Technical Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)

6. Technical Clarification for the following CSCRF clauses are given below:

6.1 Critical Systems definition (Page 26): Entities shall identify and classify their critical IT systems. Following systems shall be included in critical systems (both on premise and cloud):

a. Any system, if compromised, that will have an adverse impact on core and critical business operations.

b. Stores/ transmits data as per regulatory requirements.

c. Devices/ network through which critical systems are connected (through trusted channels).

d. Internet facing applications/ systems.

e. Client facing application/ systems.

f. All the ancillary systems used for accessing/ communicating with critical systems either for operations or for maintenance.”

Clarification: Above-mentioned para (f) shall now be read as under: Any other system which is on the same network segment where systems mentioned in para (a) to (e) are deployed.

6.2 Zero-trust security model (PR.AA.S4 and PR.AA.S5 guidelines – Page 97): “REs shall follow zero-trust security model in such a way that access (from within or outside REs’ network) to their critical systems is denied by default and allowed only after proper authentication and authorization.”

Clarification: Above-mentioned guidelines shall now be read as under: REs shall implement suggested strategies/ methodologies such as Zero-trust networks, segmentation, no single point of failure, high availability, etc. Further, the same shall be approved by IT committee for REs.

6.3 Mobile Application Security guidelines (PR.AA.S16 and corresponding guidelines – Page 102-103)

Clarification: Above-mentioned guidelines are recommendatory (not mandatory) in nature.

6.4 CO.S2 guidelines (Page 124-125): “If the cyber-attack is of high impact and has a broad reach, the RE shall give a press release which shall include (but not limited to) a brief of the incident, actions taken to recover, normal operation resumption status (once achieved), etc. and inform all the affected customers/ stakeholders. If the cyber-attack is of low impact and has a narrow/low reach, the REs shall inform all the affected customers/stakeholders.”

Clarification: Above-mentioned guidelines shall now be read as under: REs shall take action as per their approved Cyber Crisis Management Plan (CCMP).

6.5 CM.S3 guidelines (3.c) (Page 119): “REs shall deploy solutions such as BAS, CART, decoy, vulnerability management, etc. to enhance their cybersecurity posture.”

Clarification: Above-mentioned guideline shall now be read as under: It is recommended that REs consider deploying a range of security solutions in consultation with their IT Committee, such as threat simulation, vulnerability management, and decoy systems, to assess and enhance their cybersecurity posture.

6.6 SC.S2 (Page 56): “Suppliers and third-party service providers of information systems, components, and services shall be identified, prioritized, and assessed using a cyber-supply chain risk assessment process.”

Clarification: The above-mentioned cyber-supply chain risk assessment process may be done by the REs in consultation with their IT committee.

6.7 Submission of VAPT and Cyber audit report (Section 4.3-4.4 – Page 48-52, Annexure-A, Annexure-B )

Clarification: REs shall submit the summary of VAPT and cyber audit reports strictly as per the format mentioned in CSCRF. It is clarified that at no point of time, REs shall submit the explicit vulnerabilities unless and otherwise asked for the details by SEBI.

6.8 PO – Guideline 11 (Page 85): “The cybersecurity policy shall encompass the principles prescribed by National Critical Information Infrastructure Protection Centre (NCIIPC) of National Technical Research Organisation (NTRO), GoI in the report titled ‘Guidelines for Protection of National Critical Information Infrastructure’ and subsequent revisions, if any, from time to time.”

Clarification: The above-mentioned clause is applicable only on REs which have been identified as Critical Information Infrastructure (CII) by NCIIPC.

6.9 On boarding to Market-SOC (Box Item 11)

Clarification: small-size and self-certification with few exclusions as mentioned in (CSCRF Box Item 11, DE.CM.S3 Guidelines (c-d) – Page 118) and (Clause 2.2, 2.6, 2.7 and 3 of SEBI circular vide SEBI/HO/ ITD- 1/ITD_CSC_EXT/P/CIR/2025/60 dated April 30, 2025) have been mandated to be on boarded on Market-SOC. Please refer Q. 60 of CSCRF FAQs^[1] issued vide dated June 11,2025:

Question: In a scenario where an RE falling under small-size or self­certification REs category has its own SOC, is it necessary for such REs to get onboarded to Market-SOC?

Answer: It is imperative that setting up own SOC is a costly proposition. Hence, SEBI has mandated NSE and BSE to setup Market-SOC (M-SOC) where small-size REs and self-certification REs can get onboarded and take the benefit to stay cyber secure and resilient. However, REs who have their own SOC and falling under the category of small-size REs or self-certification REs by virtue of their regulatory activity may leverage their existing SOC. Further, such REs shall be required to submit the SOC efficacy report periodically as mandated in CSCRF.

6.10 RP.S2 guideline (Page 128-129): “In the event of disruption of any one or more of the critical systems, the RE shall, within 30 minutes of the incident, declare that incident as ‘Disaster’ based on the business impact analysis. Accordingly, the RTO shall be two (2) hours as recommended by IOSCO^[2] for the resumption of critical operations. The RPO shall be 15 minutes for all REs. The recovery plan shall be scenario-based and in line with the RTO and RPO specified.”

Clarification: Above-mentioned guideline shall now be read as under as referred from IOSCO^[3]: Resumption within two hours (i.e. two-hour RTO). REs shall design and test its systems and processes to enable the safe resumption of critical operations within two hours of a disruption, even in the case of extreme but plausible scenarios. Notwithstanding this capability to resume critical operations within two hours, when dealing with a disruption REs shall exercise judgment in effecting resumption so that risks to itself or its ecosystem do not thereby escalate. In consultation with their IT Committee, REs shall also plan for scenarios in which the resumption objective is not achieved.

Further, RPO for critical systems shall be 15 minutes as per SEBI circular^[4] dated March 22, 2021.

6.11 Requirement of ISO 27001 certification for Qualified REs (PR.IP.S16 (Page 66) and corresponding guideline (Page 115), and Section 4.2 – Page 47)

Clarification: Qualified REs are encouraged and recommended (not mandatory) to obtain ISO 27001 certification.

6.12 While receiving and handling cyber audit reports submitted by their members, Stock Exchanges and Depositories shall ensure that adequate safeguards are in place to maintain the confidentiality and integrity of such reports.

^[1]  Refer https://www.sebi.gov.in/sebi data/faqfiles/jun-2025/1749647139924.pdf

^[2] Refer https://www.bis.Org/cpmi/publ/d 146.pdf.

^[3] Refer https://www.iosco.org/librarv/pubdocs/pdf/IOSCOPD535.pdf

^[4] Refer https://www.sebi.gov.in/legal/circulars/mar-2021/guidelines-for-business-continuitv-plan-bcp-and-disaster-recoverv-dr-of-market-infrastructure-institutions-miis- 49601.html