SEBI · CSCRF
SEBI CSCRF cyber audits, sized to your category
Cyber audits, VAPT and SOC readiness for SEBI-regulated entities, with findings closed well before the next submission.
What is SEBI CSCRF?
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued in August 2024, sets cybersecurity requirements for SEBI-regulated entities such as stock brokers, depositories, mutual funds and portfolio managers. It requires cyber audits, VAPT, SOC capability and incident reporting, scaled to the entity's category.
One framework, five categories, different obligations.
CSCRF replaced earlier SEBI cyber circulars with one framework. What you must do depends on your category, from twice-yearly audits for MIIs and qualified REs to VAPT-only for self-certification REs. HostX scopes your audit to exactly what your category requires.
Category assessment before scoping
Audit, VAPT and SOC evidence in one engagement
Findings closed within CSCRF timelines
What our CSCRF service covers
Category & gap assessment
Your RE category and gaps against CSCRF.
Cyber audit
Critical systems in full; non-critical systems sampled.
VAPT
Testing of in-scope systems and applications.
SOC readiness
Own SOC, market SOC or third-party SOC set-up.
Policies
Cybersecurity and cyber resilience policy set.
Incident response
Response plan and reporting readiness.
How a CSCRF audit runs
Categorise
Confirm your RE category.
Gap assessment
Against CSCRF requirements.
VAPT
Test critical and sampled systems.
Cyber audit
Controls, evidence and interviews.
Report
Findings mapped to CSCRF clauses.
Closure
Fix, verify and follow-on audit.
CSCRF audit frequency by category
| RE category | Cyber audit frequency |
|---|---|
| Market Infrastructure Institutions (MIIs) | Twice a year |
| Qualified REs | Twice a year |
| Mid-size and small-size REs with internet-based or algorithmic trading | Twice a year |
| Other mid-size and small-size REs | Once a year |
| Self-certification REs | VAPT only; no periodic cyber audit |
CSCRF at a glance
| Item | Detail |
|---|---|
| Issued | August 2024, by SEBI |
| Applies to | SEBI-regulated entities, incl. stock brokers, depository participants, AMCs, portfolio managers, KRAs and MIIs |
| Audit coverage | All critical systems and a sample of non-critical systems |
| Finding closure | Vulnerabilities to be closed within set timelines, verified in a follow-on audit |
| SOC | SOC capability required: own SOC, group SOC, market SOC or third-party managed SOC |
What you get
Who needs SEBI Audit?
Stock brokers and depository participants
Asset management companies and mutual funds
Portfolio managers and investment advisers
KYC registration agencies and other SEBI REs
Why teams choose HostX for SEBI Audit
Category-aware
No over- or under-scoping.
One engagement
Audit, VAPT and SOC together.
Closure support
We help fix, then verify.
SOC on tap
HostX Managed SOC can meet your SOC requirement.
Related services
Frequently asked questions
Get CSCRF-ready before your next submission.
Book a consultation and we will confirm your category and scope.