What is the SEBI CSCRF and who does it apply to?

CSCRF (Cybersecurity and Cyber Resilience Framework) is SEBI's mandatory compliance framework applicable to all SEBI-registered entities including stock brokers, AMCs, depositories, portfolio managers, AIFs, RTAs, and fintech platforms. There are no exemptions based on size, age, or stage of business.

Why must the SEBI CSCRF audit be conducted by a CERT-In empanelled firm?

SEBI's circulars explicitly require that cybersecurity audit reports submitted for regulatory compliance be produced by CERT-In empanelled auditors. Reports from non-empanelled providers are not accepted for SEBI compliance submissions regardless of the provider's reputation or other credentials.

How often is the SEBI CSCRF audit required?

SEBI mandates an annual cybersecurity audit under CSCRF for all registered entities. Significant cyber incidents may trigger unscheduled audits. Begin planning at least 3-4 months before your compliance deadline.

How long does a SEBI CSCRF audit take from start to final report?

Typically 3-4 weeks for mid-sized entities such as registered stock brokers or AMCs. Large or complex entities may require 6-8 weeks. Allow an additional 3-6 weeks for remediation and re-validation before final submission.

Do vendors and third-party service providers fall within CSCRF audit scope?

Yes. Third-party and vendor risk management is an explicit requirement under the CSCRF Protect pillar. Cloud service providers, technology platform vendors, and data processing partners are commonly in scope.

What is the log retention requirement under SEBI CSCRF?

SEBI CSCRF requires a minimum of two years of log retention for all critical systems, stored in a tamper-proof centralised manner with access controls.

How can I verify that an audit firm is genuinely CERT-In empanelled?

Visit cert-in.org.in, search for the firm's legal registered name, confirm the empanelment number and validity period, and request a copy of the empanelment certificate. Beware of firms claiming to be 'affiliated with' an empanelled auditor - only direct empanelment is accepted.

Does CSCRF require Business Continuity and Disaster Recovery testing?

Yes. The Recover pillar requires documented BCP and DRP with defined RTOs and RPOs for critical systems, plus evidence of annual drill execution with results reported to board.

Will the CSCRF audit disrupt our trading or operational systems?

No. ISECURION follows strictly controlled testing methodologies. Intrusive penetration testing is scheduled during approved maintenance windows or in staging environments to ensure zero disruption to trading or operational services.

Can ISECURION help with both SEBI CSCRF and ISO 27001 or SOC 2 compliance simultaneously?

Yes. ISECURION specialises in cross-framework compliance mapping, addressing CSCRF, ISO 27001, SOC 2, and RBI Cybersecurity Framework requirements in a unified, efficient engagement. This significantly reduces duplication of effort and total cost of compliance.

How do I engage ISECURION for a SEBI CSCRF audit?

Complete the quote form on this page, visit isecurion.com/contact-us.html, or email info@isecurion.com. We arrange a no-obligation scoping discussion and provide a customised proposal within 48 hours.

SEBI CSCRF Audit by CERT-In Empanelled Firm in India 2026 | Complete Checklist & Guide

What Is SEBI CSCRF and Why It Is Non-Negotiable for All Registered Entities

The Cybersecurity and Cyber Resilience Framework (CSCRF) is SEBI's mandatory compliance framework for all registered entities operating within India's capital markets ecosystem. It is not optional - non-compliance can result in penalties, operational restrictions, and board-level escalations. The framework is built around five internationally recognised pillars that ensure full lifecycle cybersecurity management for stock brokers, AMCs, depositories, portfolio managers, AIFs, RTAs, fintech and WealthTech platforms.

Identify Protect Detect Respond Recover

Who Does SEBI CSCRF Apply To?

CSCRF applies to all SEBI-registered entities - stock brokers, AMCs, depositories, portfolio managers, AIFs, RTAs, and regulated fintech platforms. There are no exemptions based on entity size, age, or revenue.

Annual Mandatory Audit Requirement

SEBI mandates an annual cybersecurity audit conducted exclusively by a CERT-In empanelled auditor. No other auditor category is accepted for formal SEBI compliance submissions, regardless of other credentials held.

Consequences of CSCRF Non-Compliance

Financial penalties · Trading restrictions · Operational restrictions · Heightened SEBI inspections · Mandatory corrective action orders · In serious cases: suspension of SEBI registration.

Why Urgency Matters in 2026

With digital trading volumes at record highs and cyber incidents targeting financial infrastructure globally, SEBI has significantly increased enforcement of cybersecurity compliance across all regulated entities.

CSCRF compliance directly impacts business continuity, investor trust, third-party relationships, and operational resilience. The quality of your CERT-In empanelled audit partner determines the quality - and regulatory acceptance - of your compliance outcome.

Why Only CERT-In Empanelled Auditors Are Accepted by SEBI

CERT-In (Indian Computer Emergency Response Team) operates under MeitY as India's national cybersecurity authority. It maintains a rigorously vetted list of empanelled auditors authorised to conduct security assessments for regulated environments. SEBI accepts audit reports only from firms on this CERT-In list - no exceptions.

Mandatory Regulatory Acceptance

SEBI's circulars explicitly state that cybersecurity audit reports must come from CERT-In empanelled firms. Reports from non-empanelled providers are rejected regardless of the provider's other qualifications or market reputation.

Government-Backed Recognition

CERT-In empanelment confirms a firm's technical capability, ethical standards, methodology maturity, evidence handling practices - all assessed and periodically renewed by CERT-In / MeitY.

Standardised Audit Methodology

Empanelled firms follow structured, consistent methodologies aligned with national and international standards, ensuring reproducibility of findings and comparability across the regulated ecosystem.

Legally & Regulatorily Defensible

Audit reports, evidence packs, and risk registers from CERT-In empanelled auditors are structured to be legally defensible during SEBI inspections, investigations, and enforcement proceedings.

SEBI CSCRF Applies to These Entities - Does Your Category Require an Audit?

CSCRF covers the full spectrum of SEBI-registered entities. Each sector has unique threat exposure and infrastructure characteristics requiring specialised audit expertise - not a generic cybersecurity review.

Stock Brokers & Trading Platforms

High exposure to real-time transaction vulnerabilities, API security risks, algorithmic trading integrity, order management system (OMS) security, and FIX protocol audit requirements.

Asset Management Companies (AMCs)

Sensitive investor data, NAV computation systems, portfolio management platforms, and fund operations. CSCRF audit scope includes data protection, access controls, and third-party vendor risk.

Depositories & Clearing Corporations

Critical financial market infrastructure with systemic implications. CSCRF audit scope covers the full five-pillar framework with emphasis on detect, respond, and recover capabilities.

Portfolio Managers & AIFs

Rapidly growing sector with increasing institutional participation. Tightening SEBI compliance scrutiny across fund documentation, investor data handling, and platform security.

Fintech & WealthTech Platforms

Complex API-driven architectures, cloud dependencies, and large retail customer bases. Third-party vendor risk, cloud security, and mobile application security are critical CSCRF audit scope areas.

Registrar & Transfer Agents (RTAs)

Custodians of investor records for millions of shareholders. Data integrity, access control, incident response, and log management are key CSCRF audit focus areas for RTAs.

The Complete 10-Point Checklist for Choosing a CERT-In Empanelled SEBI CSCRF Auditor

Not all CERT-In empanelled firms are equal in capital markets expertise. Use this checklist to rigorously evaluate audit partners before engagement. Each point covers what to look for, what to ask, and which red flags to avoid.

Verify Active CERT-In Empanelment Status

Empanelment is time-bound and must be active at the time of engagement. Expired empanelment means the firm is not authorised to produce SEBI-accepted audit reports.

Cross-check the firm's name on the official CERT-In empanelled auditors list at cert-in.org.in
Confirm the empanelment number and current validity period are active
Verify the empanelment scope covers both VAPT and compliance audits
Request a copy of the current empanelment certificate directly from the firm

Red Flag: Firms claiming to be "partnered with" or "associated with" a CERT-In empanelled auditor. Only direct empanelment is accepted by SEBI.

Assess SEBI CSCRF Domain Expertise

CSCRF has capital-markets-specific requirements that generic IT auditors frequently miss - including trading infrastructure, market data systems, settlement workflows, and SEBI-specific control expectations.

Ask how many SEBI-regulated entities (stock brokers, AMCs, fintech platforms) the firm has audited in the last two years
Request sanitised case studies or reference letters from similar entity types
Confirm familiarity with trading system architectures, FIX protocol, order management systems (OMS), and API-driven platforms
Verify the audit team includes professionals with capital markets IT domain knowledge - not just generic security backgrounds

Red Flag: Auditors who cannot articulate SEBI-specific control requirements or propose the same generic scope regardless of entity type.

Confirm In-House VAPT Capability

VAPT is mandatory under SEBI CSCRF. When VAPT is outsourced to sub-contractors, you risk misaligned reporting, delayed timelines, and critical gaps between test findings and audit conclusions.

Confirm VAPT is performed by the auditor's own certified engineers - not subcontracted
Verify VAPT findings are directly integrated into the CSCRF audit report
Ask about coverage: network VAPT, web application testing, mobile app testing, API security, and cloud infrastructure
Confirm tools and methodologies align with OWASP, PTES, and CERT-In guidelines

Red Flag: Firms that outsource VAPT to separate vendors - this creates evidence handling gaps and accountability issues during SEBI submissions.

Evaluate Audit Methodology and Process Structure

A credible CSCRF auditor follows a documented, structured engagement process mapped to all five CSCRF pillars. If they cannot explain their methodology clearly, that is a significant concern.

Phase 1: Gap Assessment - pre-audit identification of gaps against CSCRF requirements across all five pillars
Phase 2: Documentation Review - policies, procedures, governance frameworks, board approvals
Phase 3: VAPT Execution - technical testing of infrastructure, applications, and APIs
Phase 4: Control Validation - testing implemented security controls (MFA, SIEM, PAM, DLP, BCP/DR)
Phase 5: Report Preparation - SEBI-ready audit report with risk register and remediation roadmap

Red Flag: Auditors who jump directly to testing without a gap assessment, or cannot articulate how their methodology maps to the five CSCRF pillars.

Confirm the Full Deliverables Package

A SEBI CSCRF audit must produce a comprehensive set of deliverables. Incomplete deliverables will fail SEBI regulatory review - a compliance certificate alone is not sufficient.

CSCRF Audit Report - structured against all five framework pillars with evidence references
Risk Register - documented risks with likelihood, impact ratings, and ownership assignments
Gap Analysis Report - current state vs required state across all CSCRF controls
Remediation Roadmap - prioritised action plan with timelines and responsible owners
Evidence Pack - artefacts, screenshots, configurations, and test outputs for SEBI submission
VAPT Report - separate technical report with full vulnerability details and CVSS scores

Red Flag: Auditors offering only a "compliance certificate" without detailed supporting documentation. SEBI inspectors review the full evidence pack.

Verify Auditor Independence and No Conflict of Interest

Regulatory audits require strict independence. An auditor who implemented your security controls cannot objectively assess them - this is a fundamental conflict SEBI does not accept.

Confirm the auditor has no financial interest in your organisation
Ensure the firm did not implement the security controls being assessed
Verify there are no commercial relationships that could compromise objectivity
Confirm the lead auditor has no personal conflicts with key personnel at your organisation

Red Flag: Vendors offering to both implement your CSCRF security controls and audit the same implementation - this is a direct conflict of interest.

Assess Experience Across Sectors and Technology Stacks

CSCRF audits require experience across a specific intersection of capital markets sectors and technology stacks. General BFSI experience alone is not sufficient.

Capital markets and BFSI sector audit experience across multiple entity types (brokers, AMCs, fintech)
Cloud security assessment (AWS, Azure, GCP, private cloud) relevant to cloud-hosted fintech platforms
API and microservices security testing for fintech and algorithmic trading platforms
SaaS and third-party vendor risk assessment for integrated platforms
Cross-framework experience: ISO 27001, SOC 2, PCI-DSS, RBI Cybersecurity Framework for cross-compliance mapping

Confirm Realistic Audit Timeline and SLA Commitments

SEBI compliance timelines are fixed. Your auditor must commit to binding milestones - not vague estimates that slip closer to submission deadlines.

Typical timeline: 3–4 weeks for mid-sized entities; 6–8 weeks for large or complex organisations
Ensure a signed statement of work with phase-wise milestone dates
Confirm dedicated project management and a single point of contact
Ask about capacity - ensure the firm is not overextended across too many simultaneous CSCRF engagements

Red Flag: Auditors who cannot commit to milestone dates, or who propose completing a full CSCRF audit in under two weeks - this signals an incomplete scope.

Evaluate Post-Audit Remediation and Re-Validation Support

The audit report is only the beginning. After findings are remediated, a re-validation exercise confirms closure and produces the final clean compliance report for SEBI submission.

Confirm the firm provides technical remediation guidance - not just a list of findings
Ask about re-validation testing after remediation is complete
Enquire about continuous compliance monitoring support between annual audits
Check if the firm can assist with SEBI communication and response during regulatory inspections

Consider Geographic Presence and On-Site Support Capability

Certain audit phases - physical security reviews, on-site infrastructure assessments, sensitive control validations - benefit from local qualified presence.

Confirm the auditor has qualified engineers available in or near your primary operating city
Key markets: Mumbai, Bengaluru, Delhi NCR, Hyderabad, Chennai, Pune, Ahmedabad, Kolkata
For multi-location entities, confirm coverage across all in-scope sites
Ask about travel policies and any additional costs for on-site visits

SEBI CSCRF Compliance Checklist - All Five Pillars

Key control expectations under each CSCRF pillar. Use this to assess your current compliance posture and track remediation progress during the audit cycle.

CSCRF Pillar	Control Area	Key Requirements & Audit Focus
1. Identify	Governance & Policy Framework	Board-approved cybersecurity policy; documented risk management framework; CISO appointment; clear roles and responsibilities; regular policy reviews and board sign-off.
	IT Asset Management	Complete inventory of hardware, software, and data assets; asset classification by criticality; third-party and cloud asset inventory; decommissioned asset tracking.
	Risk Assessment	Annual risk assessments aligned to CSCRF; documented risk register with ratings; risk treatment plans; board-level risk reporting and review cadence.
2. Protect	Access Control (MFA, PAM, RBAC)	Multi-factor authentication (MFA) for all critical systems; privileged access management (PAM); role-based access control (RBAC); regular access reviews and recertification.
	Data Protection & DLP	Data classification policy; encryption at rest and in transit for sensitive data; data loss prevention (DLP) controls; secure data disposal procedures.
	Vendor & Third-Party Risk	Third-party security assessment processes; contractual security obligations for vendors; ongoing vendor monitoring; cloud service provider security reviews.
3. Detect	SIEM & Security Monitoring	SIEM deployment and configuration; 24×7 security operations monitoring; anomaly detection rules; integration of network, endpoint, and application logs.
	Log Management (2-Year Retention)	Centralised log aggregation; minimum 2-year log retention mandated by SEBI; tamper-proof log storage; log access controls and regular log review procedures.
	VAPT & Security Testing	Annual VAPT covering network, applications, APIs, and mobile; red team exercises for critical entities; application security testing in SDLC; penetration test remediation tracking.
4. Respond	Incident Response Plan (IRP)	Documented and tested IRP; defined escalation matrix; designated incident response team; post-incident review and lessons-learned process with board reporting.
4. Respond	SEBI Breach Notification	Defined process for notifying SEBI within mandated timelines; breach notification templates; regulatory liaison contacts; forensic evidence preservation with chain-of-custody.
5. Recover	BCP & Disaster Recovery (DR)	Board-approved BCP and DRP; defined RTOs and RPOs for critical systems; regular backup testing; alternate site or cloud failover capability; dependencies mapped and tested.
5. Recover	Annual BCP/DR Drills	Annual BCP/DR drills with documented results; tabletop exercises for incident scenarios; results reported to board; improvement actions tracked to closure.

Common Mistakes When Selecting a CSCRF Auditor - Avoid These to Prevent Audit Failure

These are the most frequently observed mistakes that lead to CSCRF audit failures, regulatory non-acceptance, and costly re-engagements across India's capital markets ecosystem.

Mistake 1: Choosing on Price Alone

Lowest-cost auditors achieve savings through reduced scope, junior-only teams, and templated reports. Incomplete CSCRF audits fail regulatory review and require expensive re-engagement. The cost of a deficient audit vastly exceeds any saving on the initial engagement fee.

Mistake 2: Ignoring SEBI-Specific Experience

CSCRF has capital markets-specific control requirements that differ significantly from generic IT security frameworks. Auditors without SEBI domain expertise produce findings that miss regulatory nuances - gaps that only surface during SEBI inspections.

Mistake 3: Separating VAPT from the Compliance Audit

CSCRF requires VAPT and the compliance audit to be integrated. Disconnected VAPT and audit reports create gaps in the evidence pack that SEBI reviewers flag as incomplete submissions, triggering additional regulatory correspondence.

Mistake 4: Underestimating Documentation Requirements

SEBI submissions require a comprehensive evidence pack alongside the audit report. Organisations that engage auditors with poor documentation practices frequently have submissions queried or rejected, triggering additional inspection cycles.

Mistake 5: Last-Minute Engagement

Engaging an auditor weeks before the compliance deadline leaves no time for gap assessment, remediation, re-validation, and report finalisation. Rushed audits consistently produce incomplete findings and compressed evidence packs that fail detailed SEBI scrutiny.

Mistake 6: Not Planning for Remediation Time

The initial audit produces findings requiring remediation and re-validation before a clean compliance report can be issued. Factor in 4–6 additional weeks for remediation and re-validation in your annual SEBI CSCRF compliance calendar.

CERT-In Empanelled vs Non-Empanelled Auditor - Why There Is No Choice

This comparison highlights why CERT-In empanelment is a non-negotiable requirement - not a preference - for SEBI CSCRF compliance audits.

Evaluation Criterion	CERT-In Empanelled Auditor ✅	Non-Empanelled Provider ❌
SEBI Report Acceptance	Formally accepted by SEBI	Not accepted for compliance submissions
Government Recognition	Formally recognised by CERT-In / MeitY	No government-backed validation
Evidence Handling Standards	Chain-of-custody; regulator formats	Varies; may not meet SEBI standards
Periodic Quality Review	Reassessed periodically by CERT-In	No independent quality oversight
Suitability for SEBI Inspections	Reports defensible during SEBI inspections	May be contested or disqualified
Post-Incident Forensic Reports	Accepted by national authorities	Acceptance not guaranteed; re-investigation may be required

Why ISECURION Is a Preferred CERT-In Empanelled Partner for SEBI CSCRF Audits Across India

ISECURION is a CERT-In Empanelled Information Security Auditing Organisation with deep specialisation in SEBI-regulated entities. Our combination of capital markets domain expertise, in-house VAPT capability, and end-to-end compliance support makes us a trusted partner for stock brokers, AMCs, depositories, fintech platforms, and other SEBI-registered entities across Mumbai, Bengaluru, Delhi NCR, Hyderabad, Chennai, Pune, Ahmedabad, and Kolkata.

CERT-In Empanelled

Formally empanelled by CERT-In / MeitY, confirming our methodology, technical capability, and ethical standards for conducting regulator-accepted cybersecurity audits across India's financial sector.

Proven SEBI CSCRF Expertise

Extensive audit experience across stock brokers, AMCs, fintech platforms, portfolio managers, and other SEBI-registered entities. We understand capital markets infrastructure - not just generic cybersecurity.

In-House VAPT - No Subcontracting

All VAPT is conducted by ISECURION's own certified ethical hackers, fully integrated with the CSCRF audit. Certifications include OSCP, CEH, CISSP, CISA, ISO 27001 LA, and CRISC.

Complete SEBI-Ready Deliverables

Every engagement delivers: audit report, risk register, gap analysis, remediation roadmap, VAPT report, and a full evidence pack structured for SEBI submission with minimal rework required.

End-to-End Compliance Support

Full lifecycle support - from initial gap assessment through VAPT, audit, remediation guidance, re-validation, post-submission SEBI correspondence support, and next-cycle planning.

Pan-India Coverage

Serving clients across Mumbai, Bengaluru, Delhi NCR, Hyderabad, Chennai, Pune, Ahmedabad, and Kolkata with both on-site and remote engagement models to match your operational requirements.

ISECURION's 7-Step SEBI CSCRF Audit Engagement Process

Our structured engagement model ensures no gaps between audit phases and delivers a complete, SEBI-ready compliance package within agreed timelines.

Initial Consultation & CSCRF Scoping

Understanding your entity type, systems in scope, current security posture, and SEBI compliance deadlines. Proposal and statement of work issued within 48 hours of initial discussion.

Gap Assessment Against All Five CSCRF Pillars

Pre-audit review of your current posture against CSCRF's Identify, Protect, Detect, Respond, and Recover pillars. Identifies priority remediation areas before the formal audit commences.

Documentation & Governance Review

Review of policies, procedures, risk frameworks, board approvals, vendor contracts, access control records, and incident response plans against CSCRF requirements.

In-House VAPT Execution

Technical testing of network infrastructure, web and mobile applications, APIs, cloud environments, and trading system components (OMS, FIX protocol, algorithmic trading systems) by certified ethical hackers.

Security Control Validation

Testing of implemented controls - MFA, SIEM, PAM, DLP, BCP/DR - against the five CSCRF pillars. Control effectiveness testing, not just documentation review.

SEBI-Ready Report Preparation & Evidence Pack

Structured CSCRF audit report, risk register, gap analysis, remediation roadmap, and full evidence pack prepared in SEBI-ready format for direct regulatory submission.

Remediation Support, Re-Validation & SEBI Submission

Guidance on remediating identified findings, re-validation testing, and issuance of the final compliance report with closure evidence for SEBI submission. Ongoing support through regulatory inspection if required.

SEBI CSCRF Audit Services - CERT-In Empanelled Firm Across India

SEBI-regulated entities in India's major financial and technology cities face the highest audit volumes and most active SEBI regulatory scrutiny. ISECURION delivers CERT-In empanelled CSCRF audits with qualified support across all key cities.

SEBI CSCRF Audit - Mumbai

India's financial capital and SEBI headquarters proximity. Highest concentration of stock brokers, AMCs, depositories, and SEBI-regulated fintech entities requiring annual CSCRF audits by CERT-In empanelled firms.

SEBI CSCRF Audit - Bengaluru

India's technology and fintech hub. WealthTech platforms, API-driven brokers, and SaaS-based capital markets entities require CSCRF audits covering cloud architectures, microservices security, and API VAPT.

SEBI CSCRF Audit - Delhi NCR

Large broker ecosystems, portfolio managers, and AMC offices with significant SEBI oversight in Delhi, Gurugram, and Noida. Active compliance calendars drive demand for empanelled audit partners.

SEBI CSCRF Audit - Hyderabad & Chennai

Fast-growing BFSI and IT services ecosystems with increasing SEBI-regulated entity presence. Strong demand for CSCRF-ready CERT-In empanelled audit partners with regional on-site capability.

SEBI CSCRF Audit - Pune & Ahmedabad

Active fintech startup ecosystems and established brokerage communities requiring CSCRF audits as they scale operations and face increasing SEBI compliance obligations.

SEBI CSCRF Audit - Kolkata

Regional trading hubs and established brokerage houses with SEBI compliance requirements. ISECURION supports entities here through both on-site and remote audit delivery models.

Ready to Start Your SEBI CSCRF Audit? Get a Free Gap Assessment

ISECURION's CERT-In empanelled experts are ready to scope your CSCRF audit engagement. Free consultation. Proposal in 48 hours. Pan-India coverage.

Request Free CSCRF Gap Assessment Email Us Directly

Frequently Asked Questions - SEBI CSCRF Audit & CERT-In Empanelled Firms

Answers to the most common questions from Compliance Officers, CISOs, and management teams at SEBI-regulated entities about CSCRF compliance and auditor selection.

The Cybersecurity and Cyber Resilience Framework (CSCRF) is SEBI's mandatory compliance framework applicable to all SEBI-registered entities including stock brokers, asset management companies (AMCs), depositories, portfolio managers, alternative investment funds (AIFs), registrar and transfer agents (RTAs), and regulated fintech and WealthTech platforms. There are no exemptions - all registered entities must comply with CSCRF requirements and undergo annual audits by CERT-In empanelled auditors.

SEBI's circulars explicitly require that cybersecurity audit reports submitted for regulatory compliance be produced by CERT-In empanelled auditors. CERT-In empanelment is the Government of India's formal recognition that a firm meets the technical standards, methodology requirements, and ethical standards necessary to produce legally and regulatorily defensible audit outputs. Reports from non-empanelled providers are not accepted for SEBI compliance submissions regardless of the provider's reputation or other credentials.

SEBI mandates an annual cybersecurity audit under CSCRF for all registered entities. Additionally, if a significant cybersecurity incident occurs, entities may be required to undergo an unscheduled audit or provide forensic evidence. Begin planning for your annual CSCRF audit at least 3–4 months before your compliance deadline to allow adequate time for the audit process, remediation, re-validation, and final report preparation.

Yes. Vulnerability Assessment and Penetration Testing (VAPT) is mandatory under SEBI CSCRF. VAPT must cover the entity's network infrastructure, web applications, mobile applications, APIs, and trading system components as applicable. The VAPT findings must be integrated into the overall CSCRF audit report and remediation evidence provided as part of the compliance submission. ISECURION conducts all VAPT in-house, ensuring seamless integration with the CSCRF audit report - no subcontracting.

Failure to meet CSCRF requirements or submit an acceptable audit report can result in: financial penalties, heightened supervisory scrutiny, trading and operational restrictions, mandatory corrective action orders, and in serious cases, suspension of SEBI registration. SEBI has progressively increased enforcement activity around cybersecurity compliance, making it essential that entities engage credible, experienced CERT-In empanelled auditors who produce complete, regulator-ready submissions.

A typical CSCRF audit engagement for a mid-sized entity (e.g., a registered stock broker or AMC) takes approximately 3–4 weeks from kickoff to draft report delivery. Large or complex entities - depositories, clearing corporations, or multi-product fintech platforms - may require 6–8 weeks. Following the draft report, allow an additional 3–6 weeks for remediation, re-validation, and issuance of the final compliance report. Plan your annual SEBI CSCRF compliance calendar accordingly - engage your auditor at least 3-4 months before your submission deadline.

Yes. Third-party and vendor risk management is an explicit requirement under the CSCRF Protect pillar. SEBI-regulated entities are expected to assess the cybersecurity posture of their critical vendors, maintain contractual security obligations, and demonstrate ongoing vendor monitoring. Cloud service providers, technology platform vendors, and data processing partners are commonly in scope. ISECURION includes vendor risk assessment as part of our standard CSCRF engagement scope.

SEBI CSCRF requires a minimum of two years of log retention for all critical systems. Logs must be stored in a tamper-proof, centralised manner with access controls to prevent unauthorised modification or deletion. Log coverage should include network devices, servers, applications, user access events, and security monitoring systems. During a CSCRF audit, auditors verify both the existence of logs and the adequacy of the log management infrastructure, including SIEM deployment and 24×7 monitoring capability.

No. There are no exemptions based on entity size, age, stage of business, or revenue. All SEBI-registered entities - including recently registered fintech startups, new-age brokers, and first-time AMC licensees - are subject to CSCRF compliance requirements and must undergo annual audits by CERT-In empanelled firms. Newer entities often benefit most from an early CSCRF gap assessment to understand their compliance posture and prioritise investments before their first formal audit cycle.

To verify a firm's CERT-In empanelment status: (1) Visit the official CERT-In website (cert-in.org.in) and navigate to the empanelled auditors list. (2) Search for the firm's legal registered name and confirm the empanelment number is listed. (3) Check the validity period - empanelment is time-bound and must be active at the time of engagement. (4) Request a copy of the empanelment certificate directly from the firm and verify it matches the CERT-In listing. (5) Confirm the scope of empanelment covers the services you require. Beware of firms claiming to be "affiliated with" or "partnered with" an empanelled auditor - only direct empanelment is accepted by SEBI.

Yes. The Recover pillar of CSCRF explicitly requires documented Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP) with defined Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for critical systems. Annual BCP/DR drills must be conducted and results documented, with improvement actions tracked to closure. Auditors review both the documentation quality and evidence of actual drill execution - not just the existence of plans. ISECURION assesses BCP/DR maturity as a core component of all CSCRF engagements.

ISECURION follows strictly controlled testing methodologies designed to minimise operational disruption. The majority of a CSCRF audit - documentation review, governance assessment, log analysis, non-intrusive scanning - is conducted without any impact on live systems. For intrusive penetration testing, tests are scheduled during approved maintenance windows or conducted in staging environments after formal approval. All testing activities are coordinated with your IT and security teams before execution to ensure zero unexpected disruptions to trading or operational services.

SEBI requires regulated entities to notify SEBI of cybersecurity incidents within defined timelines. Entities must have a documented breach notification process, designated regulatory liaison contacts, and incident response plans that include specific steps for SEBI communication. Forensic evidence must be preserved with chain-of-custody to support regulatory investigations. ISECURION assists clients with incident response planning and forensic readiness as part of post-audit support.

Yes. ISECURION specialises in cross-framework compliance mapping, allowing SEBI-regulated entities to simultaneously address CSCRF, ISO 27001, SOC 2, and the RBI Cybersecurity Framework in a unified, efficient engagement. Many controls overlap across these frameworks. By mapping findings once and reporting against multiple frameworks, we significantly reduce duplication of effort and total cost of compliance - particularly valuable for fintech entities demonstrating compliance to SEBI, enterprise clients, and international partners simultaneously.

Engage ISECURION through three channels: (1) Complete the quote request form on this page - our team responds within one business day. (2) Visit our Contact Us page with your entity type and compliance requirements. (3) Email info@isecurion.com with your organisation name, entity type, and audit timeline. We will arrange a no-obligation scoping discussion and provide a customised proposal covering audit scope, timeline, deliverables, and pricing within 48 hours.

Plan Your SEBI CSCRF Audit with ISECURION - India's Trusted CERT-In Empanelled Partner

Serving SEBI-regulated entities across Mumbai, Bengaluru, Delhi NCR, Hyderabad, Chennai, Pune, Ahmedabad & Kolkata. Free gap assessment. SEBI-ready deliverables. Proposal in 48 hours.

Get Free CSCRF Gap Assessment Speak to a CERT-In Expert

SEBI CSCRF Audit by a CERT-In Empanelled Firm in India - Complete Guideline & Checklist (2026)