Question 1

What evidence do I need for SEBI CSCRF compliance?

Accepted Answer

SEBI CSCRF requires evidence across 6 domains: GV (Govern) — board-approved cybersecurity policy, risk register, CISO appointment letter; ID (Identify) — asset inventory, vulnerability register; PR (Protect) — access control logs, patch records, encryption certificates; DE (Detect) — SIEM alerts log, threat intel subscriptions; RS (Respond) — incident response plan, tabletop exercise records, CERT-In reports; RC (Recover) — BCP/DR plan, RTO/RPO documentation, recovery test reports.

Question 2

How does this SEBI CSCRF Evidence Checklist work?

Accepted Answer

Select a CSCRF domain (GV, ID, PR, DE, RS, RC) from the tab bar. For each evidence item listed, check the box if you hold that evidence. The tool shows a live readiness percentage for each domain, highlights missing items, and gives you a shareable overall score.

Question 3

What is the penalty for SEBI CSCRF non-compliance?

Accepted Answer

SEBI can impose penalties under SEBI Act Section 15HB (up to ₹1 crore per violation) and Section 11B (suspension of registration). Non-compliant entities may also face enhanced inspections, mandatory remediation timelines, and public disclosure requirements.

Question 4

When is SEBI CSCRF compliance mandatory?

Accepted Answer

Per SEBI Circular SEBI/HO/ITD/ITD-PoD-1/P/CIR/2024/33, the compliance deadline for stock exchanges, clearing corporations, and depositories was January 2025. Stockbrokers and other intermediaries had phased timelines based on their category (Category I by March 2025, Category II by June 2025).

Question 5

Which CSCRF domain is most commonly deficient in audits?

Accepted Answer

Based on SEBI inspection findings, DE (Detect) and RS (Respond) are consistently the weakest domains — specifically SIEM configuration evidence, threat hunting documentation, and formal IR plan with tested escalation matrices.