SEBI Cybersecurity Framework: What Broking and Wealth Apps Need

CSCRF applies to SEBI-regulated entities including stock brokers, depository participants, mutual funds and asset managers, portfolio managers, investment advisers, research analysts, registrars and market infrastructure institutions. Obligations scale with size. Entities are placed in categories by criteria such as client numbers, trading volume or assets under management, and SEBI has revised these thresholds through later clarifications, so confirm your category against the current circular.

CSCRF is organised around five cyber resilience goals, Anticipate, Withstand, Contain, Recover and Evolve, mapped to six functions: Governance, Identify, Protect, Detect, Respond and Recover. Each function has standards and guidelines, some mandatory for all and some only for larger categories.

Several requirements land directly on product and engineering teams.

Auditors will ask for the component list of your app. Generate it in the build, not in a spreadsheet.

Entities need an incident response plan, classification of incidents and reporting to SEBI within short timelines, in addition to CERT-In's reporting requirement. Recovery objectives must be defined and tested through drills. Compliance is checked through periodic cyber audits by CERT-In empanelled auditors, with reports submitted in the formats and timelines set for each category.

The framework expects regulated data to be classified and protected, and addresses where it is stored. SEBI's cloud framework for regulated entities also applies: the entity stays accountable, cloud providers should be empanelled by MeitY with data centres in India, and contracts must allow audit and exit. Treat data residency in India as the default for investor data.

Beyond CSCRF itself, trading and investment apps should plan for two-factor login, session controls, transaction alerts and accessibility requirements SEBI has set for regulated entities' digital platforms.