SEBI CSCRF Compliance: What Market Intermediaries Must Do in 2026

TL;DR

• Start with your category. CSCRF is graded across five tiers, and every control decision follows from which one you are in. Get this wrong and you audit against the wrong requirements.

• Implementation deadlines have passed. The final extension expired 31 August 2025. SEBI is in the assurance phase now, so the pressure is audit evidence.

• Incident reporting changed in August 2026. The portal moved to the FSB FIRE format with staged reports. Six hours by email, 24 hours on the portal.

• MIIs have a new index landing. The IT Resilience Index becomes operational 28 February 2027, first measured for the half-year ending 31 March 2027.

• A SOC is mandatory for every regulated entity except client-based brokers with fewer than 100 clients. Three ownership models are permitted.

• Outsourcing your SOC does not outsource your accountability. The filing obligation and the audit response stay with you.

What is SEBI CSCRF?

The Cybersecurity and Cyber Resilience Framework is SEBI's single cyber regulation for its regulated entities, issued as circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113. It replaced the earlier set of cyber circulars that applied separately to brokers, depository participants, mutual funds and others, and has since been clarified twice, on 30 April 2025 and 28 August 2025.

It is organised around five cyber resilience goals:

• Anticipate – know your assets, your threats and your exposure before an incident.

• Withstand – protective controls that hold under pressure.

• Contain – limit the blast radius once something is inside.

• Recover – restore service within defined targets.

• Evolve – feed what you learn back into the programme.

Those goals sit over six operational functions adapted from the NIST Cybersecurity Framework: Governance, Identify, Protect, Detect, Respond and Recover.

The important structural difference from the old circulars is that CSCRF is proportionate. A debenture trustee and a stock exchange are not held to the same standard.

Which CSCRF category does your firm fall into?

This is the first thing to settle, because everything downstream depends on it.

Category is assessed annually against the previous financial year, using measures such as active client count, trading volume, assets under management, assets under custody, corpus or folio count. Where a firm holds multiple registrations, the highest applicable category governs for the full year.

Be careful with threshold figures you find online. Published summaries of the client, volume and AUM cut-offs disagree with each other, and several are inconsistent on units. We have deliberately not reproduced numbers we cannot stand behind. Confirm your category against the circular and its amendments with your compliance adviser. A firm sitting near a boundary should get that confirmation in writing, because the control sets either side of it differ materially.

What does each CSCRF category have to do?

Three things firms get wrong here.

• ISO 27001 for Qualified REs is no longer mandatory. The original circular required certification within a year. The August 2025 clarification made it recommendatory. If your project plan still carries it as a hard requirement at that tier, you may be spending on something SEBI no longer mandates.

• Your auditor must be CERT-In empanelled. Every RE other than a Self-certification RE needs a CERT-In empanelled auditor for external and cyber audits. A completed audit signed by a firm without that empanelment is not acceptable, and finding out late means repeating the exercise.

• Open VAPT findings need committee approval. Anything still open after three months requires sign-off from your IT Committee. That is a governance step, and it is the one most commonly missing from the evidence pack.

What is the Cyber Capability Index, and who needs it?

The Cyber Capability Index is CSCRF's maturity measure. Each verified control feeds a parameter score, and those aggregate into an overall index and a maturity band. SEBI sets the parameters and weightings in the circular's annexures.

It applies to two tiers only:

• MIIs – assessed half-yearly by a third party.

• Qualified REs – self-assessed annually.

Mid-size, Small-size and Self-certification REs have no CCI obligation.

The practical failure we see is a CCI that exists as a number with nothing substantiating it. The index is only as defensible as the evidence behind each parameter, and an auditor will test the evidence rather than accept the score.

Is a SOC mandatory under CSCRF, and which model should you choose?

Yes. A SOC is mandatory for every regulated entity except client-based stock brokers with fewer than 100 clients.

Three ownership models are permitted, and the choice is a cost and accountability decision rather than a technical one.

Two points worth knowing before you decide.

• The Market SOC does more than monitoring. For small and mid-size REs it also provides VAPT and cyber audit services, which makes it the cheapest compliant route for a firm with no internal security function.

• A SIEM licence is not a SOC. CSCRF expects continuous monitoring with named human analysis behind it. An unmonitored log platform satisfies neither the control nor the six-hour reporting clock.

Whichever model you pick, the accountability does not move. SEBI holds the regulated entity responsible for the filing, the evidence and the audit response. Your contract should name who detects, who drafts the report and who files it, with a deputy for leave.

NetNXT delivers the managed route as a managed security operations service with India-located SOCs and CSCRF-aligned reporting. Our 24×7 monitoring and response blueprint sets out what the operating model should cover, whoever provides it.

What are the CSCRF incident reporting timelines?

Three clocks, and this is where most published guidance is vague or silent.

1. Within 30 minutes – declare a "Disaster" where critical systems are disrupted, based on your documented business impact analysis.

2. Within 6 hours of detection – notify SEBI by email, and notify CERT-In under its April 2022 directions.

3. Within 24 hours – file on SEBI's Cyber Incident Reporting Portal.

Since 24 August 2026 the portal uses the Financial Stability Board's FIRE format. Reports are now staged into an initial report, intermediate updates and a final report. The deadlines did not change, but the workflow did. Your runbook needs an owner for each stage and a process for issuing intermediate updates while the investigation is still open.

Two operational realities behind these numbers.

• Six hours runs from detection, so something has to detect. An incident found on Monday morning that started on Friday night has already missed every window. This is the clearest compliance argument for round-the-clock monitoring.

• Test the process out of hours. A reporting chain exercised only at 11 a.m. on a working day has not been exercised. The same accountability question applies here as to CERT-In-compliant providers generally.

What changed for CSCRF in 2026, and what is coming in 2027?

Four developments, most consequential first.

• FIRE-format reporting, live since 24 August 2026 – staged incident reports through SEBI's portal, as described above. This affects every RE and is the change most guidance has not caught up with.

• IT Resilience Index for MIIs, announced 24 August 2026 – a nine-parameter weighted index, with Availability and Security each carrying 20%. It becomes operational on 28 February 2027, the first assessment period is the half-year ending 31 March 2027, and reports are due within 60 days of each period end. If you are an MII, this is a 2027 obligation you build for during 2026.

• AI-tools vulnerability advisory, issued 5 May 2026 – SEBI asks REs to patch promptly and use virtual patching where no fix exists, to run both conventional and AI-assisted vulnerability assessments, to secure APIs, to expedite Market SOC onboarding, to adopt Zero Trust, and to keep asset inventories and software bills of materials current. Advisory items become audit evidence in the following cycle, so treat them as expectations. The Zero Trust item is an architecture decision, and a Zero Trust access model produces the access records an auditor asks for as a by-product rather than a reporting exercise.

• MII subsidiaries consultation, issued 11 September 2026 – SEBI proposed extending the IT and cyber framework to MII subsidiaries that perform an MII function, handle protected data, or share technology infrastructure. Comments closed 2 October 2026. This is a proposal, so plan for it without building to it yet.

One thing that has not changed. Data localisation under PR.DS.S2 remains in abeyance. Abeyance is not repeal. Regulatory Data is still expected to be held in India in accessible, usable form, and IT and cybersecurity data held outside India must be retrievable within 48 hours. Do not re-architect on the assumption it has gone away.

How does CSCRF compare with RBI and CERT-In obligations?

Many intermediaries sit under more than one regime, and the overlap is where effort gets duplicated.

The useful conclusion is that one control environment can serve several regimes if you build the evidence once and map it to each. Separate programmes per regulator is how compliance budgets get spent twice.

Where do CSCRF audits usually fail?

The recurring findings are evidential rather than technical. Firms generally have the controls. What they lack is proof in the form an auditor accepts.

• Wrong category – audited against the wrong tier, so either over-spent or missing a mandatory control.

• Auditor not empanelled – audit complete, report not acceptable, exercise repeated.

• CCI without substantiation – a score with no evidence behind individual parameters.

• No closed loop on VAPT – findings identified, remediation untracked, no IT Committee approval for items open past three months.

• Reporting never drilled out of hours – the six-hour chain has only ever been tested during business hours.

• Policy approved once – the cyber security and cyber resilience policy needs Board approval and at least annual review, with minutes to prove both.

• Third-party scope missed – cloud, API and vendor controls left out, on the assumption the provider covers them.

• Evidence assembled rather than produced – everything exists, spread across four systems, and the first week of the audit goes on collecting it.

That last point separates a smooth audit from a difficult one. Compliance automation maps CSCRF controls to continuous evidence, so an auditor request becomes an export.

What governance does CSCRF require?

• Board – approves the cyber security and cyber resilience policy with at least annual review, approves the risk appetite statement, and receives periodic assurance.

• IT or Technology Committee – reviews cyber posture periodically, monitors the CCI and remediation, approves VAPT reports before submission, and signs off any finding open beyond three months.

• CISO – a designated senior officer with defined authority, reporting to the Board or the IT Strategy Committee, owning the programme and the regulatory reporting.

• Incident Response Management Plan – required for every RE except Self-certification REs.

• Source code access – MIIs and Qualified REs must obtain source code for critical applications from third-party providers.

A practical sequence for the next quarter

1. Confirm your category in writing, from the circular, with compliance sign-off. Everything else depends on it.

2. Check your auditor's CERT-In empanelment before the next cycle is scoped.

3. Rebuild your incident runbook for FIRE staging, with named owners for the initial, intermediate and final reports, and run the drill out of hours.

4. Close the VAPT loop, including IT Committee approval for anything open past three months, with dates and minutes.

5. Substantiate the CCI parameter by parameter, if you are an MII or Qualified RE.

6. Bring third-party, cloud and API scope into the evidence pack, not just your own infrastructure.

7. If you are an MII, start building for the IT Resilience Index now, so the half-year ending 31 March 2027 is measured on a system that already works.

Conclusion

CSCRF has moved past implementation. What decides your next audit is whether your tier is correctly assessed, your auditor is empanelled, and your evidence can be produced on request rather than assembled under pressure.

Settle the category question first. Then make the evidence continuous.

Want your CSCRF controls mapped against your actual category? Talk to NetNXT.

This article summarises CSCRF for planning purposes and is not legal or compliance advice. Category thresholds, control requirements and reporting obligations should be confirmed against SEBI circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, its clarifications of 30 April 2025 and 28 August 2025, and subsequent circulars and advisories, with your compliance adviser. Where published sources conflict, we have said so rather than choosing a figure.

FAQs

1) Who does SEBI CSCRF apply to?

All SEBI regulated entities, graded into five categories: Market Infrastructure Institutions, Qualified REs, Mid-size REs, Small-size REs and Self-certification REs. Category is assessed annually against the previous financial year using measures such as client count, trading volume, AUM, AUC, corpus or folios. Where a firm holds multiple registrations, the highest applicable category governs.

2) Is a SOC mandatory under SEBI CSCRF?

Yes, for every regulated entity except client-based stock brokers with fewer than 100 clients. You may run your own or a group SOC, contract a third-party managed SOC, or onboard to the Market SOC operated by NSE and BSE. Small-size and Self-certification REs must use the Market SOC, which also provides VAPT and cyber audit services to small and mid-size REs. Accountability for reporting and audit response stays with the regulated entity in every model.

3) What are the CSCRF incident reporting timelines?

Declare a Disaster within 30 minutes where critical systems are disrupted. Notify SEBI by email and CERT-In within six hours of detection. File on SEBI's Cyber Incident Reporting Portal within 24 hours. Since 24 August 2026 the portal uses the FSB FIRE format, with staged initial, intermediate and final reports.

4) How often does CSCRF require VAPT and cyber audits?

VAPT is twice a year for MIIs and annual for all other categories. Cyber audits are twice a year for MIIs and Qualified REs and annual for the rest. Red teaming and threat hunting apply only to MIIs and Qualified REs. Every RE other than a Self-certification RE must use a CERT-In empanelled auditor.