SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued as circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 on 20 August 2024, tells regulated entities in Indian securities markets how to govern, protect, detect, respond to and recover from cyber incidents. Duties scale with the entity's category, and some, like SBOMs and 6 hour incident reporting, apply to all.
How is the framework built?
The circular describes five cyber resilience goals: Anticipate, Withstand, Contain, Recover and Evolve. Each maps to cybersecurity functions such as Governance, Identify, Protect, Detect, Respond and Recover. Entities are placed in one of five groups: market infrastructure institutions (MIIs), Qualified REs, Mid-size REs, Small-size REs and Self-certification REs. The heavier duties fall on MIIs and Qualified REs.
The circular supersedes a list of earlier SEBI cybersecurity circulars and advisories. It gave an implementation date of 1 January 2025 for the six categories of entities that already had a cybersecurity circular, and 1 April 2025 for others getting the framework for the first time. Later SEBI communications may change timelines, so check the SEBI site for the current dates before you plan.
What are the main requirements?
From the circular's own summary:
- Governance. A documented cybersecurity and cyber resilience policy approved by the Board, Partners or Proprietor, with defined roles. MIIs, Qualified REs and Mid-size REs prepare a cyber risk management framework. MIIs get a third-party assessment against the Cyber Capability Index (CCI) every six months, and Qualified REs self-assess yearly.
- Third parties. The entity stays solely accountable for outsourced services, including security of its data and logs.
- Identify. Critical systems are identified and approved by the Board, with periodic risk assessment that includes scenario-based testing and post-quantum risks.
- Protect. Authentication and access policy, log collection and retention, network segmentation, layered disk and file encryption, separate production and non-production environments for critical systems, audits by a CERT-In empanelled auditor, vulnerability assessment and penetration testing, and API and endpoint security with rate limiting and authorisation. ISO 27001 certification is mandatory for MIIs and Qualified REs.
- Detect. Continuous monitoring through a Security Operations Centre, which may be your own, a third party or the market SOC. Small-size and Self-certification REs are onboarded to the market SOC.
- Respond and recover. A documented incident response plan with procedures, a Cyber Crisis Management Plan, root cause analysis, and forensic analysis where the root cause is unclear.
What does the framework say about software supply chain?
The third-party section includes an SBOM duty. For new software procurements covering core and critical activities, entities must obtain an SBOM and keep it updated with every upgrade or change. Where an SBOM cannot be obtained for legacy or proprietary systems, the Board, Partners or Proprietor must approve that with a stated limitation, rationale and risk approach. A separate guideline asks entities to obtain SBOMs for existing critical systems within six months of the circular's issue and to include open source and third-party components, their versions and patch status.
What is the incident reporting clock?
Incidents covered by CERT-In's cybersecurity directions must be notified to SEBI and CERT-In within 6 hours of noticing them, by email, with details on the SEBI incident portal within 24 hours. Stock brokers and depository participants also report to exchanges and depositories. Other incidents are reported on the portal.
Constructed example: a small broker's research portal runs a third-party charting library. A vulnerable version is found on a Monday. Under the framework the broker should already hold an SBOM for that system, know the library's version, and have a named person who can start the 6 hour clock if exploitation is suspected.
What to do
- Confirm your CSCRF category in the circular and the current dates on the SEBI site.
- Record Board approval for the cyber policy and the list of critical systems.
- Build a register of third-party providers with the security terms you hold from each.
- Collect SBOMs for critical systems and new procurements, and a dated exception approval for any you cannot get.
- Put a vulnerability assessment and penetration testing schedule in place for critical systems.
- Write the incident procedure with the 6 hour and 24 hour steps and name who sends them.
- Keep evidence in one place: policies, approvals, test reports, SBOMs and incident drills.
Safeguard SBOM generation, dependency scanning and compliance automation can help you collect and keep SBOM evidence. The framework does not certify anyone, and neither does Safeguard.
Quick check
Does every regulated entity need ISO 27001 certification?
No. The circular makes it mandatory for MIIs and Qualified REs. Other categories follow the duties listed for their group.
Is an SBOM required?
For critical systems and new procurements of core and critical software, yes, with an approved exception route for legacy or proprietary systems.
Sources
- SEBI circular on CSCRF, 20 August 2024 and its attached PDF, fetched 18 October 2026
Last reviewed: 18 October 2026.
