Sebi clarifies on cybersecurity and cyber resilience framework

Sebi Sheds Light on Cybersecurity Framework: Key Updates for Regulated Entities

The Securities and Exchange Board of India (Sebi) issued a clarification on its Cybersecurity and Cyber Resilience Framework (CSCRF) on August 28, 2025, providing much-needed clarity for regulated entities (REs).

Key Highlights:

• Scope of Application: The CSCRF applies only to systems directly involved in Sebi-regulated activities. Shared infrastructure will be audited unless already covered by the RBI or another regulator.
• Equivalence of Regulations: REs meeting equivalent RBI (or other regulator) cybersecurity standards will be deemed compliant with Sebi's framework.
• Critical System Definition: Sebi clarified the definition of "critical systems," encompassing those affecting core operations, handling regulatory data, client-facing applications, internet-facing systems, and systems on the same network.
• Zero-Trust Principles: REs are encouraged to adopt zero-trust principles including network segmentation, high availability, and eliminating single points of failure, with IT Committee approval.
• Mobile Application Guidelines: Guidelines for mobile applications are recommendatory, not mandatory.
• Cyber Crisis Response: Entities must adhere to their Cyber Crisis Management Plan, rather than issuing press releases, during cyber crises.
• Security Tools: Deployment of tools like threat simulations, vulnerability management, and decoy systems is encouraged but not compulsory.
• Third-Party Risk Assessment: Entities must assess third-party/vendor risks in consultation with their IT Committees.
• Audit Confidentiality: Stock exchanges and depositories must maintain the confidentiality and integrity of cyber audit reports.
• Disaster Recovery: REs must achieve a Recovery Time Objective (RTO) of two hours, a Recovery Point Objective (RPO) of 15 minutes, and plan for scenarios exceeding these timelines.
• Revised Categorization of Regulated Entities: Sebi revised thresholds and categories for REs under the CSCRF, particularly for Portfolio Managers and Merchant Bankers. This includes distinctions between Qualified, Mid-size, Small-size, and Self-certification REs based on Assets Under Management (AUM) for Portfolio Managers and activity status for Merchant Bankers.

For Portfolio Managers:

• > Rs 10,000 crore AUM: Qualified REs
• Rs 3,000 crore - Rs 10,000 crore AUM: Mid-size REs
• Rs 3,000 crore or below AUM: Small-size REs
• Below Minimum Threshold: Self-certification REs

For Merchant Bankers:

• Active: Classified as Small-size REs
• Inactive: Exempt from CSCRF provisions

This clarification provides much-needed guidance for REs navigating the complexities of cybersecurity compliance in the Indian market.