. Small-size and self-certification REs must join the Market SOC unless they run their own SOC. Some very small entities with under 100 clients are exempt. Entities using their own or a group SOC submit a SOC efficacy report.
Logs to collect include system, application, network, database, security, performance, audit trail and event logs. The CSCRF sets no retention period of its own. It points to the IT Act, the DPDP Act and CERT-In; see our article on the CERT-In directions. MIIs and Qualified REs are expected to build an automated compliance dashboard, preferably fed by their log aggregator.
Incident reporting
Incidents covered by the CERT-In directions must go to SEBI (at mkt_incidents@sebi.gov.in) and CERT-In within 6 hours of detection. Full details follow on SEBI’s incident reporting portal within 24 hours. Brokers and depository participants also report to the exchanges or depositories within 6 hours. Other incidents are reported within 24 hours. From SEBI’s circular of 24 August 2026, the portal follows the Financial Stability Board’s FIRE format, with reports in stages from first notice to closure. Incidents rated high or critical need a forensic audit report from a third-party auditor.
Recovery
For critical systems, the recovery time objective (RTO) is two hours and the recovery point objective (RPO) is 15 minutes. Recovery plans must be scenario-based and tested in live drills, not table-top walkthroughs. MIIs and Qualified REs must keep spare hardware in an isolated environment, or use cloud-based high availability that meets SEBI’s rules.
Data localisation and cloud
The CSCRF’s provisions on keeping regulatory data in India are in abeyance since SEBI’s clarification of 31 December 2024, pending consultation. The cloud framework of March 2023 still applies. Cloud services must come from MeitY-empanelled providers with valid STQC certification, and data, including logs, must be stored and processed in their certified data centres. SEBI’s FAQs say encryption keys and key management must stay within India. A dedicated hardware security module (HSM) is mandatory for MIIs and Qualified REs; others may use an alternative approved by their board.
Software vendors and the supply chain
The regulated entity is solely accountable for third-party services, so CSCRF duties flow to vendors through contracts and service level agreements. Vendors must follow similar or higher standards of information security.
- SBOM: a software bill of materials lists every open source and third-party component, with its version and patch status. It is required for all software used in core and critical operations. This covers in-house, bought and SaaS software. It is obtained at procurement and kept updated with every upgrade. The board must approve any exception for legacy systems.
- Source code: for critical applications built for the entity’s sole use, the entity must obtain the source code. Otherwise it needs a source code escrow that includes all updates and patches.
- Testing: off-the-shelf and in-house software must have static or dynamic application security testing (SAST or DAST) done by a CERT-In empanelled auditor.
- Cloud contracts: these must set out who closes which vulnerabilities, give audit and forensic access, and pass the same duties to all subcontractors.
Algo trading APIs
If you build trading software for brokers, SEBI’s circular of 4 February 2025 on retail algo trading applies to all brokers from 1 April 2026. Brokers may not offer open APIs. Access must use a unique vendor-client API key with a static IP whitelisted by the broker, OAuth authentication and two-factor authentication. Every algo order carries a unique identifier from the exchange. Algo providers must be empanelled with the exchanges, and providers of black box algos must register as research analysts.
Checklist
- Confirm your CSCRF category for this financial year from last year’s data.
- Appoint a dedicated CISO and set up the IT Committee.
- Build and get board approval for the list of critical systems, including the website, app and APIs.
- Plan VAPT with a CERT-In empanelled auditor in the first quarter, and track findings to closure within 3 months.
- Join the Market SOC or document your own or group SOC and its efficacy.
- Collect all log types and set retention to meet CERT-In and DPDP rules.
- Write a 6-hour incident reporting procedure for SEBI, CERT-In and, if relevant, your exchange or depository.
- Test recovery against a 2-hour RTO and 15-minute RPO in live drills.
- Get SBOMs and source code or escrow for critical software, and add CSCRF clauses to vendor contracts.
- Check cloud providers are MeitY-empanelled and that keys are under your control in India.
How Kreon helps
We can build back-office, portal, ERP and CRM systems for regulated entities with CSCRF needs designed in: role-based access, detailed logs and an audit trail of every change with before and after values. We hand over an SBOM and the source code for software we build for you when they are part of the agreed scope of work; if they are not, we can provide them later at an extra cost. Systems we have built have passed independent VAPT, and we can work with your auditor to close findings within SEBI’s timelines.