SEBI CSCRF Audit
Cyber Security and Cyber Resilience Framework audit for SEBI-regulated market infrastructure institutions and intermediaries.
SEBI Cyber Security and Cyber Resilience Framework Audit
The Securities and Exchange Board of India (SEBI) mandates the Cyber Security and Cyber Resilience Framework (CSCRF) for all regulated entities — including stock brokers, depository participants, investment managers, and Market Infrastructure Institutions (MIIs). The framework is structured around five domains mirroring the NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover. Entities are categorised into maturity levels 1 through 5 and must demonstrate progressive control implementation against their assigned tier.
Intelliroot is a CERT-In empanelled and CREST-certified firm with deep capital market domain expertise. We conduct the annual CSCRF audit, prepare the mandatory SEBI compliance report, and support the entity's SEBI CIRT incident reporting obligations — providing a single point of accountability for all SEBI cybersecurity regulatory deliverables.
Why SEBI CSCRF Compliance Cannot Wait
Mandatory Annual Submission
SEBI requires all regulated entities to submit an annual cybersecurity compliance report prepared by a qualified auditor. Non-submission or gaps identified in the report attract regulatory action and potential licence implications.
Maturity Level Accountability
SEBI categorises entities into five maturity tiers based on size and criticality. Each tier has a defined minimum control baseline — falling below your assigned tier level is a direct regulatory breach.
Capital Markets Are High-Value Targets
Trading platforms, order management systems, and market data feeds are prime targets for nation-state actors, insider threats, and financially motivated attackers. CSCRF controls directly address these vectors.
Qualified Auditor Requirement
SEBI requires the CSCRF audit to be conducted by a CERT-In empanelled organisation with capital market domain experience. Intelliroot satisfies both requirements, ensuring your audit report is regulator-accepted without challenge.
CSCRF Domains Covered
Identify & Govern
- Asset inventory and classification
- Cyber risk management framework assessment
- Governance structure and board oversight
- Third-party and supply chain risk evaluation
Protect
- Access control and identity management
- Data security and encryption controls
- Secure configuration and patch management
- Network segmentation and perimeter defence
Detect
- Security monitoring and SIEM coverage
- Anomaly and event detection capabilities
- Log management and retention compliance
- Threat intelligence integration
Respond & Recover
- Incident response plan and playbook review
- SEBI CIRT reporting capability assessment
- Business continuity and disaster recovery testing
- Recovery time and recovery point objective verification
Our CSCRF Audit Approach
Entity Classification & Scoping
Determine the entity's SEBI-assigned maturity level tier, define the audit scope boundary (trading systems, network, applications, third-party connections), and confirm the applicable CSCRF control baseline for that tier.
Document Review & Policy Gap Analysis
Review information security policies, risk management frameworks, BCP/DR documentation, and vendor contracts against CSCRF requirements. Identify documentation gaps and classify findings by domain.
Technical Assessment
Conduct vulnerability assessment of trading infrastructure, network security review, configuration audit of critical systems (order management, market data, settlement), and endpoint security review across the in-scope environment.
Control Testing & Interviews
Test implemented controls against CSCRF requirements through interviews with CISO, IT, and operations staff. Validate access control effectiveness, monitoring coverage, and incident response readiness through tabletop exercises.
Maturity Scoring & SEBI Report Preparation
Score controls against the five CSCRF domains, calculate maturity scores, and prepare the annual compliance report in SEBI's prescribed format — including the mandatory attestation and qualified auditor sign-off.
Frequently Asked Questions
Deliverables
SEBI Annual Compliance Report
CSCRF compliance report in SEBI's prescribed format, signed by the qualified CERT-In empanelled auditor, ready for submission to SEBI.
Maturity Scorecard
Domain-wise maturity scores across all five CSCRF domains — Identify, Protect, Detect, Respond, and Recover — with benchmark comparison against your assigned tier.
Gap Register & Control Mapping
Detailed register of all findings mapped to specific CSCRF control requirements, with risk ratings, evidence references, and recommended remediation actions.
Board Presentation Pack
Executive-level presentation summarising the audit outcome, risk posture, critical findings, and remediation priorities — formatted for SEBI-required Board IT/Risk Committee reporting.
Remediation Roadmap
Prioritised remediation plan with effort estimates, ownership assignments, and compliance deadline alignment to the next SEBI annual reporting cycle.
Request a Security Assessment
Tell us about your environment and security objectives. We'll design a bespoke assessment and deliver a detailed proposal within 48 hours.