SEBI CSCRF checklist: cyber awareness and phishing drill requirements for REs
What SEBI's CSCRF asks of regulated entities on employee awareness, training and phishing tests, clause by clause, with an evidence checklist for your audit.
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) replaced the separate cybersecurity circulars for its regulated entities (REs) with one graded framework. This checklist covers only the employee awareness, training and phishing-test parts, quoted from the circular of 20 August 2024. For the wider framework, see our SEBI CSCRF compliance page.
Who is in scope
CSCRF puts REs into five categories, based on thresholds such as number of clients, trade volume and assets under management:
- Market Infrastructure Institutions (MIIs)
- Qualified REs
- Mid-size REs
- Small-size REs
- Self-certification REs
Many requirements are graded by category, so start by confirming yours. The circular set a glide path of 1 January 2025 for the six RE categories that already had a cybersecurity circular, and 1 April 2025 for REs getting one for the first time. SEBI has issued later circulars on CSCRF, so check sebi.gov.in for the current position before relying on any date.
The awareness clauses, quoted
PR.AT standards (all REs)
Standard 1 says: "Mandatory programs for building awareness of cybersecurity, cyber resilience, and system hygiene among employees shall be established. Such programs shall be conducted on a periodic basis, and shall be updated as per emergence of new threats, state-of-the-art technologies and industry trends."
Standard 4 adds a dedicated programme for Board members.
PR.AT guidelines (all REs, mandatory)
- Awareness programmes, with a focus on non-technical employees.
- Employees should be "aware of potential risks including social engineering attacks, phishing, etc."
- "Thoughtfully designed security awareness campaigns that stress the avoidance of clicking on links and attachments in email", with CERT-In and CSIRT-Fin advisories as a reference.
- Periodic training that incorporates up-to-date threats, extended to outsourced staff where possible.
- Programmes reviewed and updated.
GV.RM guideline 1(e) (all REs except small-size and self-certification)
"REs shall periodically assess level of employee cybersecurity awareness, for e.g., through phishing test success rate, etc."
Cyber Capability Index (MIIs and Qualified REs)
The CCI (Annexure-K) is computed only by MIIs (third-party assessment, half-yearly) and Qualified REs (self-assessment, yearly). Parameter 3, "Security Training Measure [PR.AT.S1]", measures the percentage of information system security personnel trained in the past year, with a target of 100% and a weightage of 5%. The evidence named is the details of training sessions from the past year and the cyber audit observation.
Incident classification
Annexure-O lists "instances of phishing emails that were not recognized by employees and were clicked by them" as a Medium-severity example. A phishing programme should therefore also feed how you report real clicks.
Evidence checklist
| Requirement | What to keep | Where SecurityRing helps |
|---|---|---|
| PR.AT standard 1: periodic, updated programme | Programme calendar; proof that content changes with new threats | Campaigns recommended from current advisories (including CERT-In) and Regulatory updates, each dated |
| PR.AT guideline: phishing and social engineering awareness | Simulations covering email links and attachments | Link-click, attachment, credential, QR-code and ClickFix simulations in email |
| PR.AT guideline: non-technical staff, outsourced staff where possible | Target lists by department | Target employees imported from CSV or XLSX; department and location cuts |
| GV.RM 1(e): periodic awareness assessment | Phishing test results over time | Campaign funnel and the executive trend report with the phishing exposure score |
| PR.AT standard 4: Board programme | Board session records | Executive risk concentration view for board reporting (sessions themselves are yours) |
| CCI parameter 3 (MIIs and Qualified REs) | Training session details for the past year | Per-person lesson completion and CSV export |
How to run it in SecurityRing
- Set your Org Profile: industry, country and regulatory regimes (SEBI), plus your Tech Stack.
- Pick a recommendation ("Build this idea"), for example a lure dressed as an exchange or depository notice, or draft one in the AI Builder and approve each tab.
- Send yourself a test, allowlist the sender domain with IT, and set a campaign window of 1 day to 8 weeks.
- Anyone who clicks gets a lesson on that exact email, in under two minutes.
- Download PPT or PDF for your cyber audit and keep the CSV for your records.
SecurityRing gives you evidence; it does not make you CSCRF compliant, and your auditor decides how much weight it carries.
Sources
- Securities and Exchange Board of India, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs), circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024. Accessed 15 October 2026.