Home / Controls lists / SEBI CSCRF 2024

SEBI CSCRF 2024 Controls List

SEBI's CSCRF replaced its earlier cybersecurity circulars for the securities market. Part I sets standards under six cybersecurity functions (Governance, Identify, Protect, Detect, Respond and Recover) and the goal Evolve. What applies depends on the category of regulated entity.

Download SEBI CSCRF controls list (Excel) Read the list

Free account needed to download. You come straight back to the file.

Who it is for. SEBI regulated entities: stock exchanges, clearing corporations and depositories (MIIs), stock brokers, depository participants, mutual funds and asset managers, portfolio managers, AIFs, registrars, KRAs, investment advisers, research analysts and other intermediaries.

What this list covers. CSCRF issued 20 August 2024, Part I standards; SEBI has since issued clarifications and revised compliance dates, so check its current circulars: 128 standards. Each has a reference, a heading and a sentence in plain English.

Read it here, download it when you want it. The download is the SecureXcel unified controls workbook for this framework, an Excel file exactly as we maintain it, with a Version History sheet for document control.

GV.OC. Governance: organisational context

Ref	Control	What it requires
GV.OC.S1	Know what others rely on you for	Understand and communicate the critical objectives, capabilities and services that outside stakeholders depend on or expect from you.
GV.OC.S2	Know your legal duties	Understand and manage the legal and regulatory requirements on cybersecurity, including data protection and privacy.
GV.OC.S3	Know what you depend on	Understand and communicate which outcomes, capabilities and services depend on outside parties such as third-party providers.

GV.RR. Governance: roles, responsibilities and authorities

Ref	Control	What it requires
GV.RR.S1	Leadership owns cyber risk	Leadership is accountable for cybersecurity risk and builds a culture that is risk-aware, security-conscious and always improving.
GV.RR.S2	Define cyber roles	Develop, communicate, understand and enforce cybersecurity roles, responsibilities and authorities.
GV.RR.S3	Appoint a CISO	Appoint a CISO or designated officer who reports to a designated authority in the organisation.
GV.RR.S4	Fund security	Align budget planning with security and privacy objectives, and allocate resources that match the cyber risk strategy, roles and policies.
GV.RR.S5	Sign before access	Staff and third-party providers get access to information systems only after signing a confidentiality and integrity agreement.
GV.RR.S6	Train for security	Include cybersecurity in human resources training programmes.

GV.PO. Governance: policy

Ref	Control	What it requires
GV.PO.S1	Approved cyber policy	Document and implement a cybersecurity and cyber resilience policy approved by the Board, partners or proprietor, built on industry practice and covering this framework's standards.
GV.PO.S2	Review the policy	Review the cybersecurity and cyber resilience policy periodically.
GV.PO.S3	Cyber risk policy	Set a policy for managing cyber risk based on your context, strategy and priorities, then communicate and enforce it.
GV.PO.S4	Keep the risk policy current	Review, update, communicate and enforce the risk policy as requirements, threats and technology change.
GV.PO.S5	Asset ownership and approvals	Define the owner and custodian of every asset and a clear chain of command for approvals, and follow it.

GV.OV. Governance: oversight

Ref	Control	What it requires
GV.OV.S1	Review risk strategy outcomes	Review the outcomes of the cyber risk management strategy to inform and adjust strategy and direction.
GV.OV.S2	Adjust the strategy	Review and adjust the risk management strategy so it covers organisational requirements and risks.
GV.OV.S3	Measure risk performance	Evaluate and review how well organisation-wide cyber risk management is performing, and adjust where needed.
GV.OV.S4	Score yourself on the CCI	Assess cyber resilience on a regular basis using SEBI's Cyber Capability Index, which SEBI applies to MIIs and Qualified REs.

GV.RM. Governance: risk management

Ref	Control	What it requires
GV.RM.S1	Cyber risk framework	Prepare a framework to identify, assess, mitigate and monitor cyber risk, define the processes to address it, and agree the objectives with stakeholders.
GV.RM.S2	Cyber risk inside enterprise risk	Include cyber risk management activities and outcomes in the organisation's overall risk management processes.
GV.RM.S3	Test risk scenarios	Document risk scenarios and the responses to them, and test them periodically to check the risk management plan.
GV.RM.S4	Risk appetite and register	State and communicate risk tolerance and appetite, informed by your role in critical infrastructure. Keep a risk register that the IT Committee reviews periodically.

GV.SC. Governance: supply chain risk management

Ref	Control	What it requires
GV.SC.S1	Supply chain risk strategy	Identify, set up, assess, manage and agree a cybersecurity supply chain risk strategy and process with organisational stakeholders.
GV.SC.S2	Assess suppliers	Identify, prioritise and assess suppliers and providers of systems, components and services using a cyber supply chain risk assessment.
GV.SC.S3	Contract for security	Put measures in supplier and provider contracts that meet your cyber programme and supply chain plan objectives, including adequate cybersecurity manpower.
GV.SC.S4	Monitor critical providers	Monitor, review and ensure compliance of providers who perform critical activities for you, on a periodic basis.
GV.SC.S5	Obtain an SBOM	Obtain a Software Bill of Materials for new software bought for core and critical activities and keep it current. Where a legacy or proprietary system cannot supply one, the Board approves the exception with its rationale.
GV.SC.S6	Plan response with providers	Run response and recovery planning and testing together with third-party providers.
GV.SC.S7	Assess concentration risk	Assess and review concentration risk on outsourced agencies to achieve operational resilience.
GV.SC.S8	Providers follow the same standards	Require third-party providers to follow similar information security standards.

ID.AM. Identify: asset management

Ref	Control	What it requires
ID.AM.S1	Inventory assets	Inventory physical devices, digital assets (URLs, domain names, applications, APIs), shared and cloud resources and interfacing systems, within a set time.
ID.AM.S2	Map data flows and encryption	Map and inventory communications, data flows and encryption methods across all IT systems and network resources.
ID.AM.S3	No shadow IT	Make sure no shadow IT assets exist in the organisation.
ID.AM.S4	Board approves critical systems	The Board, partners or proprietor approves the list of critical systems.
ID.AM.S5	Inventory data and metadata	Maintain inventories of data and the metadata for designated data types.
ID.AM.S6	Manage assets through their lifecycle	Manage all inventoried IT assets and data across their whole lifecycles.

ID.RA. Identify: risk assessment

Ref	Control	What it requires
ID.RA.S1	Find and document vulnerabilities	Identify, validate and document asset vulnerabilities, and assess and manage risk factors for all IT assets.
ID.RA.S2	Assess risk periodically	Assess risk in the IT environment periodically, including post-quantum risk.
ID.RA.S3	Use threat intelligence and advisories	Receive threat intelligence from trusted sources, join the CERT-In intelligence platform, and act on CERT-In and CSIRT-Fin advisories promptly (SEBI's footnote says within 24 hours unless it states otherwise).
ID.RA.S4	Rank inherent risk	Use threats, vulnerabilities, likelihood and impact to understand inherent risk and prioritise responses, especially for access and authentication.
ID.RA.S5	Plan and track risk responses	Choose, prioritise, plan, track and communicate risk responses.

PR.AA. Protect: identity, authentication and access control

Ref	Control	What it requires
PR.AA.S1	Manage identities and credentials	Issue, manage, verify, revoke and audit identities and credentials for authorised devices, users and processes.
PR.AA.S2	Protect network integrity	Protect network integrity through measures such as segregation and segmentation.
PR.AA.S3	Least privilege and segregation of duties	Grant access to on-premise and cloud resources on least privilege, with segregation of duties.
PR.AA.S4	Zero Trust	Use a Zero Trust model to allow individuals, devices and resources to access organisational resources.
PR.AA.S5	Review rights and use maker-checker	Review and document access rights periodically. Use a maker-checker process to grant, revoke and change user rights in applications and databases.
PR.AA.S6	Authentication policy	Document and implement an authentication policy. Proof identities, bind them to credentials, and authenticate with single or multiple factors in line with risk.
PR.AA.S7	MFA for critical systems	Require multi-factor authentication on all critical systems for users who connect from an untrusted network to a trusted one.
PR.AA.S8	Log management policy	Document and implement a log management policy.
PR.AA.S9	Identify users in logs	Make user logs uniquely identifiable and store them for a specified period.
PR.AA.S10	Control physical access	Manage, monitor and protect physical access to assets, record it continuously for critical systems, and screen people before granting access.
PR.AA.S11	Watch privileged users and third parties	Review privileged users' activity periodically. Restrict employee and provider access, and where granted make it time-limited, need-to-know and closely supervised.
PR.AA.S12	Track remote access	Strictly track and administer remote access to assets.
PR.AA.S13	Retention and disposal policy	Document and implement a data-disposal and data-retention policy.
PR.AA.S14	Media handling procedures	Document procedures for handling storage media and disposing of it.
PR.AA.S15	Control endpoints and media	Define and implement access control for endpoints, networks, APIs, removable media, laptops and mobile devices.
PR.AA.S16	Vet mobile apps	Vet mobile applications against security requirements and test them thoroughly before deployment.
PR.AA.S17	Secure the APIs	Define and implement API security with proper authentication and authorisation.

PR.AT. Protect: awareness and training

Ref	Control	What it requires
PR.AT.S1	Awareness programmes	Run mandatory, periodic programmes on cybersecurity, cyber resilience and system hygiene, updated for new threats, technology and trends.
PR.AT.S2	Privileged users know their role	Make sure privileged users understand their roles and responsibilities.
PR.AT.S3	Third parties know their role	Make sure third-party stakeholders such as suppliers, customers, investors and partners understand their roles and responsibilities.
PR.AT.S4	Board and senior executives	Make sure senior executives and Board members understand their roles, with a dedicated programme on cybersecurity, resilience and system hygiene for the Board.
PR.AT.S5	Security staff know their role	Make sure physical and information security personnel understand their roles and responsibilities.

PR.DS. Protect: data security

Ref	Control	What it requires
PR.DS.S1	Encrypt data at rest and in transit	Protect data at rest and in transit with industry-standard encryption. MIIs should also explore encrypting data while in use.
PR.DS.S2	Classify and localise data	Classify data as Regulatory Data and IT and Cybersecurity Data as the framework defines, and keep both available in usable form within India.
PR.DS.S3	Keep capacity for availability	Maintain enough capacity to keep data available.
PR.DS.S4	Prevent data leaks	Put measures and tools in place to prevent data leakage.
PR.DS.S5	Separate environments	Keep development and testing separate from production, with at least one non-production environment for rigorous testing of critical software before release.
PR.DS.S6	Verify integrity (MIIs)	MIIs put in place integrity mechanisms to verify software, firmware and information on their critical systems and the systems connected to them.

PR.IP. Protect: information protection processes and procedures

Ref	Control	What it requires
PR.IP.S1	Baseline configurations	Create and maintain a baseline configuration of IT systems that builds in security principles such as least functionality.
PR.IP.S2	Secure development lifecycle	Implement a system development life cycle to manage systems.
PR.IP.S3	Change control	Put in place configuration change control and change management.
PR.IP.S4	Scan critical software for malicious code	Scan critical software and applications thoroughly to make sure no malicious code is present.
PR.IP.S5	Vendor assurance on code you do not own	Where you do not own the source code, obtain an undertaking from the provider that the software is free of known vulnerabilities, malware, malicious or fraudulent code and covert channels.
PR.IP.S6	Test and certify software	Test or certify software to show it does only what is intended, follows secure design and coding practice, and addresses known insecure-coding flaws.
PR.IP.S7	Backup and recovery plan	Document a data backup and recovery plan so no data is lost.
PR.IP.S8	Test backups	Implement, test and maintain data backups, and run restoration drills periodically.
PR.IP.S9	Physical environment policy	Define and follow policies for the physical operating environment of your assets.
PR.IP.S10	Measure protective technology	Measure how effective protective technologies are on a regular basis against service levels.
PR.IP.S11	Response and recovery plans	Put in place, regularly test and update incident response and business continuity plans and incident recovery and disaster recovery plans.
PR.IP.S12	Vulnerability management plan	Develop and implement a vulnerability management plan.
PR.IP.S13	Follow SEBI's cloud framework	For cloud instances in scope, comply with SEBI's Framework for Adoption of Cloud Services by SEBI Regulated Entities.
PR.IP.S14	Use CERT-In empanelled auditors	Bring in only CERT-In empanelled information security auditors for external audits, including the cyber audit, of the framework's standards and mandatory guidelines.
PR.IP.S15	Certify software for security and function	Certify all SaaS, hosted, COTS, customised COTS and in-house software for application security and functional audit. STQC certifies COTS products empanelled by exchanges and depositories.
PR.IP.S16	ISO 27001 certification (MIIs and Qualified REs)	MIIs and Qualified REs obtain ISO 27001 certification.
PR.IP.S17	Follow CIS Controls (MIIs and Qualified REs)	MIIs and Qualified REs follow globally recognised standards such as the CIS Critical Security Controls.

PR.MA. Protect: maintenance

Ref	Control	What it requires
PR.MA.S1	Log maintenance with approved tools	Perform and log maintenance and repair of assets using approved and controlled tools.
PR.MA.S2	Control remote maintenance	Approve and log remote maintenance of assets, and do it in a way that prevents unauthorised access.
PR.MA.S3	Patch by severity	Identify and categorise patches by severity, apply critical patches at the earliest, and test patches in non-production before applying them at the DC and DR.

DE.CM. Detect: security continuous monitoring

Ref	Control	What it requires
DE.CM.S1	Run a 24x7x365 SOC	Run a Security Operations Centre around the clock covering networks, endpoints, physical environment, personnel activity, malicious code, third-party activity and unauthorised devices and software.
DE.CM.S2	Monitor continuously	Set up continuous monitoring in the SOC for timely detection of anomalous or malicious activity.
DE.CM.S3	Investigate alerts in time	Monitor and investigate all anomalies and alerts within the stipulated time.
DE.CM.S4	Monitor capacity	Monitor capacity utilisation of all critical systems.
DE.CM.S5	Audit and test	Run cybersecurity, configuration, implementation and change management audits and VAPT to find vulnerabilities in the IT environment.

DE.DP. Detect: detection process

Ref	Control	What it requires
DE.DP.S1	Assign detection roles	Define roles and responsibilities for detection so accountability is clear.
DE.DP.S2	Test detection with playbooks	Test detection processes by developing playbooks and use cases.
DE.DP.S3	Communicate detections	Communicate event detection information as regulation and organisational policy require.
DE.DP.S4	Red team exercises (MIIs and Qualified REs)	MIIs and Qualified REs run goal-based adversarial simulation (red teaming) exercises periodically to find weaknesses in their cyber defence.
DE.DP.S5	Hunt threats and assess compromise	Run threat hunting and compromise assessment on a regular basis.

RS.MA. Respond: incident management

Ref	Control	What it requires
RS.MA.S1	Crisis Management Plan	Document a Cyber Crisis Management Plan with scenario-based SOPs that includes the incident response plan, and trigger the response as soon as an incident occurs.
RS.MA.S2	Respond in time	Be able to respond in a timely and appropriate way to adverse conditions, stresses, attacks or signs of them, so operations continue and consequences are limited.
RS.MA.S3	Contingency and recovery plans	Prepare contingency plans, continuity of operations plans, training, exercises, and incident response and recovery plans, approved by the Board, partners or proprietor.
RS.MA.S4	Contain and mitigate	Contain and mitigate incidents, and either fix newly found vulnerabilities or document them as accepted risks.
RS.MA.S5	Join CERT-In initiatives (MIIs and Qualified REs)	MIIs and Qualified REs get onboarded to Cyber Swachhta Kendra and other CERT-In initiatives as notified.

RS.CO. Respond: reporting and communication

Ref	Control	What it requires
RS.CO.S1	Incident response roles SOP	Prepare and implement an SOP that sets out the roles and responsibilities of personnel in incident response.
RS.CO.S2	Report incidents	Notify SEBI, CERT-In and NCIIPC (as applicable) of incidents within the CERT-In Directions within the stipulated time, and report all other incidents as guidelines require.
RS.CO.S3	Coordinate under the plan	Coordinate with stakeholders in an incident as your Cyber Crisis Management Plan says.

RS.AN. Respond: incident analysis

Ref	Control	What it requires
RS.AN.S1	Receive vulnerability reports	Set up processes to receive, analyse and respond to vulnerabilities and incidents disclosed from internal and external sources.
RS.AN.S2	Categorise incidents	Categorise incidents as your Cyber Crisis Management Plan prescribes.
RS.AN.S3	Investigate and run forensics	Investigate incidents and alerts in detail, with forensic analysis as appropriate, to find root cause, the attacker's methods and any lateral movement, and to prevent recurrence.
RS.AN.S4	Root cause analysis	Run root cause analysis to find the gaps in people, process and technology behind an incident and to strengthen your posture against similar ones.
RS.AN.S5	Impact analysis	Always analyse the impact of an incident, and run root cause and forensic analysis as SEBI's incident classification and handling SOP (Annexure-O) sets out.

RS.IM. Respond: improvements

Ref	Control	What it requires
RS.IM.S1	Learn from incidents	Fold lessons from incident handling into response plans, training and testing, and implement the resulting changes.
RS.IM.S2	Tell key people about plan changes	Communicate changes to the response plan to designated key personnel.

RC.RP. Recover: recovery plan execution

Ref	Control	What it requires
RC.RP.S1	Scenario-based recovery plans	Classify recovery plans by cyber scenario.
RC.RP.S2	Meet SEBI's RTO and RPO	Use the RTO and RPO SEBI specifies when you execute a recovery plan to restore systems after an incident.
RC.RP.S3	Drill recovery	Run drills periodically to test different recovery scenarios.
RC.RP.S4	Document backup and recovery	Document the backup and recovery plan for data so there is no data loss.

RC.CO. Recover: recovery communication

Ref	Control	What it requires
RC.CO.S1	Manage public relations	Handle public relations as the recovery plan defines during a cyber incident.
RC.CO.S2	Communicate recovery progress	Communicate recovery activities to internal and external stakeholders, executives and management.
RC.CO.S3	Tell stakeholders what was done	Tell all related stakeholders what actions were taken during recovery.

RC.IM. Recover: improvements

Ref	Control	What it requires
RC.IM.S1	Update recovery plans	Update and improve recovery plans with lessons from cyber incidents.
RC.IM.S2	Raise capability through drills	Raise cyber resilience through periodic drills so critical operations can be restored safely and on time.

EV.ST. Evolve: strategies

Ref	Control	What it requires
EV.ST.S1	Anticipate new attack vectors	Plan to anticipate new attack vectors by adding or removing controls to cover known weaknesses, shrinking attack surface, and orienting controls toward emerging threats.
EV.ST.S2	Avoid common-mode failure	Show heterogeneity that limits common-mode failures, especially from threats that exploit common vulnerabilities.
EV.ST.S3	Change the business after incidents	Confirm business functions and supporting processes are changed after an incident to handle adversity better, and build the lesson into your resilience posture.
EV.ST.S4	Keep evolving (MIIs and Qualified REs)	MIIs and Qualified REs keep adapting and evolving to counter new cybersecurity threats and challenges.
EV.ST.S5	Evaluate resilience (mid-size and small-size REs)	Mid-size and small-size REs evaluate their cyber resilience posture periodically.

Download SEBI CSCRF controls list (Excel)Free account needed. You come straight back to the file.

SecureXcel unified controls workbook

Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.

A summary, not the source. The references and short headings identify each item. The wording beside them is our own summary and is not a quotation, a legal opinion or advice. Check the published source for the exact requirement. We help organisations with this: see our VAPT service.

Questions people ask

Which entities does the CSCRF apply to?

SEBI regulated entities. It sorts them into five categories (MIIs, Qualified REs, Mid-size REs, Small-size REs and Self-certification REs) by clients, trade volume, assets and similar thresholds, and the standards that apply depend on the category.

What is the Cyber Capability Index?

A SEBI index built from 23 parameters that rates cybersecurity maturity from Exceptional to Fail. SEBI applies it to MIIs and Qualified REs, who assess themselves with it periodically.

Are the standards all mandatory?

Part I standards are mandatory for the entities they apply to. Part II guidelines give recommendations on how to meet them and flag the ones that are mandatory, and the framework's exemption table lists the relaxations for smaller categories.

Is this a complete statement of the CSCRF?

No. It is a plain-English summary of Part I in our own words, using SEBI's reference numbers. Read the circular and its annexures, and SEBI's later clarifications, before you rely on it.