Regulatory directionIndia

SEBI Cybersecurity and Cyber Resilience Framework (SEBI CSCRF)

A consolidated cybersecurity and cyber-resilience framework for the securities market.

Request an Assessment

Verify current status

Deadlines were extended more than once in 2025; confirm current dates for your RE category on the SEBI site.

Classification

Regulatory direction

Issuing authority

Securities and Exchange Board of India (SEBI)

Jurisdiction

India · Sector: Financial services (securities market)

Status / edition

In force (phased; deadlines extended)

Key dates

Master circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated 20 Aug 2024; compliance dates extended (to 31 Aug 2025 for most REs; earlier for MIIs/KRAs/QRTAs)

Mandatory or voluntary

Mandatory (sector-specific)

Who it applies to

SEBI-regulated entities (REs) across the securities market, with graded requirements by category.

Purpose

A consolidated cybersecurity and cyber-resilience framework for the securities market.

Major requirements / obligations

  • Governance and cyber-resilience goals
  • Controls mapped to functions
  • Audit and reporting to SEBI
  • Graded requirements by RE category

Control domains

GovernanceRisk assessmentIncident responseAudit evidence

Official reference

https://www.sebi.gov.in/ ↗

Last reviewed

2026-10-18 (source verification date)

This library provides general information for orientation only. It is not legal advice, a determination of applicability, or a substitute for formal certification or professional counsel. Verify current legal status, editions and dates against the official source before relying on any entry. Inclusion of a jurisdiction or instrument here is informational and does not imply that Srida IT provides regulated services, holds local authorisation, or has a presence in that jurisdiction.