SEBI CSCRF Overview
The Securities and Exchange Board of India's Cyber Security and Cyber Resilience Framework (CSCRF) mandates comprehensive security controls for Market Infrastructure Institutions (MIIs), stock brokers, depository participants, and other SEBI-regulated entities.
Key Requirements
Governance
- Board-approved cyber security policy
- Designated CISO with direct board reporting
- Quarterly cyber security review by the board
- Annual cyber security audit by CERT-In empaneled auditor
Technical Controls
- Network segmentation between trading and corporate networks
- Multi-factor authentication for critical systems
- Data Loss Prevention (DLP) deployment
- Security Operations Center (SOC): 24x7 for MIIs
- Vulnerability Assessment and Penetration Testing (VAPT): quarterly
Incident Reporting
- Report cyber incidents to SEBI within 6 hours
- Report to CERT-In as per CERT-In guidelines
- Maintain incident response playbooks
- Conduct quarterly cyber drills
Data Protection
- Encryption of sensitive data at rest and in transit
- Secure data backup with periodic restoration testing
- Data classification and access control
- API security for market data feeds
Compliance Checklist
- Appoint CISO and establish governance structure
- Deploy SOC with 24x7 monitoring capability
- Implement DLP across endpoints and network
- Conduct quarterly VAPT through CERT-In empaneled auditors
- Configure MFA for all critical system access
- Establish incident reporting procedures (6-hour SLA)
- Maintain and test business continuity plans
SuperClue SEBI CSCRF Module
SuperClue's SEBI CSCRF framework scan runs 22 checks grouped by CSCRF area, such as governance, access control, data protection, SOC operations, and VAPT. It checks your external website and asks for evidence for the rest, to help you prepare for audit.