SEBI Clarifies Cybersecurity Rules for Entities

The Securities and Exchange Board of India (SEBI) has released a new circular to provide technical clarifications for its Cybersecurity and Cyber Resilience Framework (CSCRF). This circular addresses various queries from regulated entities (REs) and updates the guidelines to ensure a robust and clear implementation of the framework. A key part of the new circular is the introduction of the “Principle of Exclusivity” and “Principle of Equivalence” for entities that are regulated by multiple bodies, such as the SEBI and the Reserve Bank of India. These principles aim to streamline compliance by limiting the scope of the CSCRF to systems exclusively used for SEBI-related activities and by accepting equivalent cybersecurity measures followed under another regulator’s framework. The circular also provides specific technical clarifications, including a revised definition of critical systems, clarifying that mobile application security guidelines are now only recommended, and specifying that audit reports should be submitted in a summary format. Additionally, it updates the categorization thresholds for Portfolio Managers and Merchant Bankers.

Securities And Exchange Board of India

 Circular No. SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2025/119 | Dated: August 28, 2025

To,
All Alternative Investment Funds (AIFs)
All Bankers to an Issue (BTI) and Self-Certified Syndicate Banks (SCSBs)
All Clearing Corporations
All Collective Investment Schemes (CIS)
All Credit Rating Agencies (CRAs)
All Custodians
All Debenture Trustees (DTs)
All Depositories
All Designated Depository Participants (DDPs)
All Depository Participants through Depositories
All Investment Advisors (IAs) / Research Analysts (RAs)
All KYC Registration Agencies (KRAs)
All Merchant Bankers (MBs)
All Mutual Funds (MFs)/ Asset Management Companies (AMCs)
All Portfolio Managers
Association of Portfolio Managers in India (APMI)
All Registrar to an Issue and Share Transfer Agents (RTAs)
All Stock Brokers through Exchanges
All Stock Exchanges
All Venture Capital Funds (VCFs)
BSE Limited (Investment Adviser Administration and supervisory body- IAASB)
BSE Limited (Research Analysts Administration and supervisory body- RAASB)

Sir / Madam,

Subject: Technical Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)

1. Recognising the need for robust cybersecurity measures and protection of data and IT infrastructure, Securities and Exchange Board of India (SEBI) has issued ‘Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)’ vide circular SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated August 20, 2024.

2. Upon receipt of various queries from REs seeking extension and clarification on the aforementioned circular, SEBI has also issued following clarifications and Frequently Asked Questions (FAQs):

3. Based on further discussions, technical clarifications are being issued with respect to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated

Entities (REs) in following parts:

3.1. Part-A: Principles for REs under multiple regulators’ purview

3.2. Part-B: Technical clarifications

3.3. Part-C: Re-categorisation of Portfolio Managers and Merchant Bankers

3.4. Part-D: Cyber Security Audit Policy Guidelines from CERT-In

Part – A: Principles for SEBI REs under multiple regulators’  purview

4. There are several SEBI REs engaged in various business operations, and their activities are being regulated by multiple regulatory bodies within the Indian jurisdiction. For example: SEBI REs such as Custodians, Depository Participants (DPs) Merchant Bankers (MBs), etc. are also banks which are being primarily regulated by Reserve Bank of India (RBI).

5. Following clarifications are being issued for such REs w.r.t. CSCRF issued vide SEBI circular SEBI/HO/ ITD- /ITD_CSC_EXT/P/CIR/2024/113 dated August 20, 2024:

5.1. There are various standards and corresponding guidelines mentioned in CSCRF which REs need to implement and comply with in a certain manner. For the ease of compliance and clarity of implementation, following Principle of Exclusivity and Principle of Equivalence have been formulated. During submission of CSCRF compliance, REs need to demonstrate that they follow the principle of equivalence and/ or exclusivity for the applicable controls. Further, SEBI reserves the right to seek the submissions made by the REs to other regulators to verify their compliances.

5.2. Principle of Exclusivity: The scope of CSCRF shall be limited to only those systems/ applications/ infrastructure/ processes which are exclusively used for SEBI regulated activities. Further, the shared infrastructure/ network/ technology stack, security solutions shall be included in the audit/ inspection scope by SEBI, if the same is not covered under audit/ inspection scope by primary regulator and their frameworks/ guidelines.

Following are representative examples of the standards and corresponding guidelines as mentioned in CSCRF:

Table 1: Representatives examples under Principle of Exclusivity

5.3. Principle of Equivalence: CSCRF controls which have an equivalence in other regulators’ cybersecurity frameworks/ guidelines shall be deemed compliant provided that the frameworks/ guidelines issued by primary regulator are adhered by such REs.

Following are representative examples of the standards and corresponding guidelines as mentioned in CSCRF:

Table 2: Representatives examples under Principle of Equivalence

Part – B: Technical clarifications

6. Technical Clarification for the following CSCRF clauses are given below:

6.1. Critical Systems definition (Page 26): Entities shall identify and classify their critical IT systems. Following systems shall be included in critical systems (both on premise and cloud):

a. Any system, if compromised, that will have an adverse impact on core and critical business operations.

b. Stores/ transmits data as per regulatory requirements.

c. Devices/ network through which critical systems are connected (through trusted channels).

d. Internet facing applications/ systems.

e. Client facing application/ systems.

f. All the ancillary systems used for accessing/ communicating with critical systems either for operations or for maintenance.”

Clarification: Above-mentioned para (f) shall now be read as under: Any other system which is on the same network segment where systems mentioned in para (a) to (e) are deployed.

6.2. Zero-trust security model (PR.AA.S4 and PR.AA.S5 guidelines – Page 97): “REs shall follow zero-trust security model in such a way that access (from within or outside REs’ network) to their critical systems is denied by default and allowed only after proper authentication and authorization.”

Clarification: Above-mentioned guidelines shall now be read as under: REs shall implement suggested strategies/ methodologies such as Zero-trust networks, segmentation, no single point of failure, high availability, etc. Further, the same shall be approved by IT committee for REs.

6.3. Mobile Application Security guidelines (PR.AA.S16 and corresponding guidelines – Page 102-103)

Clarification: Above-mentioned guidelines are recommendatory (not mandatory) in nature.

6.4. RS.CO.S2 guidelines (Page 124-125): “If the cyber-attack is of high impact and has a broad reach, the RE shall give a press release which shall include (but not limited to) a brief of the incident, actions taken to recover, normal operation resumption status (once achieved), etc. and inform all the affected customers/ stakeholders. If the cyber-attack is of low impact and has a narrow/low reach, the REs shall inform all the affected customers/ stakeholders.”

Clarification: Above-mentioned guidelines shall now be read as under: REs shall take action as per their approved Cyber Crisis Management Plan (CCMP).

6.5. DE.CM.S3 guidelines (3.c) (Page 119): “REs shall deploy solutions such as BAS, CART, decoy, vulnerability management, etc. to enhance their cybersecurity posture.”

Clarification: Above-mentioned guideline shall now be read as under: It is recommended that REs consider deploying a range of security solutions in consultation with their IT Committee, such as threat simulation, vulnerability management, and decoy systems, to assess and enhance their cybersecurity posture.

6.6. GV.SC.S2 (Page 56): “Suppliers and third-party service providers of information systems, components, and services shall be identified, prioritized, and assessed using a cyber-supply chain risk assessment process.”

Clarification: The above-mentioned cyber-supply chain risk assessment process may be done by the REs in consultation with their IT committee.

6.7. Submission of VAPT and Cyber audit report (Section 4.3-4.4 – Page 48-52, Annexure-A, Annexure-B )

Clarification: REs shall submit the summary of VAPT and cyber audit reports strictly as per the format mentioned in CSCRF. It is clarified that at no point of time, REs shall submit the explicit vulnerabilities unless and otherwise asked for the details by SEBI.

6.8. GV.PO – Guideline 11 (Page 85): “The cybersecurity policy shall encompass the principles prescribed by National Critical Information Infrastructure Protection Centre (NCIIPC) of National Technical Research Organisation (NTRO), GoI in the report titled ‘Guidelines for Protection of National Critical Information Infrastructure’ and subsequent revisions, if any, from time to time.”

Clarification: The above-mentioned clause is applicable only on REs which have been identified as Critical Information Infrastructure (CII) by NCIIPC.

6.9. On boarding to Market-SOC (Box Item 11)

Clarification: small-size and self-certification with few exclusions as mentioned in (CSCRF Box Item 11, DE.CM.S3 Guidelines (c-d) – Page 118) and (Clause 2.2, 2.6, 2.7 and 3 of SEBI circular vide SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2025/60 dated April 30, 2025) have been mandated to be on boarded on Market-SOC. Please refer Q. 60 of CSCRF FAQs¹ issued vide dated June 11, 2025:

Question: In a scenario where an RE falling under small-size or self-certification REs category has its own SOC, is it necessary for such REs to get onboarded to Market-SOC?

Answer: It is imperative that setting up own SOC is a costly proposition. Hence, SEBI has mandated NSE and BSE to setup Market-SOC (M-SOC) where small-size REs and self-certification REs can get onboarded and take the benefit to stay cyber secure and resilient. However, REs who have their own SOC and falling under the category of small-size REs or self-certification REs by virtue of their regulatory activity may leverage their existing SOC. Further, such REs shall be required to submit the SOC efficacy report

¹ Refer https://www.sebi.gov.in/sebidata/faqfiles/jun-2025/1749647139924.pdf

periodically as mandated in CSCRF.

6.10. RC.RP.S2 guideline (Page 128-129): “In the event of disruption of any one or more of the critical systems, the RE shall, within 30 minutes of the incident, declare that incident as ‘Disaster’ based on the business impact analysis. Accordingly, the RTO shall be two (2) hours as recommended by IOSCO² for the resumption of critical operations. The RPO shall be 15 minutes for all REs. The recovery plan shall be scenario-based and in line with the RTO and RPO specified.”

Clarification: Above-mentioned guideline shall now be read as under as referred from IOSCO³: Resumption within two hours (i.e. two-hour RTO). REs shall design and test its systems and processes to enable the safe resumption of critical operations within two hours of a disruption, even in the case of extreme but plausible scenarios. Notwithstanding this capability to resume critical operations within two hours, when dealing with a disruption REs shall exercise judgment in effecting resumption so that risks to itself or its ecosystem do not thereby escalate. In consultation with their IT Committee, REs shall also plan for scenarios in which the resumption objective is not achieved.

Further, RPO for critical systems shall be 15 minutes as per SEBI circular⁴ dated March 22, 2021.

6.11. Requirement of ISO 27001 certification for Qualified REs (PR.IP.S16 (Page 66) and corresponding guideline (Page 115), and Section 4.2 – Page 47) Clarification: Qualified REs are encouraged and recommended (not mandatory) to obtain ISO 27001 certification.

6.12. While receiving and handling cyber audit reports submitted by their members, Stock Exchanges and Depositories shall ensure that adequate safeguards are in place to maintain the confidentiality and integrity of such reports.

² Refer https://www.bis.org/cpmi/publ/d146.pdf.

³ Refer https://www.iosco.org/library/pubdocs/pdf/IOSCOPD535.pdf

⁴ Refer https://www.sebi.gov.in/legal/circulars/mar-2021/guidelines-for-business-continuity-plan-bcp-and-disaster-recovery-dr-of-market-infrastructure-institutions-miis-49601.html

Page 9 of 11

Part – C: Re-categorisation of Portfolio Managers and  Merchant Bankers (MBs)

7. Based on further discussions, it has been decided to revise the thresholds and categorization of following REs as under:

7.1. Portfolio Managers

Table 1: Criteria and thresholds for Portfolio Managers categorization

7.2. Merchant Bankers (MBs)

Table 2: Criteria and thresholds for MBs categorization

Part – D: Cyber Security Audit Policy Guidelines from CERT-In

8. CERT-In has issued comprehensive Cyber Security Audit Policy Guidelines⁵. These guidelines are intended to serve as a reference both CERT-In empanelled auditing organisations and auditee organisations. REs shall follow these guidelines to ensure a consistent, effective and secure approach to cyber security audits.

⁵ https://www.cert-in.org.in/PDF/ComprehensiveCyberSecurityAuditPolicyGuidelines.pdf

9. Stock Exchanges/ Depositories are directed to:

9.1. Make necessary amendments to the relevant byelaws, rules and regulations for the implementation of the above direction and

9.2. Bring the provisions of this circulars to the notice of their members/ participants and also disseminate the same on their websites.

10. BSE Limited is directed to:

10.1. Make necessary amendments to the relevant byelaws, rules and regulations for the implementation of the above direction and

10.2. Bring the provisions of this circulars to the notice of Investment Advisers (IAs) and Research Analysts (RAs) and also disseminate the same on their websites.

11. The provisions of this Circular shall come into force with immediate effect.

12. This circular is being issued in exercise of powers conferred under Section 11 (1) of the Securities and Exchange of India Act, 1992, to protect the interests of investors in securities and to promote the development of, and to regulate the securities market.

13. This circular is issued with the approval of Competent Authority.

14. This circular is available on SEBI website at sebi.gov.in under the category “Legal” and drop “Circulars”.