SEBI CSCRF readiness
How to prepare for SEBI Cybersecurity and Cyber Resilience Framework: what it requires, which of its controls RuleFix checks in your code, what remains organisational, and how to turn RuleFix scans into audit evidence.
On this page
What SEBI CSCRF requires
There is no CSCRF certificate. Regulated entities demonstrate compliance through periodic cybersecurity audits by CERT-In-empanelled auditors, VAPT and compliance reports submitted to SEBI or their stock exchange or depository, with frequency and depth set by the entity's category. Market infrastructure institutions and qualified entities also report a Cyber Capability Index.
SEBI-regulated entities in five categories — market infrastructure institutions, qualified, mid-size, small-size and self-certification entities. The compliance deadline was last extended to 31 August 2025 for most entities. The data localisation requirement was put in abeyance in December 2024 and is still under consultation.
- Governance (GV). Board-approved cybersecurity and cyber resilience policy, roles, risk management, and oversight of third-party service providers.
- Identify (ID). Inventory of critical systems and data, risk assessment and vulnerability management.
- Protect (PR). Identity and access management with strong authentication, data security at rest and in transit, secure configuration and secure software development; user-access logs for critical systems kept for at least two years.
- Detect (DE). Continuous security monitoring through a security operations centre (own or market SOC, depending on category).
- Respond (RS). Incident response plans and reporting of cyber incidents to SEBI and to CERT-In (within six hours under CERT-In's 2022 directions).
- Recover (RC). Tested recovery plans, recovery time objectives and post-incident review.
What RuleFix checks in code
10 RuleFix rules run when SEBI CSCRF is selected on a project. 4 of the framework's controls have at least one rule mapped to them. The table is generated from the rule catalogue, so it always matches what the scanner runs.
| Control | What it requires | RuleFix rules |
|---|---|---|
DE.CM | Detect: continuous security monitoring | |
PR.AA | Protect: identity management, authentication and access control | |
PR.DS | Protect: data security (confidentiality and integrity of data at rest and in transit) | |
PR.PS | Protect: platform security, including secure software development |
DE.CM- What it requires
- Detect: continuous security monitoring
- RuleFix rules
PR.AA- What it requires
- Protect: identity management, authentication and access control
PR.DS- What it requires
- Protect: data security (confidentiality and integrity of data at rest and in transit)
PR.PS- What it requires
- Protect: platform security, including secure software development
- RuleFix rules
A mapping means the rule checks part of that control in application code or configuration. Passing every rule does not satisfy a control: each one also needs process, people and infrastructure work that no code scanner can see.
What RuleFix does not check
Most of an audit is organisational. You need these in place regardless of what any scan finds:
- Governance and policies. The board-approved policy, IT committee, CISO and third-party risk assessments.
- SOC and monitoring operations. 24x7 monitoring, SIEM use cases and the market SOC onboarding for smaller entities.
- Audits and VAPT. Cybersecurity audits, VAPT and their remediation tracking.
- Resilience. BCP/DR drills, backups and recovery testing.
- Log retention operations. RuleFix flags secrets in logs; it does not check that your log store keeps access logs for two years.
Using RuleFix reports as audit evidence
Select SEBI CSCRF on each project in scope. Every scan then records findings with stable fingerprints. An issue becomes Fixed when a complete scan no longer finds it, when your agent resolves it with a confirming re-scan, or when a person marks it — and every status change is written to the audit log with who made it. The evidence report (print to PDF or JSON) collects the latest scan, score history, open and resolved findings and triage decisions per framework.
- PR.DS, PR.AA and PR.PS standards ask for protected data, protected authentication data and secure development. RuleFix findings and their resolution are evidence for the application-code part of each.
- Give your CERT-In-empanelled auditor the evidence report with SEBI CSCRF selected, together with your secure-development policy; the scan history shows the policy operating.
- Use RuleFix findings as input to your vulnerability management records, with the fix date for each.
Readiness checklist
- Confirm your CSCRF category and the matching compliance, audit and reporting frequency.
- Adopt the board-approved cybersecurity policy and name the responsible officers.
- Build the inventory of critical systems and the data they hold.
- Turn on RuleFix with SEBI CSCRF selected for applications that touch client or trading data; clear high findings.
- Set up SOC coverage appropriate to your category and an incident-reporting runbook (SEBI and CERT-In timelines).
- Configure log retention for user-access logs on critical systems (at least two years, six months online).
- Schedule the cybersecurity audit and VAPT with a CERT-In-empanelled auditor.
Disclaimer
Engineering guidance, not an audit
RuleFix checks part of the technical controls in your code and gives you evidence that you ran those checks. It is not legal advice, it is not an audit, and using it does not make an organisation compliant, certified or attested. CSCRF has been clarified and extended by several later SEBI circulars; check sebi.gov.in for the version that applies to your category.
Requirements are summarised; read the primary sources for SEBI CSCRF and confirm your obligations with your auditor or counsel.