July 18, 2026 · Alastor InfoSec Team
SEBI CSCRF Compliance 2026: What Indian Fintech and Capital Market Firms Must Do Now
Indian fintech companies and capital market participants are navigating an unusually dense compliance calendar in 2026. DPDPA enforcement begins November 13. CERT-In's 6-hour breach notification mandate is active. And sitting underneath all of it — often underappreciated relative to DPDPA — is SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), which has been live and enforced since 2024 but whose practical implications many firms are still working out in 2026.
If your organisation is a Registered Investment Adviser, Stock Broker, Depository Participant, Mutual Fund, Portfolio Manager, or any other SEBI-regulated market participant, the CSCRF mandates a level of cybersecurity maturity that goes well beyond basic IT hygiene. This post covers what the framework requires, where firms typically fall short, and what a compliant posture looks like.
What Is SEBI's CSCRF?
The Cybersecurity and Cyber Resilience Framework (CSCRF) is SEBI's consolidated cybersecurity directive, updated substantially in 2023 and 2024, that applies to the full range of Regulated Entities (REs) in India's capital markets. It draws on internationally recognised standards — NIST CSF, ISO 27001, and CERT-In guidelines — and maps them to the specific risk profile of financial services.
The CSCRF is not a checkbox exercise. SEBI's framework organises requirements around five functions: Identify, Protect, Detect, Respond, and Recover. Each function carries specific controls, and SEBI-regulated entities are expected to demonstrate ongoing compliance, not just point-in-time compliance certified by an annual audit.
SEBI categorises REs into tiers based on size and systemic importance, with more rigorous requirements for Market Infrastructure Institutions (MIIs) such as stock exchanges and depositories. But even smaller Category 3 and Category 4 entities — which include many boutique brokers and RIAs — face non-trivial VAPT and audit obligations.
The VAPT Requirement Under CSCRF
One of the most operationally significant aspects of CSCRF is its explicit requirement for Vulnerability Assessment and Penetration Testing. SEBI mandates that regulated entities conduct:
Annual VAPT covering all internet-facing and critical internal systems, including web applications, APIs, trading platforms, order management systems, and back-office infrastructure. The VAPT must be performed by an empanelled CERT-In auditor or a qualified third-party security firm.
Post-change assessments whenever there are significant changes to the IT environment — new application deployments, infrastructure migrations, major software upgrades, or changes to network architecture. Many firms misunderstand this requirement as applying only to major transformations; in practice, any change that materially alters the attack surface triggers a reassessment obligation.
Continuous monitoring for Category 1 and Category 2 entities, which includes Security Operations Centre (SOC) capabilities, log management, and near-real-time alerting for critical security events.
The output of VAPT exercises must be documented, findings must be remediated within defined timelines based on severity, and evidence of remediation must be maintained for regulator inspection. SEBI has signalled it will audit compliance with these requirements more rigorously in the second half of 2026.
Where Firms Are Falling Short in 2026
Our engagements with SEBI-regulated entities in 2026 reveal a consistent set of gaps. The first is scope underestimation: firms conduct VAPT on their public-facing web portal but omit their trading APIs, internal admin panels, and third-party data feed integrations. SEBI's CSCRF considers these in scope.
The second gap is remediation tracking. VAPT reports are completed, filed, and forgotten. When SEBI asks for evidence that critical findings from last year's assessment were remediated within the mandated 30-day window, many firms cannot produce it.
The third gap is third-party risk. CSCRF requires regulated entities to ensure that their critical service providers — cloud vendors, data centres, trading technology vendors — maintain equivalent cybersecurity standards. In practice, most firms rely on vendor-supplied SOC 2 reports and assume they satisfy this requirement. They do not always cover the specific controls SEBI demands.
The fourth and increasingly significant gap is the DPDPA intersection. SEBI-regulated entities are also data fiduciaries under the DPDP Act. Consent frameworks, breach notification processes, and data retention policies must align to both regimes simultaneously. Firms that are treating DPDPA and CSCRF as entirely separate compliance tracks are creating fragmented documentation that satisfies neither regulator's requirements fully.
The Incident Response Requirement
CSCRF mandates that regulated entities maintain a tested Cyber Crisis Management Plan (CCMP). The plan must cover detection, containment, eradication, and recovery, and it must be tested through tabletop or live simulation exercises at least annually.
The CERT-In 6-hour reporting window — applicable to all CERT-In-covered entities, which includes most SEBI REs — adds a temporal dimension to incident response that most firms have not fully internalised. Six hours from the point of detection to regulator notification is a tight window that requires pre-approved notification templates, clear internal escalation chains, and pre-designated points of contact.
We have seen situations where firms discovered an incident on a Friday evening, escalated through a manual approval chain over the weekend, and notified CERT-In 42 hours later while believing in good faith they had acted promptly. Under current enforcement, that creates material compliance exposure.
ISO 27001 and SOC 2 as CSCRF Enablers
SEBI's CSCRF does not require ISO 27001 certification, but holding a current ISO 27001 certification significantly simplifies CSCRF compliance. The framework's control requirements map closely to ISO 27001 Annex A, and certified entities can demonstrate systematic implementation of the Identify and Protect functions with pre-existing documentation.
SOC 2 Type II is increasingly relevant for SaaS vendors that power capital market participants — their clients are asking for SOC 2 reports as part of vendor due diligence under CSCRF's third-party risk requirements.
Alastor Shield, our compliance automation platform, maps security findings directly to SEBI CSCRF controls alongside DPDPA, ISO 27001, and SOC 2, so your teams are building a single evidence base rather than three parallel documentation tracks.
A Practical Compliance Roadmap
For firms that have not yet fully assessed their CSCRF posture, the second half of 2026 is the window to act before SEBI's anticipated enforcement sweep.
Start with a gap assessment against the CSCRF control framework. Identify which controls are met, which are partially met, and which are absent entirely. This typically surfaces the scope and remediation issues described above.
Conduct or commission a comprehensive VAPT that covers the full scope required by CSCRF: internet-facing applications, APIs, internal networks, trading infrastructure, and third-party integrations. Ensure the assessing firm can produce output aligned to SEBI's evidence requirements, not just a generic penetration testing report.
Establish formal remediation tracking with severity-based SLAs. Critical findings within 30 days, highs within 60 days, mediums within 90 days. Document closure with screenshots, configuration extracts, or retesting evidence.
Align DPDPA and CSCRF compliance activities. Your data inventory, consent records, and breach response plan should satisfy both regulators simultaneously rather than being built as separate artefacts.
Review and test your incident response plan, including the notification workflow that must complete within CERT-In's 6-hour window.
Getting Started
SEBI CSCRF compliance is achievable with the right partner, but the window for comfortable implementation before regulatory scrutiny intensifies is narrowing. Alastor InfoSec has worked with SEBI-regulated entities across the broker, RIA, and fund management space to build compliant cybersecurity programmes that stand up to audit.
Contact us at [email protected] or explore Alastor Shield to see how we automate compliance evidence collection across SEBI CSCRF, DPDPA, ISO 27001, and SOC 2 simultaneously.
SEBI's CSCRF requires annual VAPT, continuous monitoring, tested incident response, and third-party risk oversight from every regulated entity — with DPDPA enforcement adding a parallel compliance track that must be addressed in the same programme.