Security Brigade is the only CERT-In empanelled firm that delivers SEBI CSCRF compliance as a single bundled engagement covering VAPT, Attack Surface Management, Breach Attack Simulation, and compliance reporting for every category of SEBI regulated entity.
The SEBI Cyber Security and Cyber Resilience Framework mandates comprehensive cyber resilience controls for all SEBI regulated entities. Non-compliance risks SEBI enforcement action, trading restrictions, and reputational damage. Security Brigade has helped capital markets firms, depositories, and asset management companies achieve SEBI CSCRF compliance with structured methodology, in-house tooling, and regulator-ready deliverables backed by CERT-In empanelled audit experience.
Trusted by India's leading enterprises
The moving target
CSCRF has been amended continuously since August 2024. An engagement scoped against the master circular alone is scoped against a text that no longer governs.
Read clause by clause
Each row is the CSCRF clause, what it said, and what it now reads as. These are the sentences an assessment should be scoped against.
| Clause | As issued | As clarified |
|---|---|---|
| DE.CM.S3, guideline 3.c | REs shall deploy solutions such as BAS, CART, decoy, vulnerability management and similar, to enhance their cybersecurity posture. | It is recommended that REs consider deploying a range of security solutions in consultation with their IT Committee: threat simulation, vulnerability management and decoy systems. The obligation is softened and the two acronyms no longer appear. |
| PR.IP.S16 | ISO 27001 certification mandatory for MIIs and Qualified REs, to be obtained within one year of issuance. | Qualified REs are encouraged and recommended to obtain ISO 27001 certification. Market Infrastructure Institutions are unchanged. |
| PR.AA.S16 | Mobile application security guidelines stated as obligations. | Recommendatory in nature, in SEBI’s own characterisation. |
| PR.AA.S4 / S5 | REs shall follow a zero-trust security model such that access to critical systems is denied by default. | REs shall implement suggested strategies and methodologies (zero-trust networks, segmentation, no single point of failure, high availability) approved by the IT committee. |
| Critical systems definition | Included all ancillary systems used for accessing or communicating with critical systems. | Reads as any other system on the same network segment where the critical systems are deployed. A narrower and far more testable boundary, and it changes scope directly. |
| GV.SC.S2 | Suppliers and third parties shall be identified, prioritised and assessed through a cyber-supply-chain risk assessment process. | That process may be done in consultation with the RE’s IT committee. |
| Recovery objectives | Recovery objectives stated in the framework. | RPO for critical systems is 15 minutes, anchored to the SEBI circular of 22 March 2021 on BCP and DR for MIIs. Recovery plans are to be scenario-based, including scenarios where the objective is not achieved. |
DE.CM.S3, guideline 3.c
PR.AA.S16
PR.AA.S4 / S5
Critical systems definition
GV.SC.S2
Recovery objectives
If more than one regulator applies
A great many SEBI-regulated entities are regulated somewhere else as well: a bank that is also a depository participant, an insurer that is also a portfolio manager, a group running a broking arm beside an NBFC. The August 2025 clarifications addressed this directly with two principles. Exclusivity means CSCRF applies to the SEBI-regulated activity, not to everything the legal entity does, which makes the scope boundary a question about business lines and not about infrastructure. Equivalence means that where another regulator’s framework already covers the same ground, the duplicate exercise need not be repeated. Both are useful and both are routinely over-read. They reduce duplicated audit effort; they do not merge two compliance positions into one, and they do not decide themselves. An entity claiming equivalence has to be able to show the mapping that supports it, control by control, to a supervisor who is entitled to disagree. In practice this is the most valuable hour of a scoping conversation for a multi-regulator group, because it is where the difference between one assessment and three is decided, and because getting it wrong in the generous direction is the version that is discovered during an inspection.
How we scope it
CSCRF is not one control set. What applies to you is decided by category and tier before any testing is scoped.
Step one
Entity category, then tier, read against the April 2025 thresholds, not the master circular’s. For groups, the Exclusivity boundary is drawn here. This is the step that most often changes a buyer’s expectation of the engagement, in both directions.
Step two
Applicable CSCRF standards mapped to real systems, with the critical-systems boundary drawn on the clarified definition, same network segment, instead of the broader original. Scope that is drawn on superseded wording is either over-tested or indefensible.
Step three
Application, API, network and infrastructure testing across the systems in scope, performed by a CERT-In empanelled team because that is the precondition every Indian regulator applies to the assessment.
Step four
The clarifications direct REs to submit the summary of VAPT and cyber audit reports. A report written only for a technical reader and a summary assembled afterwards is the common failure; we write the submission and the remediation view as one artefact, tracked to verified closure in Lemon.
Methodology
Every engagement follows this process through Lemon, our proprietary audit management platform.
Security Brigade delivers SEBI CSCRF compliance through a structured methodology refined across multiple audit cycles for stock brokers, depository participants, AMCs, mutual funds, and other SEBI regulated entities. Every phase is tracked through our Lemon audit management platform with full evidence traceability.
Identify your SEBI CSCRF tier based on entity type, scale, and systemic importance. Map applicable controls for stock brokers, depository participants, AMCs, mutual funds, MIIs, or other regulated entities. Define audit scope, systems inventory, and timeline.
Evaluate current cybersecurity posture against all applicable SEBI CSCRF controls. Assess SOC/M-SOC readiness, vulnerability management maturity, DC/DR preparedness, incident handling capability, and governance reporting. ShadowMap scan identifies external attack surface exposure.
Execute VAPT across applications, APIs, networks, and infrastructure. Conduct Breach Attack Simulation to validate SOC detection. Perform red team assessment for MII-tier entities. Run ShadowMap for continuous attack surface monitoring and dark web credential exposure checks.
Deliver prioritised remediation roadmap with actionable guidance. Track all findings through Lemon with developer-friendly PoCs and specific remediation steps. Retest every fix with confirmed closure status, generating evidence that satisfies SEBI CSCRF audit requirements.
Produce regulator-ready SEBI CSCRF compliance audit report with control mapping, evidence references, executive summary, and board presentation pack. CERT-In empanelled auditor attestation. Governance documentation aligned to SEBI reporting requirements.
"We needed an assessment on a 3-week timeline because of a partner integration deadline. Security Brigade turned it around in 18 days, including the L2 and L3 reviews. The report was regulator-ready — we submitted it to our partner's compliance team unchanged. When speed and credibility both matter, they're the only call we make."
Continuous Compliance with ShadowMap
An annual audit proves your posture at a single point in time. Between audits, attack surfaces drift, credentials leak, sub-domains get added, vendors get breached. ShadowMap watches the boundary continuously so the next audit isn't a surprise.
Continuous discovery of internet-facing assets: sub-domains, APIs, cloud resources, open ports, SSL certificates, technology stack.
Audits are point-in-time. ShadowMap watches your boundary daily.
Explore on ShadowMapAutomated vulnerability detection and validation on your live attack surface — exploit context delivered, not just scanner noise.
Annual audits prove a moment. CART proves resilience continuously.
Explore on ShadowMapThe platform underneath
CSCRF keeps several testing obligations apart and they run to different clocks, which is where most scoping errors on this framework start. B-52 takes them one at a time and says which a continuous platform can serve.
FAQ
Answers that track the amendments, not the master circular alone. Talk to our team about your category and tier.
Contact usCERT-In empanelled since 2008. VAPT, ASM, BAS, Red Team, Dark Web Monitoring, and compliance reporting from one team.
Typically responds within 1 business day · No commitment required
Proof
By entity type
CSCRF classifies 18 categories of regulated entity, and the test is different for almost every one. Each page states what decides your tier and what that tier requires.
Our reading of the circulars
