SEBI’s cyber framework, as amended — requirement by requirement.

For every regulated entity other than MIIs, KRAs and QRTAs, the last extension set 31 August 2025. MIIs and QRTAs were due on 1 January 2025, with regulatory forbearance to 31 March 2025, and KRAs on 1 April 2025. So CSCRF is fully in force: cyber audits for FY 2025-26 onwards are conducted under it, and VAPT for the current year should have started in its first quarter. We found no newer extension on SEBI’s website as of November 2026.

Use the thresholds for your RE type, applied to the previous financial year’s figures — clients and trading volume for brokers, AUM for portfolio managers and mutual funds, corpus for AIF managers, folios for RTAs. The category holds for the whole financial year. If you hold several registrations, the highest category applies. Write it down with the figures and have it approved; auditors now verify it. Thresholds were revised in April and August 2025, so re-check any older assessment.

For MIIs, yes. For Qualified REs it was mandatory in the original circular, but SEBI’s technical clarifications of 28 August 2025 made it “encouraged and recommended (not mandatory)”. Where it applies, the scope includes the primary and DR sites, near-DR, SOC and colocation, and outsourced providers of those must be certified too. Certification comes from an accredited certification body — never from a consultancy, including us. Our ISO 27001 page covers readiness.

Twice a year for MIIs, Qualified REs, and Mid-size or Small-size REs that offer internet or algorithmic trading; once a year for other audited REs. Self-certification REs do VAPT only and file a signed self-certification. The audit covers all critical systems plus a 25% sample of the rest, is done by a CERT-In-empanelled auditor after the period ends, and is reported within a month. Observations close within three months, with a follow-on audit within five.

A SEBI index of cyber resilience calculated from 23 weighted parameters, with ratings from “Exceptional” (91–100) down to “Fail” (50 and below). It applies to MIIs, which need a third-party assessment every half-year, and Qualified REs, which self-assess annually; evidence goes in within 15 days. For REs with another primary regulator, an equivalent control under that regulator can count (August 2025).

Small-size and Self-certification REs are mandated to onboard to the Market-SOC run by NSE and BSE. SEBI’s FAQ lets those with their own or a group SOC use it instead, provided they file SOC efficacy reports. DPs and RTAs with fewer than 100 clients are exempt from SOC services altogether, and self-certification portfolio and AIF managers with fewer than 100 clients from mandatory Market-SOC.

No. CSCRF’s auditor selection norms bar an auditor that has done any consulting for the RE in the previous two years, and limit one auditor to three consecutive years before a two-year break. Audits must come from a CERT-In-empanelled firm. SemperWise is not CERT-In empanelled, so we would never be your auditor anyway: we do readiness, testing and fix verification, and you appoint the auditor directly.

Not part-time. SEBI’s FAQ allows a remote CISO only if that person is dedicated to one organisation, and says REs are “restricted to onboard part-time CISO”. A group-level CISO may serve several entities in the same group. An outside adviser can support your CISO — our managed security service does that — but cannot be the CISO SEBI expects you to name.