Skip to main content

SEBI CSCRF · CART · As of May 2026

Continuous Automated Red Teaming for SEBI Regulated Entities

CSCRF mandates half-yearly red teaming for MIIs and Qualified REs. ShadowMap CART provides continuous automated attack simulation between audit cycles, so the attack surface stays tested in the months between engagements.

CSCRF's red teaming mandate

Per CSCRF §4 (DE.DP.S4), red teaming exercises are mandatory at the following cadences:

MIIs

Half-yearly red teaming. Full-scope, multi-stage, multi-vector attack simulation covering all critical systems.

Qualified REs

Half-yearly red teaming. Same scope and methodology as MIIs. External + internal attack simulation.

Mid-size and below

No mandatory red teaming. BAS/CART is recommended in consultation with IT Committee (per Aug 2025).

Red teaming under CSCRF is distinct from VAPT. It simulates a real-world adversarial campaign: multi-stage, multi-vector, with a defined objective (data exfiltration, trading-system compromise, clearing-settlement bypass). The deliverable is an attack-narrative report, not a vulnerability list.

ShadowMap CART runs between audits

What CART does

Automated attack simulations against your external attack surface, every day instead of twice a year. Multi-stage attack-chain mapping. Exploitability verification. Credential-stuffing and brute-force simulation. New-exposure triggered re-simulation.

How it complements SB red teaming

CART runs continuously, discovering new vulnerabilities, simulating attacks and flagging exploitable paths. When your half-yearly CERT-In empanelled red team engagement approaches, Security Brigade picks up CART's current-state data and conducts the full-scope manual red team: validating findings, executing the human-driven attack chain and producing the audit-grade report.

CART capabilities

· Multi-stage attack-chain simulation

· Exploitability verification (not just detection)

· Credential-inventory testing (stealer-log integration)

· Multi-host asset tiering and targeting

· Lateral-movement path simulation

· Persistence and OPSEC isolation testing

· New-exposure triggered automatic re-simulation

· Attack-narrative export for audit evidence

· MITRE ATT&CK technique mapping

Aug 2025 clarification: BAS/CART now IT Committee-driven

Per CIR/2025/119, the original CSCRF language ("shall deploy BAS/CART") was softened to: "Recommended in consultation with the IT Committee."

What this means for MIIs and QREs

Half-yearly manual red teaming is still mandatory. CART/BAS is an additional IT Committee-recommended layer of continuous automated testing between the mandatory manual engagements.

What this means for Mid-size and below

No mandatory red teaming exists. CART/BAS can be recommended by the IT Committee as a proportionate control, providing automated attack-surface testing without the cost of a full manual red team.

Ready to deploy CART for your CSCRF compliance?

Security Brigade InfoSec Pvt. Ltd. · CERT-In Empanelled since 2008 · www.securitybrigade.com · www.shadowmap.com · [email protected]