What is SEBI CSCRF?
The Cybersecurity and Cyber Resilience Framework (CSCRF) is SEBI's single cybersecurity rulebook for the entities it regulates: stock brokers, depository participants, mutual funds and AMCs, portfolio managers, AIFs, KRAs, RTAs, custodians, exchanges, clearing corporations, depositories and others. SEBI issued it on 20 August 2024 (circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113), replacing the separate cybersecurity circulars each type of entity used to follow.
The framework is built around five cyber resilience goals (anticipate, withstand, contain, recover and evolve), and it is graded: what you must do depends on which of five categories your firm falls into.
Which category is your firm in?
The five categories, from strictest to lightest:
- Market Infrastructure Institutions (MIIs): stock exchanges, clearing corporations and depositories.
- Qualified REs
- Mid-size REs
- Small-size REs
- Self-certification REs
Your category is fixed at the start of each financial year from the previous year's figures, and it does not change during the year. For stock brokers, SEBI revised the thresholds on 30 April 2025. Each test is applied on its own, and whichever puts you in the higher category wins:
| Category | Total registered clients | Clientele trading volume in a year |
|---|---|---|
| Qualified RE | More than 10 lakh | More than ₹10,00,000 crore |
| Mid-size RE | More than 1 lakh, up to 10 lakh | More than ₹1,00,000 crore, up to ₹10,00,000 crore |
| Small-size RE | More than 10,000, up to 1 lakh | More than ₹10,000 crore, up to ₹1,00,000 crore |
| Self-certification RE | More than 1,000, up to 10,000 | More than ₹1,000 crore, up to ₹10,000 crore |
Other points from the April 2025 clarification:
- Stock brokers with fewer than 1,000 registered clients and less than ₹1,000 crore of clientele trading volume are exempt from CSCRF.
- KYC Registration Agencies (KRAs) moved from the MII category to Qualified REs.
- Investment advisers and research analysts that hold no other SEBI registration are exempt.
- Self-certification portfolio managers and AIF/VCF managers with fewer than 100 clients do not have to join the Market SOC.
What CSCRF requires
| Area | Requirement |
|---|---|
| Security monitoring | Continuous monitoring through a Security Operations Centre: your own or your group's, a third party's, or the Market SOC (M-SOC) that NSE and BSE run. Small-size and Self-certification REs must be onboarded on the Market SOC (with the small-client exemptions above). MIIs and Qualified REs measure their SOC's effectiveness half-yearly; others get a yearly report from their SOC provider. |
| VAPT | At least twice a year (once in each half of the financial year) for systems NCIIPC has identified as protected systems or critical information infrastructure; at least once a year for everyone else, starting in the first quarter. Also after every major release. |
| VAPT timelines | Report within 1 month of finishing the test, findings closed within 3 months of the report, and revalidation within 5 months of the test. |
| Cyber audit | At least twice a year for MIIs and Qualified REs (and Mid-size and Small-size REs offering internet or algo trading); at least once a year for the rest. |
| Auditors | Unless CSCRF says otherwise, audits must be done by a CERT-In empanelled IS auditing organisation. |
| Incident reporting | Cyber incidents reported to SEBI and CERT-In within 6 hours of noticing or detecting them. |
| Cyber Capability Index (CCI) | MIIs assess themselves half-yearly; Qualified REs do a yearly self-assessment. |
| Key management | Hardware Security Modules (HSMs) are mandatory for MIIs and Qualified REs; smaller categories may use an alternative. |
| Oversight | Your IT Committee approves VAPT and audit reports and tracks open findings; anything still open after 3 months needs its approval and must be closed before the next VAPT. |
Deadlines
SEBI extended the original timelines more than once. Its 30 June 2025 circular set 31 August 2025 as the implementation date for regulated entities other than MIIs, KRAs and QRTAs, which follow their own timelines. So for most firms CSCRF already applies. The open question is no longer "when" but whether your last VAPT, cyber audit and compliance submission match your category.
How to use the scorecard above
The scorecard covers ten control areas that cut across CSCRF, not the whole framework. Treat every "No" as a gap to close before your next VAPT or cyber audit. Then confirm the exact frequency and format for your category in the circulars listed below, because those details differ by category.
FAQ
Does CSCRF apply to a small stock broker?
Yes, unless you have fewer than 1,000 registered clients and less than ₹1,000 crore of clientele trading volume a year. Small brokers usually fall in the Self-certification or Small-size category, with lighter obligations, and must be onboarded on the exchanges' Market SOC.
Who can carry out the VAPT and cyber audit?
A CERT-In empanelled IS auditing organisation, unless CSCRF specifies otherwise for that activity.
How quickly must a cyber incident be reported?
Within 6 hours of noticing or detecting it, to SEBI and to CERT-In.
We are also regulated by RBI. Which rules apply?
The April 2025 clarification addresses entities regulated by more than one regulator. Check it for your structure, and see our RBI cybersecurity scorecard for the RBI side.
We fix the gaps a CSCRF VAPT or cyber audit would find before the empanelled auditor arrives, and set up the monitoring and incident reporting behind them. See VAPT services and banks and financial services.
Sources
- SEBI circular on CSCRF, 20 August 2024
- SEBI clarifications to CSCRF, 30 April 2025 (circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/60, as circulated by NSE)
- SEBI circular extending CSCRF implementation, 30 June 2025
Facts checked against the sources above on 22 October 2026. General information, not legal advice.