Skip to content
VITI Security
Contact

SEBI CSCRF 2024

SEBI CSCRF Readiness Scorecard

Score your readiness against SEBI’s Cybersecurity & Cyber Resilience Framework for brokers, AMCs and MIIs.

How this is calculated

  1. Each of the ten questions is one CSCRF control area; each Yes counts as one control in place. CSCRF itself is organised around five cyber-resilience goals (anticipate, withstand, contain, recover, evolve) mapped to cybersecurity functions from governance to recovery; the ten areas here are a cross-section of those, not the full standard.
  2. Readiness = controls in place divided by ten, rounded to a whole percentage. 80% or more is green, 50% to 79% amber, below 50% red.
  3. Every No becomes a gap note that names the CSCRF requirement behind it.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Weight per control area
Equal (10 percentage points each)
Colour thresholds
Green from 80%, amber from 50%

Worked example

The calculator run on its default inputs:

24×7 SOC monitoring (own or Market SOC)
No
VAPT on a defined schedule (and after major releases)
No
Incident reporting to SEBI and CERT-In within 6 hours
No
Data classification & protection policy
No
Access control with MFA (privileged & critical systems)
No
BCP/DR with defined RPO & RTO
No
Third-party / vendor risk management
No
Asset & software inventory (SBOM for critical apps)
No
Encryption at rest and in transit
No
Cyber audit by a CERT-In empanelled auditor
No

0/10 controls in place

0% ready

Controls in place
0 of 10
Gaps to close
10
Readiness
0%

All ten answers default to No, so the result is 0/10 controls in place (0% ready) with ten gaps listed. Each Yes adds 10 points; eight Yes answers reach the green band.

Sources

Sources last checked September 2026.

Limitations

CSCRF obligations differ by category (MIIs, Qualified, Mid-size, Small-size and Self-certification REs), with category-specific frequencies and formats that a flat ten-item score cannot show - for example, the SOC efficacy review is half-yearly for MIIs and Qualified REs and yearly for others. Confirm against the latest SEBI circulars and FAQs for your category. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.