Circular 2024 status not recorded
Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities
Issued by Securities and Exchange Board of India
Plain-English summary
SEBI circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 of 20 August 2024. The framework sorts SEBI regulated entities into five categories (market infrastructure institutions, qualified, mid-size, small-size and self-certification entities) and is built on five goals (Anticipate, Withstand, Contain, Recover, Evolve). It took effect on 1 January 2025 for six categories of entity that already had a cybersecurity circular and on 1 April 2025 for the rest.
Who it applies to
Capital Markets · Asset & Wealth Management
Topics
Cybersecurity & IT Risk Operational Risk & Outsourcing
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Comply with the Cybersecurity and Cyber Resilience Framework (SEBI regulated entities) | Effective 1 January 2025 or 1 April 2025 depending on entity category | SEBI | official | |
The CSCRF applies to five categories of SEBI regulated entities. It requires a Board-approved cybersecurity and cyber resilience policy, a Security Operations Centre (own, group, third-party or the Market SOC), and ISO 27001 certification for market infrastructure institutions and qualified entities within one year of issue. Incidents are to be reported in a timely manner through SEBI's incident reporting portal; the hour or day limits were not visible in the text read. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.