SEBI CSCRF Checklist 2025: Compliance Guide

The Securities and Exchange Board of India (SEBI) has strengthened the Cyber Security and Cyber Resilience Framework (CSCRF) to address emerging cyber threats across the securities market. This document provides a concise, actionable Markdown version of the SEBI CSCRF 2025 compliance checklist.

📌 Introduction

SEBI’s CSCRF 2025 framework focuses on:

• Cyber governance and oversight
• Strengthening operational security controls
• Enhancing detection and incident response
• Improved vendor and third-party risk management
• Regular audits and compliance reporting

1. Governance & Oversight

• Appoint a CISO with clearly defined roles
• Board/Audit Committee oversight of cybersecurity
• Cybersecurity strategy reviewed annually
• Cybersecurity Steering Committee established
• Periodic training for management and board members

2. Cybersecurity Policies & Documentation

• Updated Cybersecurity Policy aligned with 2025 CSCRF
• Information Security Management System (ISMS) defined
• Policies for access control, backups, and system hardening
• Annual review & approval of security policies
• Change management documentation maintained

3. Asset & Data Management

• Comprehensive IT asset inventory (servers, APIs, apps, endpoints)
• Data classification (Confidential / Internal / Public)
• Encryption for data at rest and in transit
• Secure data retention and disposal procedures
• Shadow IT monitoring and controls

4. Network Security & Zero-Trust Controls

• Segmentation for critical systems
• MFA for all remote and privileged access
• Zero-trust framework adoption roadmap
• Firewalls, IDS/IPS, and WAF properly configured
• Regular security rule reviews and testing

5. Access Control Management

• Role-based Access Control (RBAC) enforced
• Privileged Access Management (PAM) implemented
• Quarterly user access reviews
• Immediate revocation on employee exit
• Password and authentication standards defined

6. Vulnerability & Patch Management

• Routine vulnerability scans
• Periodic VA/PT (Vulnerability Assessment & Penetration Testing)
• Critical vulnerabilities patched within SEBI timelines
• Patch management logs maintained
• Continuous vulnerability monitoring tools deployed

7. Security Operations (SOC)

• 24×7 SOC monitoring (in-house or managed)
• SIEM implemented with log correlation rules
• Threat intelligence integrated into SOC workflows
• Quarterly update of detection use-cases
• Log retention per SEBI requirements

8. Incident Response & Reporting

• Incident Response Plan (IRP) defined
• Semi-annual incident response drills
• All incidents recorded and investigated
• Reporting to SEBI within mandated timelines
• Forensic readiness capabilities established

9. Business Continuity & Disaster Recovery

• Updated BCP/DR Plan
• DR drills conducted twice a year
• RTO/RPO targets documented and tested
• Redundant infrastructure for critical systems
• Backup integrity verification performed regularly

10. Third-Party & Vendor Risk Management

• Vendor due diligence before onboarding
• Security clauses included in vendor contracts
• Annual vendor risk assessments
• Monitoring of vendor security compliance
• Controls for outsourced IT services

11. Cybersecurity Audits & Compliance Reporting

• Annual cybersecurity audit by SEBI-empaneled auditor
• Observation closure tracking maintained
• Quarterly and annual compliance reports submitted
• Readiness for regulatory inspections ensured
• Evidence repository maintained for audit trails

• Mandatory maturity assessments for cybersecurity functions
• Stricter patching timelines for high-risk vulnerabilities
• Expanded vendor and cloud oversight requirements
• Stronger alignment with zero-trust principles
• Detailed incident reporting templates

The SEBI CSCRF 2025 framework reinforces cybersecurity governance, operational controls, and resilience measures for regulated entities. Following this checklist helps organizations:

• Stay compliant
• Improve security posture
• Reduce regulatory risks
• Strengthen cyber resilience

Contact info@adaptive.live for improving your security posture for SEBI cyber audits.