Fulfilling the Requirements of the Cybersecurity and Cyber Resilience Framework

Overview

Provide a comprehensive analysis of SEBI's Cyber Security and Cyber Resilience Framework applicable to Stock Brokers, Depository Participants, Mutual Funds, Asset Management Companies (AMCs), Stock Exchanges, Clearing Corporations, and Depositories.

SEBI Cyber Security and
Cyber Resilience Framework

As a trusted Security Auditor, Security Brigade is equipped to assist you in understanding, managing, and ensuring compliance with SEBI’s Cyber Security and Cyber Resilience Guidelines, which are periodically updated.

In 2018 and 2019, SEBI issued specific guidelines for entities under its jurisdiction, including Stock Brokers, Depository Participants, Mutual Funds, Asset Management Companies (AMCs), Stock Exchanges, Clearing Corporations, and Depositories. Key releases include:

  • December 3, 2018: SEBI Guidelines for Stock Brokers and Depository Participants
  • December 7, 2018: SEBI Guidelines for Stock Exchanges, Clearing Corporations, and Depositories
  • January 10, 2019: SEBI Guidelines for Mutual Funds and Asset Management Companies (AMCs)

Summary of SEBI Guidelines

Identify

critical IT assets and risks associated with such assets

Protect

assets by deploying suitable controls, tools and measures

Detect

incidents, anomalies & attacks through appropriate monitoring processes

Respond

by taking immediate steps after identification of the incident, anomaly or attack

Recover

from incident through incident management, DR & BCP framework.

How THI solutions help with SEBI CSCRF compliance

The Cybersecurity and Cyber Resilience Framework (CSCRF) is a standards-driven framework based on the Cyber Crisis Management Plan (CCMP) established by the Indian Computer Emergency Response Team (CERT-In). It focuses on five key cyber resilience goals — Anticipate, Withstand, Contain, Recover, and Evolve — which are aligned with six essential cybersecurity functions: Governance, Identify, Protect, Detect, Respond, and Recover.

The CSCRF is structured into four comprehensive parts:

  • Part I: Objectives and Standards – Outlines the foundational principles of the framework.
  • Part II: Guidelines – Provides detailed implementation guidance.
  • Part III: Compliance Formats – Contains structured formats to facilitate compliance.
  • Part IV: Annexures and References – Offers additional context and supporting information.

The framework applies to the following Registered Entities (REs) and further classifies them into different categories based on factors such as operational scale, client base, trade volume, and assets under management. It also outlines specific compliance requirements tailored to each category.

  • For REs where cybersecurity and cyber resilience circular already exists – by January 01, 2025.
  • For other REs where CSCRF is being issued for the first time – by April 01, 2025.

Ensuring CSCRF Compliance: How THI Empowers REs with Robust Cybersecurity Solutions

THI supports REs in achieving compliance with CSCRF by addressing the cybersecurity function guidelines of Governance, Identity, and Protection within the framework.

Our solutions focus on three critical areas of cybersecurity: Application Security, Data Security, and Identity & Access Management.
trojanhuntindia_cscrf-1.png