SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)
SEBI framework setting cybersecurity and cyber resilience requirements for SEBI-regulated entities, graded by entity category.
- Applies in
- India
- Edition
- Version 1.0 (Aug 2024), clarified to Aug 2025; FIRE Aug 2026
- Area
- Operational resilience & ICT
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- GV.POBoard-approved cybersecurity and cyber resilience policyGovernance
- GV.RRRoles, responsibilities and authorities, including the CISOGovernance
- GV.SCCybersecurity supply chain and third-party risk managementThird parties
- ID.AMAsset inventory and Board-approved list of critical systemsCybersecurity
- PR.AAIdentity management, authentication and access controlCybersecurity
- DE.CMContinuous monitoring through a SOC (own, third-party or Market SOC)Cybersecurity
- RS.COReport incidents to SEBI within 6 hours (email) and 24 hours (portal)Reporting
- RC.RPIncident recovery plan executionResilience
How Amoreg keeps you on it.
Enable the SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) and the Monitor suggests SEBI as a source. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 8 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read sebi.gov.in/sebiweb/home/HomeAction.do?doListing=yes&sid=1&ssid=3&smid=0
- Check the library against 8 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: board-approved cybersecurity and cyber resilience policy
- Rule
- SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), GV.PO
- Area
- Governance
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- DORA — Digital Operational Resilience ActICT risk management, incident reporting, resilience testing and third-party risk for financial entities.European Union · 8 controls
- NIS2 DirectiveCybersecurity risk-management measures and incident reporting for essential and important entities.European Union · 4 controls
- UK Operational Resilience (FCA SYSC 15A / PRA SS1/21)Important business services, impact tolerances, mapping and scenario testing.United Kingdom · 5 controls
- UK Outsourcing & Third-Party Risk (SYSC 8 / PRA SS2/21)Requirements for outsourcing and third-party arrangements, including critical third parties.United Kingdom · 5 controls
- CSSF Circular 20/750 — ICT and security risk managementEBA ICT and security risk guidelines applied to Luxembourg entities outside DORA's scope.Luxembourg · 5 controls
- CSSF Circular 22/806 — Outsourcing arrangementsThe single outsourcing framework, now applying to DORA entities for business process outsourcing only.Luxembourg · 5 controls
Also in India
- SEBI (Intermediaries) Regulations, 2008SEBI regulations for all registered intermediaries, covering registration, fit-and-proper criteria, general conduct, inspection and enforcement.India · 8 controls
- SEBI (Prohibition of Insider Trading) Regulations, 2015SEBI regulations preventing insider trading and controlling unpublished price sensitive information (UPSI) at listed companies, intermediaries and fiduciaries.India · 8 controls
- SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015SEBI regulations for the continuing disclosure and corporate governance obligations of listed entities, read with the LODR master circular.India · 8 controls
- SEBI (Investment Advisers) Regulations, 2013SEBI regulations for the registration, qualifications and client-facing conduct of investment advisers, read with the IA master circular.India · 8 controls
- RBI (Commercial Banks – Know Your Customer) Directions, 2025RBI's binding KYC/AML/CFT direction for commercial banks under the PML Act and Rules, replacing the repealed 2016 KYC Master Direction.India · 8 controls
- RBI (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026RBI's binding IT governance, cybersecurity, resilience and IS-audit direction for commercial banks, replacing the 2023 IT Governance Master Direction and the 2016 Cyber Security Framework.India · 8 controls
Questions
Does Amoreg watch for changes to the SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)?
Yes. Enable it and the Monitor suggests Securities and Exchange Board of India as a source; every publication it records keeps its source, stage and date.
Can Amoreg check our policies against the SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records Version 1.0 (Aug 2024), clarified to Aug 2025; FIRE Aug 2026. Editions were last verified in August 2026, and the Monitor records new publications as they appear.