# SEBI CSCRF Compliance

> The full Cybersecurity & Cyber Resilience Framework.

SEBI's CSCRF is a 5-tier framework spanning 22 entity types, mandating VAPT, cyber audit, red teaming, threat hunting, M-SOC, ISO 27001, a CISO, incident reporting and the NIST CSF 2.0 control catalogue. We run gap analysis to full readiness across the entire framework.

## Outcomes

- CSCRF tier determination and gap analysis
- VAPT, cyber audit and red-team coverage
- M-SOC, CISO and governance setup support
- NIST CSF 2.0 control implementation

## Process

01. **Classify** - Determine your CSCRF tier and obligations.
02. **Assess** - Gap analysis across the full control catalogue.
03. **Remediate** - Close gaps - technical, governance and SOC.
04. **Audit** - Cyber audit and evidence for SEBI.

## Deliverables

- CSCRF gap analysis
- Remediation roadmap
- Cyber audit report
- Evidence pack

## Standards

SEBI CSCRF, NIST CSF 2.0, ISO 27001, CERT-In


## Overview

SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) is one of the most demanding regulatory regimes in India - a 5-tier model across 22 entity types, pulling in VAPT, cyber audit, red teaming, threat hunting, a Market-SOC, ISO 27001, a named CISO and the full NIST CSF 2.0 control catalogue.

We take you from tier classification through gap analysis, technical remediation, M-SOC enablement and the cyber audit itself - assembling the evidence pack SEBI expects. One partner for the testing, the controls and the paperwork.


## What we cover

### Governance
CISO, IT committee, policies and the CSCRF control catalogue.

### VAPT & red team
Application, network and objective-based adversary simulation.

### Detection (M-SOC)
Market-SOC monitoring, threat hunting and incident reporting.

### NIST CSF 2.0
Identify, Protect, Detect, Respond, Recover + EV.ST controls.

### Resilience
Backup, recovery, BCP/DR and tabletop exercises.

### Evidence & audit
Cyber audit report and the documentation SEBI requires.


## FAQ

**Do you cover the M-SOC requirement?**
Yes - our managed SOC service can fulfill CSCRF's Market-SOC expectations alongside the audit.

**What about data localization?**
We advise on current status - SEBI's localization mandate has been in abeyance since December 2024 - and design for compliance when enforced.

---
Request this service: https://a5cyber.in/contact?topic=SEBI%20CSCRF%20Compliance · All services: https://a5cyber.in/services/