SEBI Cybersecurity and Cyber Resilience Framework
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF, August 2024) applies to SEBI-regulated entities — stock exchanges and other market infrastructure institutions, brokers, depository participants, mutual funds, investment advisers and more — in five tiers from market infrastructure institutions down to self-certification entities. It is organised into Governance, Identify, Protect, Detect, Respond and Recover standards, scaled by tier.
Example finding{
"ruleId": "soc-2.hardcoded-secret",
"framework": "soc-2",
"severity": "high",
"title": "Hardcoded secret or credential",
"path": "src/api/handler.ts",
"controls": [
"PR.AA"
]
}What SEBI CSCRF expects from engineering.
- 01
Governance
A board-approved cybersecurity policy, defined roles, risk management and oversight of third-party service providers (GV).
- 02
Identify
An inventory of critical systems and data, and regular risk and vulnerability assessment (ID).
- 03
Protect: access
Identity management, strong authentication and least-privilege access control, with user-access logs for critical systems kept for at least two years (PR.AA).
- 04
Protect: data and platforms
Data security at rest and in transit, secure configuration and secure software development (PR.DS, PR.PS).
- 05
Detect and respond
Continuous security monitoring, incident response and reporting to SEBI and CERT-In within the prescribed timelines (DE, RS).
- 06
Recover and audit
Tested recovery plans and periodic cybersecurity audits, VAPT and compliance reporting by tier (RC).
Turned into code rules.
10 rules run when SEBI CSCRF is selected, mapped to 4 SEBI CSCRF controls. Each covers part of a control in code — not the whole control.
- Hardcoded secret or credentialPR.AA
- SQL built from untrusted inputPR.PS
- TLS certificate verification disabledPR.DS
- Unencrypted HTTP connectionPR.DS
- JWT accepted without signature verificationPR.AA
- MD5/SHA-1 used for passwords or tokensPR.AA
- Deprecated cipher or insecure modePR.DS
- Payment webhook signature not verifiedPR.PS
- OTP or PIN written to logsPR.AA · DE.CM
- Bank account, PAN or UPI identifier in plaintextPR.DS
Preparing for an audit? Read the SEBI CSCRF readiness guide — the controls RuleFix checks, what stays organisational, and how to use reports as evidence.
Read the source.
RuleFix links to primary sources so you can check the requirements yourself. We are not affiliated with these bodies.
- Securities and Exchange Board of India (SEBI)Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (20 August 2024)sebi.gov.in
- Securities and Exchange Board of India (SEBI)CSCRF circular — full text (PDF)sebi.gov.in
- CERT-In, Government of IndiaCyber security incident reportingcert-in.org.in
Cover more with the same workflow.
GDPR
HIPAA
LGPD
Ship AI-powered products
that are compliant by design.
Join developers building with RuleFix.