SEBI CSCRF

Cyber Security Policy

Board-approved Cyber Security Policy covering risk tolerance, control framework, incident response, and third-party risk — reviewed and updated annually.

Cyber Security Operations Centre (SOC)

Qualified and Mid-size REs must operate or procure an SOC — 24x7 monitoring, SIEM, threat intelligence, and incident response capabilities.

Vulnerability Assessment & Penetration Testing

VAPT schedule per RE category — Qualified REs: quarterly VAPT of critical systems; Mid-size REs: bi-annual; Small REs: annual. CERT-In empanelled firms required for external VAPT.

Annual Cyber Audit

Mandatory annual cyber security audit by a CERT-In empanelled auditor — covering all systems in scope, audit report submitted to SEBI.

Cyber Incident Reporting

Report significant cyber incidents to SEBI and CERT-In within 6 hours of detection — using SEBI's incident reporting portal with defined incident classification.

Cyber Capability Index (CCI)

Qualified REs must maintain a CCI score above the minimum threshold — CCI measures maturity across people, process, and technology dimensions.

Data Localisation

SEBI prohibits storage and processing of Indian securities market data outside India — all critical data must be stored in India with overseas access restrictions.

Third-Party Risk Management

Due diligence, contractual security requirements, and ongoing monitoring for all IT service providers handling SEBI-regulated entity data or systems.