What are the key SEBI CSCRF controls for a stockbroker?

Stockbrokers under SEBI CSCRF must implement controls across 6 functions: GV (board-approved cybersecurity policy, CISO designation, risk register); ID (asset inventory, vulnerability assessment); PR (MFA for trading access, patch management, data encryption); DE (SIEM, intrusion detection); RS (IR plan, CERT-In reporting within 6 hours); RC (BCP, DR drill records). Category I brokers must achieve Tier 3 maturity by the SEBI deadline.

What is the difference between SEBI CSCRF Tier 1, 2, 3, and 4?

SEBI CSCRF maps to NIST CSF Tiers: Tier 1 (Partial) — ad-hoc processes, no formal cyber risk management; Tier 2 (Risk Informed) — risk management approved but not organisation-wide; Tier 3 (Repeatable) — organisation-wide cybersecurity risk management formally approved, continuously updated; Tier 4 (Adaptive) — actively adapted based on threat intelligence and lessons learned. SEBI expects Category I entities at Tier 3–4.

What dashboard gate items does SEBI CSCRF require?

SEBI CSCRF requires entities to maintain a Cyber Security Dashboard visible to the Board with: current maturity tier, open high/critical findings, incident count and status, control effectiveness scores, VAPT status, and compliance with SEBI circulars. This dashboard is typically reviewed at quarterly Board Risk Committee meetings.

What evidence is required for SEBI CSCRF DE (Detect) controls?

DE controls require evidence of: SIEM deployment and alert log for the past 12 months; threat intelligence feed subscriptions and consumption; vulnerability scanning schedule and results; anomaly detection rules in place; user behaviour analytics (for Category I); and network traffic analysis capability. Inspectors ask for log retention policy (minimum 1 year online, 5 years archived under SEBI rules).

How often does SEBI inspect CSCRF compliance?

SEBI conducts annual inspections of stock exchanges, clearing corporations, and depositories (Category I). For stockbrokers and other intermediaries, SEBI conducts risk-based inspections — high-risk entities may be inspected annually, others every 2–3 years. SEBI also receives CSCRF self-assessment reports annually from all entities.

Matrix · SEBI CSCRF

SEBI CSCRF Control & Maturity Matrix

A structured matrix mapping SEBI's Cyber Security and Cyber Resilience Framework (CSCRF) to NIST CSF 2.0 tiers, with maturity scoring per function and the mandatory gate items for CISO dashboard reporting.

Published 7 Apr 2026 Updated 7 Apr 2026 Read time 8 min Category Matrix By CreativeCyber

SEBI CSCRF: 6 NIST CSF 2.0 domains — amber = Tier 2 minimum, teal = Tier 3 mandatory, red badge = 4-hour SEBI reporting obligation on RESPOND

Controls across all 6 NIST CSF 2.0 functions

Domains — GV · ID · PR · DE · RS · RC

4 hrs

SEBI incident reporting window (tighter than CERT-In 6h)

CEO

Declaration required — Board direct accountability

SEBI CSCRF — MAKER/CHECKER EVIDENCE WORKFLOW TO CEO DECLARATION

Maker/Checker workflow enforces dual-control on every CSCRF control — rejection loops back for re-submission; locked assessments feed CEO Declaration then Board Report for SEBI

SEBI CSCRF Control & Maturity Matrix

Found this matrix useful?

Related Resources