Under SEBI's CSCRF circular of 20 August 2024, a cyber attack or breach that falls under the CERT-In directions must be notified to SEBI and CERT-In within 6 hours of noticing it. Details also go on the SEBI incident reporting portal within 24 hours. Other cybersecurity incidents are reported to SEBI, CERT-In and NCIIPC, as applicable, within 24 hours.
What the guideline says
The response guideline (RS.CO) is marked mandatory for all regulated entities:
- Incidents falling under the CERT-In Cybersecurity directions: notify SEBI and CERT-In within 6 hours of noticing or being told. Share with SEBI by email to the market incidents mailbox within 6 hours.
- Necessary details on the SEBI Incident Reporting Portal within 24 hours.
- Stock brokers and depository participants also report to stock exchanges or depositories, along with SEBI and CERT-In, within 6 hours.
- All other cybersecurity incidents: SEBI, CERT-In and NCIIPC as applicable, within 24 hours.
- Threat intelligence data collected and analysed is shared on the SEBI portal.
Other response requirements in the summary: an Incident Response Management plan with SOPs, a Cyber Crisis Management Plan, root cause analysis after incidents, and forensic analysis if the RCA is inconclusive.
How it ties to CERT-In
The CERT-In directions already use a 6 hour window for listed incident types. CSCRF reuses that boundary and adds SEBI as a recipient, plus the 24 hour portal filing. One incident can therefore trigger three outputs: a CERT-In report, a SEBI email and a SEBI portal entry.
Common mistakes
Teams often start the clock at confirmation instead of at noticing. They also send the 6 hour notice but forget the 24 hour portal entry, or the other way round. A single checklist with three tick boxes and three timestamps avoids both.
Runbook changes for a regulated entity or its vendor
- Add SEBI mailbox and portal steps to the existing CERT-In runbook.
- Keep one incident timeline that all three submissions quote.
- Pre-fill the portal fields you can from your incident record.
- Assign RCA owners and a deadline, since the framework expects root cause analysis.
- Run a drill that includes the exchange or depository step if you are a broker or depository participant.
Vendors to SEBI regulated firms should expect contract clauses requiring fast notification to the customer so the customer can meet its own 6 hour window. Offer a notification time you can keep.
A note on currency
This is the August 2024 text. SEBI has issued later communications on CSCRF, so confirm current incident reporting details on the SEBI website.
Quick check
Is the 24 hour portal filing instead of the 6 hour report?
No. The 6 hour notice goes to SEBI and CERT-In, and the portal filing within 24 hours adds details.
Does a vulnerability alone trigger this?
The trigger is an attack, incident or breach. CERT-In's FAQ says standalone vulnerability reporting is not mandatory.
Sources
- SEBI circular on the Cybersecurity and Cyber Resilience Framework (CSCRF), 20 August 2024
- CERT-In Directions of 28 April 2022
- CERT-In FAQs on the Cyber Security Directions, May 2022
Last reviewed: 19 October 2026.
