SEBI’s New Cybersecurity Guidelines: A Comprehensive Guide to CSCRF (2024)

In the wake of increasing cyber threats and vulnerabilities in financial markets, the Securities and Exchange Board of India (SEBI) has introduced a robust Cybersecurity and Cyber Resilience Framework (CSCRF). Released in August 2024, this framework provides SEBI-regulated entities (REs) with comprehensive guidelines to secure their operations and safeguard investors’ data from potential cyberattacks. In this blog, we delve into the key components of the CSCRF and how it helps safeguard the financial ecosystem against evolving cyber risks.

Introduction

The Securities and Exchange Board of India (SEBI) has introduced the Cybersecurity and Cyber Resilience Framework (CSCRF), a comprehensive set of guidelines aimed at strengthening cybersecurity in India’s financial markets. With cyber threats becoming more sophisticated and pervasive, this framework provides a robust strategy for Why Cybersecurity Matters for Financial Markets. SEBI-regulated entities to protect their systems, data, and operations. The CSCRF outlines critical measures for anticipating, containing, and recovering from cyberattacks while ensuring business continuity.

You can also read – RBI New Guidelines for Banks: 5 ways to help you comply

What is the Cybersecurity and Cyber Resilience Framework (CSCRF)?

The CSCRF is an updated and comprehensive cybersecurity framework aimed at reinforcing cyber resilience across India’s financial institutions. SEBI had previously issued several circulars, dating back to 2015, to address cybersecurity concerns. However, with the increasing digitalization of financial services, a more holistic and uniform set of guidelines was required to tackle the growing risk of cyberattacks.

The framework is built on two core pillars:

1. Cybersecurity: Protecting IT infrastructure and data from unauthorized access or malicious threats.
2. Cyber Resilience: Ensuring the ability to withstand and recover from cybersecurity incidents swiftly and efficiently.

The CSCRF applies to all SEBI-regulated entities (REs), including stockbrokers, mutual funds, asset management companies, depositories, credit rating agencies, and venture capital funds​.

Why Cybersecurity Matters for Financial Markets?

Financial markets in India are highly dependent on technology, making cybersecurity critical. The financial sector deals with high transaction volumes, sensitive financial data, and is deeply interconnected, meaning that a cyberattack on one entity can have cascading effects across the system. SEBI’s CSCRF is designed to prevent these attacks from causing widespread damage by ensuring that all REs can withstand and recover from cyber incidents.

Three Core Cybersecurity Challenges

Below we have mentioned the three core challenges related to cybersecurity.

Here’s a table outlining the three core cybersecurity challenges:

Cybersecurity Challenge	Description	Impact
High Transaction Volumes	Millions of daily financial transactions create vast attack surfaces, increasing the risk of breaches.	Breaches can lead to financial fraud, identity theft, and disruption of services, affecting users widely.
Sensitive Financial Data	Financial institutions store sensitive customer and transactional data, making them prime targets.	Data breaches result in financial loss, privacy violations, and reputational damage for institutions.
Systemic Risk to Financial Markets	A cyberattack on key institutions (e.g., stock exchanges) can destabilize the entire financial system.	Disruptions can trigger panic, market volatility, and loss of investor confidence, harming the economy.

Who Must Comply with CSCRF?

SEBI’s CSCRF applies to a broad spectrum of financial institutions, ensuring no entity is left vulnerable. The framework is mandatory for:

• Market Infrastructure Institutions (MIIs) such as stock exchanges and clearing corporations.
• Qualified Regulated Entities (REs) including mutual funds and asset management companies.
• Mid-size and Small Regulated Entities that may have fewer resources but still face significant cyber risks.
• Self-certified entities, who must ensure their compliance through regular self-assessments​

Additionally, other entities under SEBI’s regulation include:

• Alternative Investment Funds (AIFs)
• Credit Rating Agencies (CRAs)
• Debenture Trustees (DTs)
• Depositories and Custodians
• Stock Brokers and Venture Capital Funds

Key Requirements of SEBI’s CSCRF

The Cybersecurity and Cyber Resilience Framework (CSCRF) introduced by SEBI outlines several critical requirements that all regulated entities (REs) must implement to ensure robust cybersecurity and resilience. Below are the detailed key requirements of the CSCRF:

1. Cybersecurity Governance and Policy Framework

• Comprehensive Cybersecurity Policy: REs must establish a well-documented cybersecurity policy that is approved by their Board of Directors or governing body. This policy should clearly define the approach to risk management, security controls, and operational procedures.
• Roles and Responsibilities: Entities are required to assign specific roles and responsibilities related to cybersecurity management, ensuring accountability at all levels.
• Cyber Risk Management Framework: REs must implement a framework for managing cyber risks. This includes identifying, assessing, and mitigating risks across their IT environment. Regular reviews of this framework should be conducted to account for new threats.

2. Risk Assessment and Critical System Identification

• Identification of Critical Systems: REs are required to classify their IT infrastructure and identify critical systems that are essential for business operations. These systems include trading platforms, payment gateways, and data storage services.
• Periodic Risk Assessments: Regular and comprehensive risk assessments must be conducted, including scenario-based testing to evaluate potential threats. This helps in understanding the risks posed by both internal and external sources.

3. Cyber Capability Index (CCI)

• Purpose of CCI: The Cyber Capability Index (CCI) is a tool introduced to measure the cybersecurity readiness of REs. It evaluates entities based on a set of 23 parameters, including threat detection, incident response, and data protection measures.
• Market Infrastructure Institutions (MIIs): MIIs are required to undergo third-party assessments of their cybersecurity resilience twice a year.
• Qualified Regulated Entities (REs): Qualified REs, such as asset management companies and mutual funds, must conduct self-assessments annually​.
• Index Evaluation: The CCI provides a numerical score based on the preparedness and effectiveness of an entity’s cybersecurity infrastructure, allowing continuous monitoring and improvement.

4. Security Operations Center (SOC)

• Mandatory SOC Implementation: All REs must implement a Security Operations Center (SOC) to continuously monitor cybersecurity events and detect anomalous activities. The SOC may be an in-house facility, a group-level SOC, or a third-party managed service.
• Market SOC for Smaller Entities: To help smaller REs who may lack resources, SEBI has mandated the establishment of a Market SOC by the Bombay Stock Exchange (BSE) and National Stock Exchange (NSE). This SOC will support small entities with security monitoring and detection​.
• Efficacy Monitoring: MIIs and qualified REs are required to measure and report the functional efficacy of their SOC every six months. Smaller REs must do this annually by obtaining reports from the SOC service providers.

5. Vulnerability Assessment and Penetration Testing (VAPT)

• Regular VAPT Audits: REs must conduct Vulnerability Assessment and Penetration Testing (VAPT) on their IT infrastructure regularly. This is especially important after major changes, such as software updates or system upgrades.
• Scope of VAPT: The testing should cover all critical systems, infrastructure components, and any other systems defined in the CSCRF. Any identified vulnerabilities must be addressed promptly.

6. Incident Response and Management

• Incident Response Plan (IRP): REs must have a well-defined Incident Response Plan to manage cybersecurity incidents effectively. This plan should outline the procedures for responding to incidents, including reporting, containment, and mitigation.
• Cyber Crisis Management Plan (CCMP): A robust Cyber Crisis Management Plan must be in place to ensure business continuity and system recovery after a cyber incident. This includes detailed steps for restoring critical operations and services.
• Reporting Cybersecurity Incidents: All cybersecurity incidents must be reported to SEBI through its incident reporting portal in a timely manner. This ensures that any breaches or attacks are promptly addressed and monitored at the regulatory level​.

7. Data Protection and Access Control

• Data Encryption: REs must adopt data encryption techniques, including Full Disk Encryption (FDE) and File-based Encryption (FE), to protect sensitive information from unauthorized access or theft.
• Access Control Policies: Entities are required to implement strict access control mechanisms, ensuring that only authorized personnel have access to critical systems and data. Multi-factor authentication (MFA) is recommended to enhance security.

8. Backup and Disaster Recovery

• Disaster Recovery Plans (DRP): REs must establish a Disaster Recovery Plan that outlines how they will restore critical systems and data after a cyberattack. This ensures that operations can resume quickly with minimal disruption.
• Data Backup: Regular data backups are required to prevent data loss during an incident. These backups must be securely stored and regularly tested to ensure they can be used for recovery.

9. Red Teaming and Continuous Improvement

• Red Teaming Exercises: MIIs and qualified REs must conduct red teaming exercises to simulate real-world cyberattacks and test their cybersecurity defenses. These exercises provide insights into system vulnerabilities and help improve response mechanisms.
• Continuous Updates and Training: REs must regularly update their cybersecurity policies and procedures to account for new threats. Additionally, employees should undergo periodic training to stay informed about the latest security protocols and best practices.

10. Compliance Reporting and Auditing

• Compliance Reports: REs are required to submit detailed compliance reports based on the CSCRF guidelines to SEBI. The reports should follow the structured formats provided within the framework and must be submitted within the defined timelines.
• Audits: Entities must undergo regular cybersecurity audits to assess compliance with the CSCRF standards. These audits ensure that REs are adhering to best practices and continuously improving their cybersecurity infrastructure.

Reporting and Compliance Timeline

The compliance reporting for CSCRF must follow a structured format provided in the framework. The key deadlines for REs to adopt the CSCRF standards are:

• January 1, 2025, for REs where previous circulars already exist.
• April 1, 2025, for other REs adopting the CSCRF for the first time.

Why Should Organizations Adopt SEBI’s CSCRF?

Adopting SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF) is crucial for organizations, not just for regulatory compliance, but to ensure robust protection against the ever-growing threat of cyberattacks. Implementing the framework helps businesses:

1. Boost Cybersecurity Defenses: Strengthen their resilience against potential cyber threats and reduce vulnerabilities.
2. Safeguard Trust: Protect the confidence of investors and stakeholders by ensuring the security of sensitive data and transactions.
3. Maintain Operational Continuity: Ensure business continuity even during a cyber incident, minimizing disruption to critical services.

Conclusion

The SEBI CSCRF is a forward-thinking, comprehensive approach to tackling the cybersecurity challenges faced by India’s financial markets. By adhering to its guidelines, regulated entities can better protect themselves against cyber threats and ensure business continuity, ultimately safeguarding the financial ecosystem.

With the framework’s focus on anticipation, containment, recovery, and continuous improvement, the CSCRF offers a clear roadmap for financial institutions to follow in their journey toward becoming more cyber-resilient.

You can also read – Best Phishing Tools for Advanced Protection (2025)

FAQs