What does the SuperClue SEBI CSCRF scan check?
The SEBI CSCRF scan runs 22 modules against your public website. Each one makes external checks (headers, TLS, DNS, public pages, exposed files) and maps them to an area of SEBI's Cybersecurity and Cyber Resilience Framework. Board approvals, SOC staffing, backups and audits are internal, so every module also lists what needs internal evidence.
Governance and policy (4 checks)
| Check | What it looks at from outside |
|---|---|
| Cyber Security Governance | Looks for policy pages, audits security headers, and searches your homepage for mentions of a security policy, CISO or compliance. |
| Cyber Risk Assessment | Audits security headers, the TLS certificate and DNS records (SPF, DMARC, CAA). |
| Information Security Policy | Looks for policy pages, security.txt and robots.txt. |
| SEBI Compliance Reporting | Looks for policy pages and searches your homepage for terms such as "SEBI", "CERT-In" or "annual report". |
Access and identity (3 checks)
| Check | What it looks at from outside |
|---|---|
| Access Control Management | Finds login pages and checks HTTPS on them, probes for exposed files and admin paths, and checks cookie flags. |
| Identity and Authentication | Checks cookie flags (Secure, HttpOnly, SameSite) and finds login pages. It cannot test MFA. |
| Privileged Access Management | Probes for exposed admin panels and sensitive files (.env, .git, phpMyAdmin) and finds login pages. |
Network and infrastructure (3 checks)
| Check | What it looks at from outside |
|---|---|
| Network Security | Checks the TLS certificate, security headers and CORS, and notes whether a WAF or CDN is in front of the site. |
| Endpoint Security | Audits security headers and checks error pages for stack traces. It cannot see endpoint agents. |
| Cloud Security | Checks CORS and security headers, and identifies AWS, Azure or Google Cloud from response headers. |
Data protection (3 checks)
| Check | What it looks at from outside |
|---|---|
| Data Protection and Privacy | Checks the TLS certificate, security headers including HSTS, and cookie flags. It cannot see encryption at rest. |
| Data Classification | Checks error pages and flags homepage text such as "PAN card", "Aadhaar" or "bank account". |
| Data Backup and Recovery | Looks for health endpoints and exposed sensitive files. Backup schedules and restore tests need internal evidence. |
SOC and monitoring (3 checks)
| Check | What it looks at from outside |
|---|---|
| SOC Operations | Measures response time (flags more than 3 seconds) and looks for request-tracing headers. |
| Threat Detection | Sends one request with a known attack-tool user agent and records whether it is blocked. |
| Log Management and SIEM | Looks for request-tracing headers (X-Request-ID, X-Correlation-ID, X-Trace-ID). |
Incident response and continuity (3 checks)
| Check | What it looks at from outside |
|---|---|
| Incident Response Framework | Looks for policy pages, security.txt and health or status endpoints. |
| BCP and Disaster Recovery | Looks for health endpoints and checks the TLS certificate. |
| Cyber Crisis Management | Looks for policy pages and audits security headers. |
VAPT and audit (3 checks)
| Check | What it looks at from outside |
|---|---|
| VAPT Compliance | Audits security headers, the TLS certificate and DNS records. |
| Cyber Security Audit | Audits security headers, TLS, DNS and exposed sensitive files. |
| Red Team Assessment | Probes for exposed files, stack traces on error pages and missing headers. It is not a red team exercise. |
How should I read the results?
A passed check means the public signal is in place. It does not prove the underlying control. Modules that need internal records can finish as "requires access". The scan is not a SEBI audit or a VAPT.
The default cost is 0.30 credits per module, so all 22 come to 6.6 credits. See the SEBI CSCRF overview, the CERT-In checks, or all 14 framework scans.
Run the 22 SEBI CSCRF checks on a domain you have verified.
Request access