Jul 29, 2025Clarifications and FAQs regarding Cybersecurity and Cyber Resilience Framework
i. SEBI, on April 30, 2025, issued a Circular clarifying aspects of Cyber Security and Cyber Resilience Framework (‘CSCRF’) for SEBI regulated entities (‘REs’). Key highlights are as follows:
(a) the category of REs will be decided at the beginning of the financial year (‘FY’), based on data of the previous FY. Once the category is decided, the RE will remain in the same category throughout the FY, irrespective of any changes in parameters during the FY.
(b) categorisation for compliance with CSCRF will be undertaken at the investment manager level, instead of the AIF. The criteria and thresholds are reproduced below:
| Criteria | Qualified REs | Mid-size REs | Small-size REs | Self-certification REs |
| Sum of corpus of all AIFs and venture capital funds (including their schemes) managed by the investment manager | Not applicable. | INR 10,000 crores (approx. USD 1 billion) and above | More than INR 3,000 crores (approx. USD 350 million) and less than INR 10,000 crores (approx. USD 1 billion) | INR 3,000 crores (approx. USD 350 million) and below |
(c) investment managers that are classified as self-certification REs and have a client base comprising fewer than 100 clients will be exempt from the mandatory requirement to implement the Market Security Operations Centre framework.
ii. SEBI released frequently asked questions (‘FAQs’) on CSCRF and Framework for Adoption of Cloud Services by REs, on June 11, 2025, with a host of clarifications on the scope of the obligations under the CSCRF for REs.
iii. SEBI issued a Circular on June 30, 2025, extending the compliance timelines for CSCRF by two months, i.e., till August 31, 2025.