What SEBI's cybersecurity framework asks of each category.

What the framework is for

SEBI issued the Cybersecurity and Cyber Resilience Framework, known as CSCRF, on 20 August 2024. It replaces the separate cybersecurity circulars SEBI had issued for different kinds of regulated entity, including the 2015 framework for market infrastructure institutions and the 2018 framework for stock brokers and depository participants. It gives every SEBI regulated entity one set of standards, built on the NIST Cybersecurity Framework 2.0, and varies by category which standards apply and how often they must be carried out.

Who it applies to, and how it tiers

The framework binds SEBI regulated entities across 22 categories. Market infrastructure institutions, meaning stock exchanges, clearing corporations and depositories, form their own category by status, whatever their size. Other regulated entities are placed in one of four bands, Qualified, Mid-size, Small-size and Self-certification, unless they are exempt.

For stock brokers, the bands were reset by SEBI's clarifications circular of 30 April 2025, which replaced the original test based on active clients. A broker is now placed on two measures, each read independently, and the higher category applies:

• Qualified: more than 10,00,000 total registered clients, or more than Rs 10,00,000 crore of clientele trading volume in a year.
• Mid-size: more than 1,00,000 and up to 10,00,000 clients, or more than Rs 1,00,000 crore and up to Rs 10,00,000 crore.
• Small-size: more than 10,000 and up to 1,00,000 clients, or more than Rs 10,000 crore and up to Rs 1,00,000 crore.
• Self-certification: more than 1,000 and up to 10,000 clients, or more than Rs 1,000 crore and up to Rs 10,000 crore.

A broker with fewer than 1,000 total registered clients and less than Rs 1,000 crore of clientele trading volume a year is exempt. The category is fixed at the start of each financial year on the previous year's figures and held for the whole year, even if the numbers change in between.

The same circular moved KRAs from the market infrastructure tier into the Qualified tier, and revised the categories for depository participants, portfolio managers, merchant bankers, and AIFs and VCFs, which are counted at the level of their manager. Investment advisers who hold no other SEBI registration are exempt; one that does follows the highest category of its other registration. A later circular of 28 August 2025 placed every active merchant banker in the Small-size tier and exempted inactive ones.

When it took effect

The framework applied from 1 January 2025 for the six categories that already had a SEBI cyber framework, and from 1 April 2025 for the rest. SEBI then extended the date in steps. For all regulated entities except market infrastructure institutions, KRAs and QRTAs, the last extension moved compliance to 31 August 2025.

A Board-approved policy and a named officer

These two apply to every category, Self-certification included. The policy is reviewed annually under the framework's own table of cadences.

An IT Committee for the larger tiers

For the tiers that need one, the committee meets quarterly. It also approves the VAPT and cyber audit reports before they go to the reporting authority, so the minutes of its meetings become part of the evidence trail.

Watching the systems all the time

This is where the tiers show most plainly. A Small-size or Self-certification entity is not expected to staff a round-the-clock centre of its own; it onboards to the Market SOC instead.

Reporting an incident

A broker therefore has at least three recipients on the same clock: SEBI, CERT-In and its exchange or depository. The standard operating procedure at Annexure-O sets out how incidents are classified by severity and reported, and every incident needs an impact analysis with root cause and forensic analysis afterwards.

Testing and audit

The cyber audit report follows the same rhythm as VAPT: submitted within one month of the audit, findings closed within three months of submission, and a follow-on audit within five months. Market infrastructure institutions and Qualified entities undergo the cyber audit at least twice in a financial year. Both reports go on SEBI's standard formats, Annexure-A for VAPT and Annexure-B for the cyber audit, each with an MD or CEO declaration. Brokers and depository participants send them to their exchange or depository.

Backups that are proven to work

This one is easy to miss because it sits in the Recover guidelines rather than the main standards, yet SEBI marks it mandatory. A backup that has never been restored is a hope, not a control.

What this looks like as evidence

For the policy, the document itself with the Board, partner or proprietor approval. For the officer, the appointment and the reporting line. For the IT Committee, its constitution showing the external expert, and its minutes. For monitoring, the SOC arrangement or the Market SOC onboarding. For incidents, the classification and reporting procedure and a timestamped record of each report. For testing, the VAPT and cyber audit reports in SEBI's formats, the dates they were submitted, and the record of findings closed. For backups, the quarterly test results. These are the documents an auditor asks for, and they are what AuditSahi asks you to upload for this rulebook.