SEBI's CSCRF, what it asks of regulated entities

Understand and communicate the critical services and objectives that outside parties expect from you.

Understand and manage the legal and regulatory requirements on cybersecurity, data protection and privacy.

Understand and communicate which outcomes and services depend on external resources such as third-party providers.

Leadership owns cybersecurity risk and builds a risk-aware culture that keeps improving.

Develop, communicate, understand and enforce cybersecurity roles, responsibilities and authorities.

Appoint a CISO or designated officer who reports to a named authority.

Align budget planning with information security and privacy goals and give them enough resources.

Allow staff and third parties onto information systems only after they sign a confidentiality and integrity agreement.

Include cybersecurity in human resources training programmes.

Document and implement a cybersecurity and cyber resilience policy approved by the Board, partners or proprietor, covering the framework's standards and guidelines.

Review the cybersecurity and cyber resilience policy periodically.

Set a policy for managing cyber risk based on your context, strategy and priorities, then communicate and enforce it.

Review and update the risk policy as requirements, threats and technology change.

Define an owner and custodian for every asset and a clear chain of command for approvals.

Review the outcomes of the cyber risk strategy to inform and adjust direction.

Adjust the risk strategy so it covers organisational needs and risks.

Evaluate and review how well cyber risk management is performing.

Assess cyber resilience with the Cyber Capability Index on a periodic basis, where it applies to your category.

Prepare a cyber risk management framework to identify, assess, mitigate and monitor risks, with objectives agreed by stakeholders.

Include cybersecurity activities and outcomes in your wider risk management processes.

Document different scenarios and responses and test them periodically to check the risk plan.

Set, communicate and maintain risk tolerance and appetite statements and keep a risk register reviewed by the IT Committee for REs.

Identify, establish, assess, manage and agree a cybersecurity supply chain risk management process with stakeholders.

Identify, prioritise and assess suppliers and third-party providers with a supply chain risk assessment.

Include measures in supplier contracts that support your cybersecurity programme, including enough cybersecurity manpower.

Monitor and review compliance of providers that perform critical activities, on a periodic basis.

Obtain a software bill of materials for new software used in core and critical activities and keep it updated, with approval from the Board, partners or proprietor for legacy exceptions.

Run response and recovery planning and testing together with third-party providers.

Assess and review concentration risk on outsourced agencies to support operational resilience.

Require third-party providers to follow similar information security standards.

Inventory physical devices, digital assets such as URLs, domains, applications and APIs, shared and cloud resources, and interfacing systems, in a time-bound manner.

Map and inventory communications, data flows and encryption methods across IT systems and network resources.

Make sure no shadow IT assets exist in the organisation.

Have the Board, partners or proprietor approve the list of critical systems.

Maintain inventories of data and the related metadata for designated data types.

Manage all inventoried IT assets and data through their full lifecycle.

Identify, validate and document asset vulnerabilities and assess risk factors for all IT assets.

Assess the risk of the IT environment on a periodic basis, including post-quantum risks.

Receive cyber threat intelligence from trusted sources, join the CERT-In intelligence platform and act on CERT-In and CSIRT-Fin advisories promptly.

Use threats, vulnerabilities, likelihood and impact to understand inherent risk and prioritise responses, with attention to access and authentication.

Choose, prioritise, plan, track and communicate risk responses.

Issue, manage, verify, revoke and audit identities and credentials for authorised devices, users and processes.

Protect network integrity, for example through segregation and segmentation.

Grant access on the principle of least privilege with segregation of duties, on premises and in the cloud.

Follow a Zero Trust model when allowing people, devices and resources to reach your resources.

Review and document access rights periodically and use a maker-checker process for granting, revoking and changing rights.

Document and implement an authentication policy, with strength matched to the risk of the transaction.

Use multi-factor authentication on all critical systems for users connecting from an untrusted to a trusted network.

Document and implement a log management policy.

Identify user logs uniquely and store them for a specified period.

Manage, monitor and protect physical access, record access to critical systems continuously and screen people before they get access.

Review privileged user activity periodically and limit employee and third-party access to what is needed, for a limited time and under close supervision.

Track and administer remote access to assets strictly.

Document and implement a data disposal and data retention policy.

Document standard procedures for handling and disposing of storage media.

Define and implement access control for endpoints, networks, APIs, removable media, laptops and mobiles.

Vet mobile applications against security requirements and test them before deployment.

Define and implement API security with proper authentication and authorisation.

Run mandatory, periodic awareness programmes on cybersecurity, cyber resilience and system hygiene, updated for new threats.

Make sure privileged users understand their roles and responsibilities.

Make sure third-party stakeholders such as suppliers, customers, investors and partners understand their roles and responsibilities.

Make sure senior executives and Board members understand their roles, with a dedicated programme for the Board.

Make sure physical and information security personnel understand their roles and responsibilities.

Protect data at rest and in transit with industry-standard encryption, and for market infrastructure institutions explore protection of data in use.

Classify data into Regulatory Data and IT and Cybersecurity Data and keep both available and readable within India.

Maintain enough capacity to keep data available.

Put measures and tools in place against data leaks.

Keep development and test environments separate from production, with at least one non-production environment to test critical software before release.

Use integrity mechanisms to verify software, firmware and information in critical systems, for market infrastructure institutions.

Create and maintain a baseline configuration for IT systems based on security principles such as least functionality.

Implement a system development life cycle to manage systems.

Put in place configuration change control and change management.

Scan critical software and applications thoroughly to make sure no malicious code is present.

If you do not own the source code, get an undertaking from the provider that the software is free of known vulnerabilities, malware, malicious code and covert channels.

Test or certify software so that it works only as intended, follows secure design and coding practice and addresses known flaws.

Document a backup and recovery plan so that no data is lost.

Implement, test and maintain data backups, with periodic restore drills.

Define and follow policies for the physical operating environment of assets.

Measure how effective protective technologies are on a regular basis in line with service levels.

Have incident response, business continuity, incident recovery and disaster recovery plans in place, regularly tested and updated.

Develop and implement a vulnerability management plan.

For cloud use, comply with SEBI's framework for adoption of cloud services by regulated entities.

Use only CERT-In empanelled information security auditors for external audits, including the cyber audit, against the standards and mandatory guidelines.

Certify SaaS, hosted services, off-the-shelf, customised and in-house software for application security and functional audit.

Obtain ISO 27001 certification, for market infrastructure institutions and qualified entities.

Follow globally recognised standards such as the CIS Critical Security Controls, for market infrastructure institutions and qualified entities.

Perform and log maintenance and repair of assets using approved and controlled tools.

Approve and log remote maintenance and perform it in a way that prevents unauthorised access.

Identify and rank patches by severity, apply critical patches at the earliest and test patches in non-production before applying them to the data centre and disaster recovery site.

Run a security operations centre covering network, endpoints, physical environment, personnel activity, malicious code, mobile code and third-party activity, available 24x7x365.

Set up continuous monitoring in the SOC to detect unusual or malicious activity in time.

Monitor and investigate all anomalies and alerts within the stipulated time.

Monitor capacity use of all critical systems.

Run cybersecurity, configuration, implementation and change management audits and VAPT to find weaknesses in the IT environment.

Define roles and responsibilities for detection so that someone is accountable.

Test detection processes with playbooks and use cases.

Communicate event detection information as required by regulation and your own policy.

Run periodic goal-based red team exercises that simulate attackers, for market infrastructure institutions and qualified entities.

Run threat hunting and compromise assessments on a regular basis.

Document a Cyber Crisis Management Plan with scenario-based procedures and an incident response plan, and trigger it as soon as an incident occurs.

Maximise your ability to respond quickly and well to adverse conditions, attacks or signs of them, to keep operations running.

Prepare contingency plans, continuity of operations, training, exercises, and incident response and recovery plans, approved by the Board, partners or proprietor.

Contain and mitigate incidents and either fix newly found vulnerabilities or document them as accepted risks.

Join the Cyber Swachhta Kendra and other CERT-In initiatives, for market infrastructure institutions and qualified entities.

Prepare and implement a procedure that sets out the roles and responsibilities of staff in cyber incident response.

Notify SEBI, CERT-In and NCIIPC, as applicable, of incidents within the stipulated time, and report other incidents under the guidelines.

Coordinate with stakeholders during a cyber incident as set out in your crisis management plan.

Set up processes to receive, analyse and respond to vulnerabilities and incidents disclosed from internal and external sources.

Categorise incidents in line with the categories in your crisis management plan.

Investigate incidents and alerts in detail, with forensic analysis where appropriate, to find the root cause, the attacker's methods and any lateral movement.

Carry out root cause analysis to find the gaps in people, process and technology and strengthen your security posture.

Always carry out an impact analysis of incidents, with root cause and forensic analysis as set out in the classification and handling guidance.

Build lessons learned from incident handling into response plans, training and testing, and implement the changes.

Communicate changes to the response plan to designated key personnel.

Classify recovery plans by different cyber scenarios.

Meet the recovery time and recovery point objectives set by SEBI when restoring systems after a cyber incident.

Conduct drills periodically to test different recovery scenarios.

Document backup and recovery plans so that no data is lost.

Manage public relations during a cyber incident as set out in the recovery plan.

Communicate recovery activities to internal and external stakeholders and to executive and management teams.

Tell all related stakeholders what was done during recovery.

Update and improve recovery plans using lessons learned from cyber incidents.

Upgrade cyber resilience capabilities through periodic drills so critical operations are restored safely and on time.

Form strategies to anticipate new attack vectors, apply or remove controls to cover weaknesses and reduce attack surfaces.

Show diversity in technology so that one common weakness cannot take everything down.

Confirm that business functions and processes are changed after incidents so they handle adversity better, and build the learning into your resilience posture.

Keep adapting and evolving to counter new threats, for market infrastructure institutions and qualified entities.

Evaluate your cyber resilience posture periodically, for mid-size and small entities.