SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued 20 August 2024, tells regulated entities to obtain SBOMs for new software procurements of core and critical activities and keep them updated with every change. Where an SBOM cannot be had for a legacy or proprietary system, the Board must approve the exception with its rationale and risk approach.
What the framework says
Under the supply chain standard (GV.SC), the text says an SBOM "shall be obtained for all new software procurements of core and critical activities and kept updated with every upgrade or change". The guideline marked mandatory for all regulated entities adds:
- Obtain SBOMs for existing critical systems within 6 months of the framework's issuance.
- Obtain SBOMs for new critical software products and SaaS at the time of procurement, covering open source and third party components, versions and patch status.
- Market infrastructure institutions include SBOM in empanelment criteria for application software vendors.
The framework's own box on SBOMs lists the benefits it expects: transparency about components, versions, licences and hashes; tracking vulnerability status per component; mitigating open source and third party risk; and audit of authorised dependencies.
What an SBOM must contain under CSCRF
The guideline says an SBOM should include, but not be limited to:
- licence information and the supplier name
- all primary components with their transitive dependencies and relationships
- encryption used
- cryptographic hash of components
- frequency of updates
- known unknowns, where the SBOM lacks a full dependency graph
- access control
- methods for accommodating occasional incidental errors
What a vendor should be ready to send
- An SBOM in a standard format for each release, with transitive dependencies, not only top level packages.
- Hashes per component.
- A statement of where the graph is incomplete, which the framework calls known unknowns.
- An update commitment, since the SBOM must follow every upgrade or change.
- Licence data.
Common gaps
Three gaps appear often. SBOMs list only direct packages, so transitive dependencies are missing. They are generated once and never refreshed, while the framework wants them kept updated with every upgrade or change. And container images carry operating system packages that never show up in a language level SBOM. Cover all three before you send one to a customer.
A note on currency
This post reads the 20 August 2024 circular text. SEBI has issued further communications on CSCRF since, so check the current SEBI website for later changes to timelines and applicability before you rely on any date here.
Try it yourself
In the demo, build a dependency inventory and see which components appear only as transitive dependencies. Those are the ones a top level list would miss.
Click through it at your own pace, or open it full screen.
Safeguard generates SBOMs and scans dependencies. Whether the output satisfies a given regulated entity is for that entity to judge.
Quick check
Does CSCRF say which SBOM format to use?
The text I reviewed lists required content but does not name a format. Check with your customer.
Sources
Last reviewed: 19 October 2026.
