SEBI CSCRF

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-08-24 SEBI aligns its Cyber Incident Reporting Portal with the FSB's FIRE format; entities report incidents through the portal
2. 2025-08-31 Extended compliance deadline for all regulated entities except MIIs, KYC registration agencies and qualified RTAs
3. 2025-06-30 Compliance deadline as extended in March 2025, later moved again to 31 August 2025
4. 2025-04-01 Original compliance date for entities receiving a SEBI cyber framework for the first time, and the extended date for KYC registration agencies and depository participants

1. 2025-08-28
   CSCRF Version 1.0, as clarified on 28 August 2025 AmendmentCurrent text

   Technical clarifications: principles of exclusivity and equivalence for entities under several regulators, technical clarifications, re-categorisation of portfolio managers and merchant bankers, and CERT-In audit policy guidelines. source

2. 2025-04-30
   Clarifications circular (30 April 2025) Amendment

   Revised the thresholds and categorisation of several kinds of regulated entities. source

   More

   • The category is decided at the start of each financial year from the previous year's data and holds for the whole year.
   • Stock brokers with fewer than 1,000 registered clients and less than 1,000 crore of clientele trading volume a year are exempt.
   • Investment advisers and research analysts not registered with SEBI in any other capacity are exempt.
3. 2024-12-31
   Clarifications circular (31 December 2024) Amendment

   Gave regulatory forbearance until 31 March 2025, moved KYC registration agencies and depository participants to 1 April 2025, and put the data localisation standard in abeyance. source

   More

   • No regulatory action for non-compliance during the forbearance period where the entity can show meaningful progress.
   • The data localisation provisions (standard PR.DS.S2) are in abeyance until further notification.
4. 2024-08-20
   CSCRF Version 1.0 (circular of 20 August 2024) Major version

   The framework was issued, superseding SEBI's existing cybersecurity circulars, guidelines and advisories for regulated entities. source

   More

   • It grades entities into five categories: market infrastructure institutions, qualified, mid-size, small-size and self-certification entities.
   • Standards referred to include the ISO 27000 series, CIS v8, NIST 800-53 and CPMI-IOSCO guidelines.

All SEBI-regulated entities, graded into five categories by size and activity, with the smallest brokers and stand-alone investment advisers and research analysts exempt.

Categories

Market Infrastructure Institutions, Qualified REs, Mid-size REs, Small-size REs and Self-certification REs, based on thresholds such as number of clients, trade volume and assets under management. source

Exempt

Stock brokers below 1,000 registered clients and 1,000 crore of yearly clientele trading volume, and investment advisers and research analysts not registered with SEBI in another capacity. source

Several regulators

For entities also regulated by others, such as banks, CSCRF scope is limited to systems used exclusively for SEBI-regulated activities, with equivalence for controls met under the primary regulator. source

Topics

Governance, supply chain risk, data classification and localisation, API security, a Security Operations Centre and its efficacy, and a software bill of materials. source

A cyber audit by a CERT-In empanelled auditor at least once a year, or twice for MIIs and qualified entities; self-certification entities need only a VAPT and a signed declaration.

Cyber audit

At least twice a year for MIIs, qualified REs and mid- or small-size REs offering internet-based or algorithmic trading; at least once a year for the rest. source

Auditors

Unless specified otherwise, certifications and audits are conducted by a CERT-In empanelled IS auditing organisation; the audit covers all critical systems and 25% of non-critical systems by sample. source

Reporting

The final report goes in within 1 month of the audit, after IT Committee approval, with an MD/CEO declaration; findings are closed within 3 months. Brokers and DPs report to the exchanges and depositories. source

ISO 27001

MIIs and qualified REs must obtain ISO 27001 certification within 1 year of issuance of the CSCRF. source

Self-certification

Self-certification REs conduct only a VAPT through a CERT-In empanelled organisation and submit a self-certification signed by an authorised signatory. source

SEBI supervises compliance and can take regulatory action; incidents are reported to SEBI and CERT-In within 6 hours.

Incident reporting

Incidents under the CERT-In directions are notified to SEBI and CERT-In within 6 hours of detection, with details on SEBI's incident reporting portal within 24 hours. source source

Regulatory action

During the forbearance to 31 March 2025, SEBI took no regulatory action where an entity could show meaningful steps; it reserves the right to seek submissions made to other regulators. source source

1. Law text CSCRF for SEBI Regulated Entities — circular and framework (20 August 2024)
2. Law text Clarifications to CSCRF (31 December 2024)
3. Law text Clarifications to CSCRF (30 April 2025)
4. Law text Technical Clarifications to CSCRF (28 August 2025)
5. Law text Alignment of SEBI's Cyber Incident Reporting Portal with FIRE format (24 August 2026)

1. India DPDPA

   India's personal data protection law for all data fiduciaries; the CSCRF is SEBI's cybersecurity framework for securities market entities.

2. ISO 27001

   The ISMS standard that MIIs and qualified entities must be certified to under the CSCRF.

3. NIST CSF

   A voluntary framework; the CSCRF organises mandatory standards under similar functions, such as Governance, Identify, Protect, Detect and Respond.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to SEBI CSCRF (RSS)