Skip to main content

SEBI CSCRF · CART · As of May 2026

Continuous Automated Red Teaming for SEBI Regulated Entities

CSCRF mandates half-yearly red teaming for MIIs and Qualified REs. ShadowMap CART provides continuous automated attack simulation between audit cycles — keeping your attack surface tested, not just assessed.

CSCRF's red teaming mandate

Per CSCRF §4 (DE.DP.S4), red teaming exercises are mandatory at the following cadences:

MIIs

Half-yearly red teaming. Full-scope, multi-stage, multi-vector attack simulation covering all critical systems.

Qualified REs

Half-yearly red teaming. Same scope and methodology as MIIs. External + internal attack simulation.

Mid-size and below

No mandatory red teaming. BAS/CART is recommended in consultation with IT Committee (per Aug 2025).

Red teaming under CSCRF is distinct from VAPT. It simulates a real-world adversarial campaign — multi-stage, multi-vector, with a defined objective (data exfiltration, trading-system compromise, clearing-settlement bypass). The deliverable is an attack-narrative report, not a vulnerability list.

ShadowMap CART — continuous between audits

What CART does

Automated attack simulations against your external attack surface — every day, not just twice a year. Multi-stage attack-chain mapping. Exploitability verification. Credential-stuffing and brute-force simulation. New-exposure triggered re-simulation.

How it complements SB red teaming

CART runs continuously — discovering new vulnerabilities, simulating attacks, flagging exploitable paths. When your half-yearly CERT-In empanelled red team engagement approaches, Security Brigade picks up CART's current-state data and conducts the full-scope manual red team — validating findings, executing the human-driven attack chain, and producing the audit-grade report.

CART capabilities

· Multi-stage attack-chain simulation

· Exploitability verification (not just detection)

· Credential-inventory testing (stealer-log integration)

· Multi-host asset tiering and targeting

· Lateral-movement path simulation

· Persistence and OPSEC isolation testing

· New-exposure triggered automatic re-simulation

· Attack-narrative export for audit evidence

· MITRE ATT&CK technique mapping

Aug 2025 clarification: BAS/CART now IT Committee-driven

Per CIR/2025/119, the original CSCRF language ("shall deploy BAS/CART") was softened to: "Recommended in consultation with the IT Committee."

What this means for MIIs and QREs

Half-yearly manual red teaming is still mandatory. CART/BAS is an additional IT Committee-recommended layer — continuous automated testing between the mandatory manual engagements.

What this means for Mid-size and below

No mandatory red teaming exists. CART/BAS can be recommended by the IT Committee as a proportionate control — providing automated attack-surface testing without the cost of a full manual red team.

Ready to deploy CART for your CSCRF compliance?

Security Brigade InfoSec Pvt. Ltd. · CERT-In Empanelled since 2008 · www.securitybrigade.com · www.shadowmap.com · [email protected]