On this page
Need a CSCRF VAPT report? We run the full engagement and route the formal report through our CERT-In empanelled partner, so you deal with one team from scoping to revalidation.
CSCRF changed SEBI cybersecurity from a set of separate circulars into one framework that scales with the size of the entity. For most stock brokers, depository participants, mutual funds, portfolio managers and RTAs, the part that creates real work every year is the same: a VAPT that a CERT-In empanelled auditor runs, a closure report, and deadlines set by the exchange or depository.
CSCRF in brief
- Issued by
- Securities and Exchange Board of India (SEBI)
- Circular
- SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024
- Applies to
- SEBI regulated entities, from stock exchanges and depositories to brokers, DPs, mutual funds, PMS, RTAs and KRAs
- Structure
- Five categories, with requirements that scale by category
- VAPT auditor
- CERT-In empanelled information security auditing organisation
- Clarifications
- SEBI FAQs on CSCRF and cloud adoption released 11 June 2025
SEBI started with 1 January 2025 for MIIs, KRAs and qualified RTAs. For most other regulated entities the deadline was extended twice and finally landed on 31 August 2025. CSCRF is now an ongoing annual cycle, not a one-time project.
Which category are you in?
| Category | Who typically falls here | What it means for VAPT |
|---|---|---|
| MIIs | Stock exchanges, clearing corporations, depositories | Half-yearly VAPT, the most extensive controls, plus additional testing such as red teaming |
| Qualified REs | Larger intermediaries, including Qualified Stock Brokers and some KRAs and RTAs | Near-full controls; Qualified Stock Brokers test half-yearly |
| Mid-size REs | Mid-tier brokers, AMCs and similar entities | Substantial controls and at least annual VAPT |
| Small-size REs | Smaller intermediaries | Lighter controls and periodic VAPT |
| Self-certification REs | The smallest entities | Baseline controls with self-certification |
Thresholds differ by entity type. Client-based brokers are categorised on trading volumes and client numbers; proprietary brokers on their collateral or assets with clearing corporations. The category is fixed at the start of each financial year using the previous year’s data. If you hold several SEBI registrations, the highest category applies.
How often you need VAPT
- MIIs and Qualified Stock Brokers: a half-yearly VAPT cycle.
- Most other regulated entities: VAPT at least once a year.
- Everyone: after a major change to critical systems, such as a new trading platform, a new mobile app, a data centre move or a cloud migration.
Your exchange or depository sets the practical deadlines. For example, NSDL’s implementation for depository participants asks non-QSB DPs to complete VAPT by 30 June, submit the report after IT Committee approval by 31 July and submit the revalidation report by 30 November, starting with the financial year ending 31 March 2026. QSB DPs run two cycles: the half ending 31 March (report by 30 June, revalidation by 30 September) and the half ending 30 September (report by 31 December, revalidation by 31 March).
Check your own MII's circular
Exchanges and depositories publish their own CSCRF implementation circulars with submission formats and dates. Read the latest one for each MII you report to, because they are updated and can differ by entity type.
What the VAPT must cover
A CSCRF VAPT is not a scan of your website. Scope typically includes:
- Network infrastructure reachable over the internet, WAN or LAN: firewalls, routers, servers and VPN gateways
- Internet-facing web applications and trading or back-office portals
- Mobile trading and investor apps on Android and iOS
- APIs used by apps, partners and algorithmic trading platforms
- Systems on public IP addresses and cloud-hosted environments
- Databases and endpoints that store or process regulated data
- Application security testing (SAST or DAST) of in-house and off-the-shelf applications, which SEBI’s FAQs say must also be done by CERT-In empanelled auditors
Test the critical systems first. CSCRF puts heavy weight on identifying critical systems correctly, so your asset inventory and VAPT scope should match.
Closure, revalidation and patching deadlines
- Three months to close. Vulnerabilities found in VAPT should be closed within three months of the report.
- IT Committee for anything open. Items still open after three months need approval from the entity’s IT Committee, with a justification, and must be closed before the next VAPT starts.
- One week for high-severity missing patches. SEBI’s FAQs expect high-severity vulnerabilities caused by unapplied patches to be fixed within a week, after testing the patch outside production.
- Revalidation through an empanelled auditor. The fixes are retested and an action-taken or revalidation report is submitted. Depositories have asked for this to go through a CERT-In empanelled auditor too, along with a signed declaration of empanelment and no conflict of interest.
Choosing a CSCRF VAPT provider
- Empanelment. Confirm the organisation issuing the report is on CERT-In’s current list, and that the name on the report matches it. Our guide to CERT-In empanelled auditors explains what to check.
- Manual depth. Trading platforms and back-office systems have business-logic flaws that scanners miss: order manipulation, access to other clients’ holdings, broken session handling.
- Revalidation included. The closure report is part of the requirement, so price and schedule it upfront.
- Formats. The provider should know your MII’s submission format and help with the IT Committee summary.
If you are comparing firms, see our list of VAPT companies in India and our VAPT cost guide.
How Summit delivers CSCRF VAPT
Summit is based in New Delhi and runs manual, expert-led VAPT for SEBI regulated entities. We scope from your critical-systems inventory, test your web applications, mobile trading apps, APIs and networks, help your team fix what we find and run the revalidation. The formal CSCRF report is routed through our CERT-In empanelled partner, so you get the report your exchange or depository expects without managing a second vendor. Our SEBI CSCRF and RBI compliance page covers the wider framework.
Book your next CSCRF cycle early
Tell us your category, your MII deadlines and your systems. We will plan the VAPT, the fixes and the revalidation so you submit on time. Get a quote.
Related reading: RBI VAPT requirements for banks and NBFCs · CERT-In empanelled auditors and VAPT · DPDP Rules 2025 deadlines
Frequently asked questions
What is SEBI CSCRF?
The Cybersecurity and Cyber Resilience Framework for SEBI Regulated Entities, issued by circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 on 20 August 2024. It replaced SEBI's earlier, separate cybersecurity circulars with one framework that scales requirements by the size and type of the regulated entity.
How often is VAPT required under SEBI CSCRF?
It depends on the category. Market infrastructure institutions and Qualified Stock Brokers follow a half-yearly VAPT cycle, while most other regulated entities run VAPT at least once a year. Testing is also expected after major changes to critical systems.
Does the VAPT auditor have to be CERT-In empanelled?
Yes. VAPT under CSCRF has to be carried out by a CERT-In empanelled information security auditing organisation, and depositories have asked for the revalidation of fixes to be done through a CERT-In empanelled auditor as well.
How quickly must CSCRF VAPT findings be fixed?
Vulnerabilities should be closed within three months of the VAPT report. Anything still open after that needs approval from the entity's IT Committee with a justification, and must be closed before the next VAPT cycle. SEBI's FAQs expect high-severity issues caused by missing patches to be fixed within a week.
Which category is my entity in?
CSCRF has five categories: MIIs, Qualified REs, Mid-size REs, Small-size REs and Self-certification REs. The category is fixed at the start of each financial year based on the previous year's data, such as client numbers, trading volume or assets. Entities with several SEBI registrations follow the requirements of their highest category.
Can Summit deliver a CSCRF VAPT report?
Yes. Summit runs the full engagement, from scoping and manual testing to the revalidation, and routes the formal report through our CERT-In empanelled partner, so you deal with one team.
