SEBI CSCRF Readiness Checklist
Twenty practitioner-grade questions to test whether your stock broker, RIA, AMC, MII, or KRA is ready for a CSCRF cyber audit — or whether you will get a remediation list longer than your trading day.
20 questions · 5 minutes · Score band on completion
Answer Honestly. No One Is Watching.
Five sections, twenty yes/no questions. Click Yes only if you can produce the document or run the workflow today. Score reveals when you complete all twenty.
Categorisation & Governance
CSCRF starts with knowing your category. Then proving cyber is governed at the right level.
Asset, Identity & Access
CSCRF expects asset and identity hygiene at control-ID granularity, not high-level claims.
Detection, ATT&CK & SOC
The CSCRF-specific bar — MITRE ATT&CK-aligned detection and (for Q-RE/MII) 24x7 SOC.
Testing, SBOM & Vulnerability Management
Annual VAPT plus the CSCRF-specific additions: SBOM, threat-led testing, application security pre-prod.
Audit, Incident & Cloud
Cyber audit by qualified auditor + multi-regulator incident reporting + cloud localisation.
Your CSCRF readiness score
Three Bands. Three Plays.
Your first CSCRF audit will produce major findings. Spend the next 90 days on categorisation clarity, governance fixes, asset inventory, ATT&CK-aligned SIEM use-cases, and a CERT-In empanelled VAPT.
Foundations exist but you are missing CSCRF-specific elements (SBOM, ATT&CK heat-map, vendor flow-down). Close these in the next 60 days with a documented gap closure plan and audit-committee oversight.
Your first formal CSCRF audit will land cleanly. Move to threat-led testing maturity, sectoral intel integration, vendor concentration risk, and the next category-up controls (preparing for re-categorisation).
Common Questions
Which CSCRF category am I in?
CSCRF defines 5 categories: MII (exchanges/depositories/clearing), Qualified RE (Q-RE), Mid-Size RE, Small-Size RE, Self-Certification RE. Categorisation is based on size, complexity, and systemic importance — explicit thresholds are in the annexure for your sub-sector. SEBI re-categorises during inspection, so conservative interpretation wins.
Do I need a CISO?
Mandatory for MIIs and Q-REs. For Mid-RE, a designated senior officer with cyber accountability is typically required. Self-Certification REs (smallest RIAs) can have a founder/proprietor accountable. Read your category annexure for the specific requirement.
What is the SBOM requirement?
For material applications, you must maintain a Software Bill of Materials — a list of every component (libraries, packages, dependencies) with versions. Refreshed at each release. Vulnerabilities in the SBOM tree are tracked and remediated. SPDX or CycloneDX formats are standard.
How is CSCRF different from RBI Cyber Framework?
RBI is outcome-oriented and broad. CSCRF is control-ID prescriptive with explicit MITRE ATT&CK mapping. If you are also RBI-regulated (e.g. an entity that is both a SEBI-registered broker and an NBFC), you have a layered regime — both apply, and your audit programme must satisfy both.
What is the difference between this checklist and the buyer's guide?
The checklist diagnoses readiness in 5 minutes. The full SEBI CSCRF guide walks through every control family, the categorisation logic, MITRE alignment, audit qualifications, incident reporting matrix, and a 90-day roadmap.
Skip the Guesswork. Get a 90-Day Plan.
A 30-minute consultation. Walk away with a prioritised remediation list mapped to your CSCRF category annexure and the controls you must close before audit.
No sales pitch. Responds within 24 hours.