Cybernerds, a CERT-In Empanelled Information Security Auditor, conducts independent cyber security audits aligned with SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) for regulated entities operating in India's securities market.

Understand how your organization's cybersecurity posture aligns with SEBI's CSCRF expectations and what to address before your audit.

Why This Audit Exists

SEBI introduced the Cybersecurity and Cyber Resilience Framework (CSCRF) on August 20, 2024, to strengthen cybersecurity across entities operating in India’s securities market, replacing earlier circulars with a unified, evidence-based standard.

The CSCRF mandates periodic cyber security audits by CERT-In empanelled auditors. These audits are a regulatory requirement with defined timelines, reporting formats, and consequences for non-compliance.

Beyond compliance, the audit provides independent verification that controls protecting investor data, trading systems, and market operations are effectively implemented.

Who This Applies To

The CSCRF applies across the securities ecosystem. Entities required to comply include:

  • Stock Brokers and Trading Members
  • Depository Participants
  • Mutual Funds and Asset Management Companies
  • Portfolio Managers
  • Investment Advisers and Research Analysts (where applicable based on registration)
  • KYC Registration Agencies (KRAs)
  • Registrars and Share Transfer Agents
  • Alternative Investment Funds
  • Merchant Bankers and other SEBI-regulated intermediaries

SEBI categorizes regulated entities into tiers , Market Infrastructure Institutions (MIIs), Qualified REs, Mid-size REs, Small-size REs, and Self-Certification REs , with each tier carrying specific audit obligations, SOC requirements, and reporting timelines. The applicable category determines the scope and depth of the audit engagement.

  • Regulatory Background

The CSCRF is structured around six cybersecurity functions . Governance, Identify, Protect, Detect, Respond, and Recover , aligned with five resilience goals drawn from CERT-In's Cyber Crisis Management Plan: Anticipate, Withstand, Contain, Recover, and Evolve.

Key regulatory references include:

  • SEBI CSCRF Circular dated August 20, 2024
  • SEBI Categorization Circular dated April 30, 2025
  • SEBI Technical Clarifications Circular dated August 29, 2025
  • CERT-In Cyber Security Audit Policy Guidelines

Organizations are expected to demonstrate implementation of controls across all applicable functions and maintain supporting evidence for regulatory validation.

Scope of the Audit

Our CSCRF audit evaluates both the design and operating effectiveness of controls verifying that requirements are not only documented but implemented and functioning across your environment.

Key assessment areas include:

  • Governance and Policy Framework
  • Risk and Asset Management
  • Identity and Access Controls
  • Infrastructure and Endpoint Protection
  • Security Operations and Detection
  • VAPT and Security Testing
  • Incident Response Readiness
  • Business Continuity and Recovery
  • Cloud Security and Data Localization

Our Audit Methodology

We follow a structured, evidence-based audit lifecycle aligned with SEBI's CSCRF requirements and CERT-In audit policy guidelines:

  • Applicability and Categorization Review Confirm the entity's correct SEBI category and map applicable CSCRF requirements to the specific audit scope
  • Document and Policy Review Assess board-approved policies, CISO governance documentation, IT Committee records, CCMP, and vendor risk registers
  • Control Mapping and Validation Map implemented controls against CSCRF's six functions, validate through configuration review, evidence sampling, and walkthrough sessions
  • VAPT Coordination and Review Review VAPT reports, assess finding severity, and verify closure evidence against SEBI's defined remediation timelines
  • Evidence Assessment and Gap Identification Each control is assessed against collected evidence. Gaps are documented with clear reference to the applicable CSCRF requirement and observed deviation
  • Risk-Based Reporting Observations are prioritized by risk impact and structured in SEBI's prescribed audit report format, ready for submission

Common Gaps We Observe

These are recurring observations from CSCRF audit engagements , not hypothetical risks:

  • CISO reporting directly to the Head of IT, creating a structural independence gap
  • IT Committee constituted on paper without documented meeting records or board-approved terms of reference
  • VAPT conducted but findings tracked informally closure evidence not available at time of audit
  • SOC subscribed to but not operationally active , alerts unmonitored, incidents untriaged
  • Incident response plans that do not reflect SEBI's 6-hour and 24-hour reporting obligations
  • Third-party vendor contracts without CSCRF compliance clauses or documented risk assessments
  • Log retention falling short of CSCRF requirements , logs collected but not retained for the mandated period
  • Categorization errors , entities operating at a higher obligation tier than their assumed classification

What You Receive

Every CSCRF audit engagement with Cybernerds produces:

  • Detailed Cyber Audit Report - Control-level findings with observations, evidence references, and risk classification, structured in SEBI's prescribed format
  • Evidence Mapping Document - Control-to-evidence mapping aligned to the CSCRF framework's six functions
  • VAPT Summary Integration - Where VAPT is in scope, findings and closure status are integrated into the audit report

Who Should Opt for This Audit

  • Stock Brokers and Depository Participants
  • Mutual Funds and Asset Management Companies
  • Portfolio Managers and Investment Advisers
  • KYC Registration Agencies and RTAs
  • Alternative Investment Funds
  • Merchant Bankers and other SEBI-regulated intermediaries

Our Perspective

We approach CSCRF audits as a risk-focused evaluation of how effectively your organization protects investor data, market infrastructure, and operational continuity — not as a checklist exercise.

As a CERT-In Empanelled Information Security Auditor, we emphasize:

  • Independence and objectivity in every engagement
  • Evidence-backed validation of control implementation
  • Practical observations grounded in regulatory intent
  • Clear, structured reporting aligned to SEBI's format requirements
  • Sample Audit Output

Understand how CSCRF audit findings, control evaluations, and evidence mapping is structured for submission to SEBI.

  • Not Sure Where Your Organization Stands?

Before the audit begins, it helps to know what controls, documentation, and evidence your organization will need to demonstrate. We have prepared a guide that walks you through exactly what to review and address in advance.

Speak With Our Experts

If your organization is planning or undergoing a SEBI CSCRF cyber audit, connect with our team for an independent and structured assessment aligned with regulatory expectations.