Overview
The Securities and Exchange Board of India (SEBI) issued the Cybersecurity and Cyber Resilience Framework (CSCRF) on 20 August 2024 (circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113), replacing its earlier cybersecurity guidelines. CSCRF applies to all SEBI-regulated entities including stock exchanges, depositories, clearing corporations, mutual funds, stockbrokers, portfolio managers, and other market intermediaries. The framework sets detailed prescriptive requirements across governance, protection, detection, response, and recovery, with compliance deadlines phased by entity type.
Applicability by Entity Category
| Category | Entities | Compliance Standard |
|---|---|---|
| Market Infrastructure Institutions (MIIs) | Stock exchanges, depositories, clearing corporations | Highest standard with dedicated SOC and CERT-Fin integration |
| Qualified RTs | Large brokers, depository participants with high trading volumes | Dedicated cybersecurity team and comprehensive controls |
| Mid-size RTs | Medium-sized intermediaries | Security operations with third-party SOC option |
| Small-size RTs | Small brokers, investment advisors, research analysts | Basic security controls with managed services option |
| Self-certification RTs | Entities below specified thresholds | Self-assessment with periodic compliance reporting |
Governance Requirements
The Board or senior management must approve the cybersecurity policy and allocate adequate resources for implementation. A Technology Committee must be constituted with cybersecurity as a standing agenda item. A designated CISO (or equivalent) must be appointed with direct reporting to the MD/CEO and the Board. The cybersecurity policy must be reviewed and updated at least annually. A Cyber Resilience Plan covering business continuity, disaster recovery, and incident response must be documented and tested. Board members must receive cybersecurity awareness training at least annually.
Technical Implementation Checklist
- Establish or engage a Security Operations Centre (SOC) for continuous monitoring
- Deploy network security controls including firewalls, IDS/IPS, and DLP solutions
- Implement multi-factor authentication for all critical systems and remote access
- Conduct Vulnerability Assessment and Penetration Testing (VAPT) by CERT-In empaneled auditors at least twice yearly
- Deploy endpoint detection and response (EDR) solutions across all endpoints
- Implement email security with anti-phishing, anti-spoofing, and DMARC controls
- Establish a patch management process with critical patches applied within defined SLAs
- Implement data encryption at rest and in transit for sensitive and personal data
- Deploy privileged access management (PAM) solutions for administrative accounts
- Maintain comprehensive audit logs with minimum 2-year retention
- Conduct red team exercises annually for MIIs and Qualified RTs
ID.RA.S3: dark web monitoring, takedown services and anti-rogue app services
Most of CSCRF tells regulated entities how to run their own systems. ID.RA.S3 is different: it tells them to buy outside services. Clause 1 reads: “REs shall engage Dark web monitoring (for brand intelligence, customer protection, etc.), and takedown services as a cyber-defence strategy to check for any brand abuse, data/credentials leak, combating cyber abuse etc.” Clause 2 adds: “REs shall subscribe to anti-phishing/ anti-rogue app services to mitigate potential phishing or impersonation attacks.” The next standard, ID.RA.S4, asks REs to “proactively monitor the cyberspace to identify phishing websites w.r.t. REs’ domains and report the same to CSIRT-Fin/CERT-In”. An auditor checking these will want three things on file: the contract or subscription for each service, the list of domains, apps and brand names being watched, and case records showing what was found, when it was reported and when it came down. A dashboard screenshot rarely satisfies anyone. Two related lines are easy to miss. GV.RM asks REs to “periodically assess level of employee cybersecurity awareness, for e.g., through phishing test success rate”, so phishing simulation results count as evidence. And RS.CO keeps the CERT-In clock: incidents “shall be notified to SEBI and CERT-In within 6 hours of noticing/ detecting such incidents”.
Incident Response and Reporting
All cyber incidents must be reported to SEBI within 6 hours of detection. MIIs must also report to CERT-In and RBI concurrently, as applicable. The framework requires detailed incident classification, root cause analysis, and a corrective action plan submitted within 14 days of incident closure. SEBI expects regulated entities to participate in sector-wide cyber exercises conducted by CERT-Fin (CERT for the financial sector). Post-incident, entities must demonstrate steps taken to prevent recurrence through verifiable evidence.
Common Audit Findings
- Insufficient segregation of duties for database and system administrators
- Inadequate network segmentation between trading, clearing, and corporate networks
- Missing or incomplete asset inventory covering all hardware, software, and data assets
- Weak API security controls in trading platforms and client-facing applications
- Delayed patching of critical vulnerabilities beyond the prescribed SLA
- Lack of formalized vendor risk assessment for technology service providers
- Insufficient board-level reporting on cybersecurity metrics and incidents