Glossary
What is SEBI CSCRF? The Cybersecurity and Cyber Resilience Framework
SEBI's Cybersecurity and Cyber Resilience Framework for its regulated entities, issued by circular on 20 August 2024. It sets awareness and training standards under PR.AT and asks entities to assess employee awareness periodically.
Who it covers
The CSCRF puts SEBI regulated entities (REs) into five categories: Market Infrastructure Institutions (MIIs), Qualified REs, Mid-size REs, Small-size REs and Self-certification REs. Many requirements are graded by category.
What it says about employee awareness
- PR.AT standard 1: mandatory programmes for building awareness of cybersecurity, cyber resilience and system hygiene among employees, run periodically and updated as new threats emerge.
- PR.AT guidelines: make employees aware of risks including social engineering and phishing; run awareness campaigns that stress not clicking links and attachments in email (CERT-In and CSIRT-Fin advisories may be referred to); and run periodic training on up-to-date threats.
- GV.RM guideline 1(e): for all REs except Small-size and Self-certification REs, "REs shall periodically assess level of employee cybersecurity awareness, for e.g., through phishing test success rate, etc."
For the full checklist, see the SEBI CSCRF compliance page.
Sources
- Securities and Exchange Board of India, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs), circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024. Accessed 15 October 2026.