Checklists 🇮🇳 Indian Mandate Aligned 9 min read

SEBI CSCRF (Cybersecurity & Cyber Resilience Framework) Compliance Audit Checklist

Comprehensive compliance audit checklist for Stock Brokers, Depository Participants, Mutual Funds, and Market Infrastructure Institutions (MIIs) under SEBI's Cybersecurity and Cyber Resilience Framework. Mapped to the 5 CSCRF goals: Anticipate, Withstand, Contain, Recover, and Evolve.

By BlueCiphr Capital Markets Advisory • Lead CEH & PenTest+ Auditors

📥 Download Offline Artifact: Audit-Ready Formats

[Goal 1: Anticipate] Identify critical business assets, algorithmic trading engines, and user data repositories.

Mandate: SEBI Asset Inventory

[Goal 1: Anticipate] Conduct continuous vulnerability assessments and quarterly external VAPT on trading terminals.

Mandate: Trading Terminal Pentest

[Goal 2: Withstand] Enforce multi-factor authentication (MFA) and biometric controls for all client trading logins.

Mandate: MFA Mandate

[Goal 2: Withstand] Implement anti-DDoS mitigation capable of absorbing multi-gigabit attacks on order routing gateways.

Mandate: Anti-DDoS Order Book

[Goal 3: Contain] Operate a 24/7 SOC with automated SOAR playbooks to quarantine compromised broker terminals.

Mandate: SEBI 24/7 SOC

[Goal 3: Contain] Segment trading algorithms, market data feeds, and back-office accounting into isolated VLANs.

Mandate: Network Segmentation

[Goal 4: Recover] Validate Recovery Time Objective (RTO < 4 hours) and Recovery Point Objective (RPO < 15 minutes).

Mandate: RTO/RPO SLA

[Goal 4: Recover] Conduct bi-annual unannounced live Disaster Recovery (DR) switchover drills.

Mandate: Live DR Drills

[Goal 5: Evolve] Incorporate root-cause forensic learnings into security baseline policies after every incident.

Mandate: Post-Incident Audit

[Goal 5: Evolve] Submit certified compliance reports to NSE/BSE and SEBI within mandated filing deadlines.

Mandate: Exchange Submission

🇮🇳 SEBI CSCRF 2024: Capital Markets Resilience Framework

SEBI's CSCRF framework establishes five mandatory cybersecurity goals: Anticipate, Withstand, Contain, Recover, and Evolve. Stock brokers and mutual funds must ensure complete operational independence and failover capabilities.

### SEBI CSCRF: Capital Markets Cybersecurity Standard The Securities and Exchange Board of India has unified cybersecurity circulars into the CSCRF. - Goal 1: Anticipate (Threat modeling, vulnerability management) - Goal 2: Withstand (Hardened trading APIs, DDoS defense) - Goal 3: Contain (24/7 SOC monitoring, sub-15 minute isolation) - Goal 4: Recover (RTO < 4 hours, RPO < 15 minutes) - Goal 5: Evolve (Purple teaming and regulatory filing)

🛡️ AUDIT DEFENSE & TECHNICAL VERIFICATION

Request Audit Scoping & Consultation → ⚡ Quick Response SLA • Board-Ready Evidence

SEBI CSCRF (Cybersecurity & Cyber Resilience Framework) Compliance Audit Checklist

Interactive Technical Checklist (10 Verification Checkpoints)

Need Accredited Auditors to Execute This Audit or Gap Assessment?