The Securities and Exchange Board of India (SEBI) has established a comprehensive Cybersecurity and Cyber Resilience Framework (CSCRF) to enhance the cybersecurity posture of all regulated entities (REs), including Research Analysts (RAs). This framework consolidates and supersedes prior circulars on cybersecurity, providing a structured and forward-looking approach to managing cyber risks. This article provides a comprehensive technical analysis of the CSCRF as it applies to RAs.
Regulatory Basis
Primary Circular: SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113
SEBI issued the primary circular on CSCRF on August 20, 2024, introducing a new framework aimed at strengthening cybersecurity for all regulated entities in the Indian securities market. The framework is based on five cyber resiliency goals: Anticipate, Withstand, Contain, Recover, and Evolve.
Clarifications and Updates
SEBI has issued subsequent clarifications to address queries from regulated entities:
- Circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/184 dated December 31, 2024: Clarifications on CSCRF
- Circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/119 dated August 28, 2025: Technical clarifications
- Circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/60 dated April 30, 2025: Further clarifications
Applicability to Research Analysts
General Rule
Research Analysts (RAs) not registered with SEBI in any other capacity are exempted from the CSCRF framework.
Exception
With respect to RAs registered with SEBI in any other capacity (e.g., stock broker, investment adviser, portfolio manager), those RAs shall follow the highest among the other category in which they are registered with SEBI apart from RA.
Implications
| RA Type | CSCRF Applicability |
|---|---|
| RA only (no other registration) | Exempted |
| RA + Stock Broker | Follow CSCRF as Stock Broker |
| RA + Investment Adviser | Follow CSCRF as Investment Adviser |
| RA + Portfolio Manager | Follow CSCRF as Portfolio Manager |
CSCRF Structure
The CSCRF sets out objectives, standards, and guidelines. Objectives are goals which a security control needs to achieve. The framework categorizes REs based on their size, scale, span of operations, and certain thresholds like number of clients.
Five Cyber Resiliency Goals
| Goal | Description |
|---|---|
| Anticipate | Proactively identify and assess cyber risks |
| Withstand | Build resilience to withstand cyber attacks |
| Contain | Limit the impact of a cyber incident |
| Recover | Restore operations after an incident |
| Evolve | Continuously improve cybersecurity posture |
CSCRF Policy and Cyber Risk Management Framework
All REs are required to put in place a comprehensive cybersecurity and cyber resilience policy. The policy must address:
- Governance and oversight
- Risk assessment and management
- Incident response and recovery
- Business continuity
- Third-party risk management
- Compliance and audit
Core Obligations
1. Governance
REs must continuously allocate and communicate clear roles and responsibilities related to cybersecurity risk management. The Chief Information Security Officer (CISO) must report directly to the MD/CEO.
2. Vulnerability Assessment and Penetration Testing (VAPT)
REs must conduct regular VAPT to identify and remediate vulnerabilities. Any gaps/vulnerabilities detected must be remedied on an immediate basis.
3. Business Continuity Planning and Disaster Recovery
REs must have robust business continuity plans (BCP) and disaster recovery (DR) capabilities.
4. Incident Response
REs must have incident response procedures to detect, respond to, and recover from cyber incidents.
5. Third-Party Risk Management
REs must manage risks associated with third-party vendors and service providers.
6. Compliance and Audit
REs must demonstrate compliance with the CSCRF through regular audits and reporting.
Regulatory Forbearance
SEBI provided regulatory forbearance until March 31, 2025, allowing REs to demonstrate progress towards CSCRF compliance without facing immediate regulatory actions.
Common Compliance Gaps
1. Assuming Exemption Applies
Some RAs incorrectly assume they are exempt from CSCRF.
Solution: Determine if you are registered in any other capacity. If yes, follow the highest standard.
2. No CSCRF Policy
Some RAs do not have a comprehensive cybersecurity policy.
Solution: Develop and implement a CSCRF-compliant cybersecurity policy.
3. No VAPT
Some RAs do not conduct regular VAPT.
Solution: Conduct regular VAPT and remediate findings.
4. No BCP/DR
Some RAs do not have business continuity and disaster recovery plans.
Solution: Develop and test BCP/DR plans.
Conclusion and How Anuj Desai & Associates Can Help
The CSCRF represents a significant step forward in cybersecurity regulation. RAs must understand their obligations and ensure compliance.
Anuj Desai & Associates offers specialized services to help RAs comply with the CSCRF:
- Assessment of CSCRF applicability
- Development of cybersecurity policies
- VAPT implementation and remediation
- BCP/DR planning and testing
- Compliance audit and advisory
Contact us today to ensure your cybersecurity practices comply with SEBI requirements. Our team will guide you through the process.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers are advised to consult qualified professionals for legal and compliance matters. Anuj Desai & Associates is a SEBI compliance consulting firm based in India.