Regulatory15 min read•January 10, 2026

SEBI CSCRF: Complete Implementation Guide for Market Intermediaries

Compliance Team

Cyber Soldiers Lab

January 10, 2026

The Securities and Exchange Board of India's Cyber Security and Cyber Resilience Framework (CSCRF) mandates comprehensive security controls for market intermediaries. This guide provides a detailed implementation roadmap for stockbrokers, depository participants, and other regulated entities.

Understanding SEBI CSCRF

The CSCRF framework establishes baseline security requirements for all market intermediaries, with enhanced requirements for larger entities based on client base and transaction volumes. Applicability Criteria: • Stockbrokers with >10,000 clients: Enhanced Tier • Stockbrokers with ≤10,000 clients: Basic Tier • Depository Participants: Enhanced Tier (All) • Asset Management Companies: Enhanced Tier (All)

Core Requirements

1. Cyber Security Policy (CSP) Every regulated entity must have a board-approved Cyber Security Policy covering: • Roles and responsibilities for cyber security • Asset classification and protection standards • Access control policies • Incident response procedures • Business continuity and disaster recovery • Third-party risk management 2. Security Operations Center (SOC) Enhanced tier entities must establish or outsource SOC capabilities: • 24x7 monitoring of security events • Log aggregation and correlation • Threat intelligence integration • Incident detection and escalation 3. Vulnerability Assessment and Penetration Testing (VAPT) • Vulnerability Assessment: Monthly for all internet-facing systems • Penetration Testing: Quarterly for critical systems • Application Security Testing: Per release for all customer-facing apps

Incident Reporting

CSCRF mandates strict incident reporting timelines: • Critical incidents: 6 hours to SEBI and CERT-IN • High severity: 24 hours • Medium/Low: Next working day Netra's automated incident classification and reporting workflows ensure you never miss a deadline.

Implementation Roadmap

Phase 1 (Months 1-2): Foundation • Conduct baseline assessment • Establish governance structure • Draft/update Cyber Security Policy • Implement basic monitoring Phase 2 (Months 3-4): Core Controls • Deploy SOC capabilities • Implement access controls • Establish VAPT programme • Configure incident management Phase 3 (Months 5-6): Advanced Controls • Integrate threat intelligence • Implement DLP solutions • Conduct DR drills • Prepare for SEBI inspection

Common Compliance Gaps

Gaps that commonly draw attention in inspections: 1. Incomplete asset inventory 2. Missing VAPT schedules 3. Inadequate incident response 4. Weak access controls 5. Missing BCP/DR testing