SEBI CSCRF and VAPT: Requirements for Stock Brokers, Depositories and AMCs

Hero Summary

SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued on August 20, 2024 (circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113), is the consolidated cybersecurity framework for SEBI-regulated entities. For vulnerability assessment and penetration testing (VAPT), it expects regulated entities to plan VAPT at the start of each financial year, test a defined scope of critical systems, use CERT-In empanelled auditors where the framework requires it, and report results and closure of findings through their exchange or depository on category-specific timelines. This guide summarizes what that means in practice and how to prepare.

Executive Summary

Earlier SEBI guidance on VAPT was issued in separate circulars for stock brokers, depository participants, and mutual funds and asset management companies. The CSCRF brings SEBI's cybersecurity expectations into a single framework with requirements that vary by the category of regulated entity. This guide explains what the CSCRF is, who it applies to, what it expects of VAPT — planning, scope, who performs it, reporting, and closure — and how to prepare. Compliance dates under the CSCRF were phased and extended by later circulars and differ by entity category, so the dates that apply to your organization should always be confirmed against SEBI's current circulars and your exchange's or depository's notices.

What is the SEBI CSCRF? {#what-is-cscrf}

The Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities is a framework issued by the Securities and Exchange Board of India on August 20, 2024. It sets cybersecurity and cyber resilience expectations for entities that SEBI regulates, and it was followed by several clarifications and extensions from SEBI during 2024 and 2025. It builds on SEBI's earlier cybersecurity circulars, including the 2022 circulars that introduced annual VAPT expectations for stock brokers, depository participants, and mutual funds and asset management companies, and consolidates SEBI's cybersecurity requirements into one framework.

Who it applies to {#who}

The CSCRF applies to SEBI-regulated entities. In practice, requirements are tiered by the type and size of the entity — for example, market infrastructure institutions, qualified stock brokers and other larger entities, mid-size and small-size entities, and entities in a self-certification category. Which tier an entity falls into determines its compliance expectations and timelines. Stock brokers and depository participants receive their notices through their stock exchange or depository, and mutual funds and AMCs through SEBI and their industry body.

What the CSCRF expects of VAPT {#vapt-expectations}

Based on SEBI's framework and the circulars that stock exchanges and depositories have issued to implement it, VAPT expectations include:

• Planning at the start of each financial year. Entities are expected to plan their VAPT activity at the beginning of the financial year and not to leave an audit cycle unaudited because of a change in their categorization.
• A defined scope. The framework describes a comprehensive scope covering critical assets and infrastructure, including networking systems, security devices, servers, databases, applications, and both internet-facing and internal systems.
• Testing by a CERT-In empanelled auditor for the entity categories where the framework requires it. Exchange and depository circulars specify when VAPT must be conducted by a CERT-In empanelled auditor.
• Reporting. The VAPT report is submitted through the stock exchange or depository after approval by the entity's IT committee or governing body.
• Closure of findings. Entities must fix identified vulnerabilities and then submit evidence of closure — typically a revalidation or action-taken report from the auditor showing which findings are resolved.
• Testing before go-live. Systems should undergo vulnerability scanning and penetration testing before they are put into production, not only during the annual cycle.

The VAPT cycle in practice {#cycle}

For most regulated entities, the framework turns VAPT into a recurring annual cycle:

1. Inventory and classify assets — an up-to-date list of hardware, software, network resources, and data flows, with critical assets identified.
2. Plan and scope — decide the systems in scope at the start of the financial year and appoint an auditor.
3. Test — vulnerability assessment and penetration testing of the in-scope systems.
4. Report and approve — review the findings internally and submit the report through the exchange or depository.
5. Remediate — fix vulnerabilities, prioritizing critical findings.
6. Revalidate and submit closure — have the auditor confirm that findings are closed and submit that evidence by the applicable deadline.

Why dates differ by category {#dates}

SEBI phased the CSCRF's compliance dates and extended them through later circulars, and exchanges and depositories have issued their own notices with specific dates for VAPT conduct, report submission, and closure submission for different entity categories. Those dates have been revised more than once, and some sources differ. Treat any date you read in a summary — including this one — as a prompt to check the current SEBI circular and your exchange or depository's latest notice for your specific category.

Incident reporting alongside VAPT {#incident-reporting}

VAPT is one part of cyber resilience; incident reporting is another. Separately from SEBI, CERT-In's April 2022 directions require covered entities to report specified cyber incidents to CERT-In within six hours of noticing them. SEBI-regulated entities should confirm the incident-reporting timelines and recipients set out in the CSCRF for their category and align internal procedures with both.

How to prepare {#prepare}

• Know your category under the CSCRF and the dates your exchange or depository has published for it.
• Maintain a current asset inventory with critical systems identified — scope definition depends on it.
• Book an empanelled auditor early. Annual deadlines compress quickly, and retesting needs time after remediation.
• Build remediation capacity so critical findings can be fixed and revalidated within the closure window.
• Get IT committee or board approval into the schedule — reports are submitted after approval.
• Keep evidence organized — reports, approvals, remediation records, and closure confirmations — so they can be produced on request.

How Threat ResQ fits {#threat-resq-fit}

Threat ResQ's VAPT service covers vulnerability assessment and penetration testing, with retest included on all critical findings. VAPT-as-a-Service is delivered in collaboration with a CERT-In empanelled security firm; the CERT-In empanelment belongs to that partner, not to Threat ResQ itself. Threat ResQ's Compliance Consulting service supports regulatory readiness, and getTRAC, its compliance automation platform, automates evidence collection, control mapping, and audit readiness across 20+ global and regional frameworks, including SEBI, RBI-CSF, and CERT-In for India.

For a plain-language explanation of the two testing methods behind VAPT, see VAPT vs Penetration Testing. For the wider regulatory picture for banks and financial institutions, see Banking Compliance Guide.

This guide is general information, not legal advice. Confirm your obligations against the current SEBI circulars.

FAQ {#faq}

What is the SEBI CSCRF? The Cybersecurity and Cyber Resilience Framework is SEBI's framework of cybersecurity and cyber resilience requirements for SEBI-regulated entities, issued on August 20, 2024 and clarified and extended by later circulars.

How often must SEBI-regulated entities do VAPT? The framework expects VAPT planned and carried out as a recurring cycle each financial year, with the schedule and frequency depending on the entity's category. Check the exchange or depository circular for your category for the current cycle and deadlines.

Does VAPT have to be done by a CERT-In empanelled auditor? For the entity categories where the framework and exchange or depository circulars require it, yes. Confirm which category your organization falls into and what your exchange or depository requires.

What happens after a VAPT report is submitted? Identified vulnerabilities must be fixed, and the entity submits evidence of closure, typically a revalidation or action-taken report confirming which findings are resolved, by the applicable deadline.

Does Threat ResQ hold CERT-In empanelment? No. Threat ResQ's VAPT-as-a-Service is delivered in collaboration with a CERT-In empanelled security firm; the empanelment belongs to that partner.