Cybersecurity Obligations for Investment Advisers — The CSCRF Framework Explained
An Investment Adviser holds exactly the kind of information a cyberattack is built to exploit — client financial data, KYC records, portfolio details, and increasingly, AI-processed advisory outputs. SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) is the regulator's consolidated answer to how seriously it now expects that exposure to be managed, across every category of regulated entity, IAs included.
Why SEBI Consolidated Its Cybersecurity Guidance Into One Framework
Since 2015, SEBI had issued cybersecurity guidance to regulated entities in a piecemeal fashion — separate circulars for different intermediary categories, updated periodically as threats evolved. The CSCRF was built to bring this into a single, consistent framework applicable across SEBI's regulated entities, reducing the inconsistency of having different cybersecurity expectations depending on which category of intermediary a firm happened to be, and making compliance genuinely auditable rather than a matter of interpreting scattered older circulars.
What the Framework Actually Covers
The CSCRF addresses cyber risk, threat management, and incident resilience together, rather than treating prevention and response as separate concerns — reflecting a broader shift in regulatory thinking toward assuming that incidents will occur and building an entity's ability to detect, contain, and recover from them, not merely trying to prevent every possible breach. Notably, the framework has also been built with forward-looking considerations in mind, including "harvest now, decrypt later" risks associated with future quantum computing capability — an unusually forward-leaning element for a domestic regulatory framework to explicitly address.
Why This Matters Specifically Where an IA Uses AI or Third-Party SaaS Tools
CSCRF compliance is explicitly referenced as a precondition in other emerging SEBI frameworks — for instance, entities seeking recognition as a PaRRVA verification agency (covered in our companion article) must demonstrate CSCRF compliance before recognition is granted. This signals a broader pattern: wherever technology sits inside a regulated entity's operations — AI tools, third-party SaaS platforms, data processing vendors — CSCRF compliance is increasingly the baseline SEBI expects to see demonstrated, not merely assumed.
The Audit and Certification Layer
The CSCRF framework isn't a self-assessment exercise left to an IA's own judgement — it requires systems and process audits by auditors empanelled with a recognised stock exchange, with formal certification confirming that an entity's systems and processes are adequate and appropriate for its specific activities. This audit requirement means CSCRF compliance needs to be demonstrable and documented, not simply asserted in an internal policy document that's never actually been independently tested.
Ongoing Clarifications — Why This Framework Keeps Being Refined
SEBI has issued multiple rounds of technical clarifications to the CSCRF since its introduction, reflecting both industry feedback on implementation practicalities and the regulator's own evolving understanding of emerging threats. Firms treating CSCRF compliance as a one-time project rather than an ongoing obligation risk falling behind these clarifications, particularly around technical implementation details that get refined after the framework's initial rollout.
What This Looks Like for a Smaller IA Practice, Not Just Large Institutions
A common misconception is that a framework this comprehensive is really aimed at large brokerages and exchanges, with smaller IA practices facing a lighter, informal expectation in practice. SEBI's regulated-entity-wide approach doesn't support that assumption — a smaller practice handling client financial data carries the same underlying data-security risk, proportionate to its scale, and should not assume CSCRF-aligned practices are optional simply because its operation is smaller than an exchange or a large brokerage.
Where This Intersects With Data Localisation and SaaS Advisories
Our companion article on SaaS-based compliance tools covers the specific data localisation expectations SEBI has flagged for financial sector organisations using SaaS platforms — a closely related but distinct compliance thread that IAs using any third-party cloud-based tool (including AI tools, covered in our companion article on AI disclosure) need to review alongside their CSCRF obligations, not instead of them.
Building a CSCRF-Aligned Posture Without an In-House Security Team
Most IA practices don't have a dedicated in-house cybersecurity function, and CSCRF compliance doesn't require building one from scratch — it requires a documented policy, appropriate technical controls matched to the firm's actual scale and risk profile, and the independent audit and certification the framework calls for, which can be achieved through the right external partners without an internal security department.
How We Help
We help Investment Advisers and other SEBI-regulated entities assess their current cybersecurity posture against CSCRF expectations, build the policy documentation the framework requires, and coordinate the independent audit and certification process — proportionate to the size and risk profile of your specific practice, not a one-size-fits-all template built for a large institution. If your firm hasn't reviewed its cybersecurity compliance against CSCRF specifically, our SEBI Intermediary Compliance practice can help you close that gap.
This article is for general informational purposes and reflects the regulatory position as understood at the time of writing. It does not constitute regulatory or technical advice specific to any IA's circumstances — please consult our team and verify the current CSCRF requirements directly with SEBI before relying on this for compliance planning.