AWS Consulting ·
SEBI CSCRF and cloud framework on AWS: a control map and cyber-audit checklist for regulated entities
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) — circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 of 20 August 2024 — is the single cybersecurity framework for SEBI-regulated entities (REs), including stockbrokers, depository participants, mutual funds and market infrastructure institutions.
By Upvantix team
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) — circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 of 20 August 2024 — is the single cybersecurity framework for SEBI-regulated entities (REs), including stockbrokers, depository participants, mutual funds and market infrastructure institutions. SEBI has since issued clarifications (31 December 2024 and 28 August 2025), extended compliance dates (most REs had until 31 August 2025), and published FAQs (11 June 2025). Where an RE uses cloud, CSCRF points to SEBI's separate Framework for Adoption of Cloud Services (6 March 2023).
For AWS workloads, the requirements that become day-to-day controls are: logging with user-access logs kept for at least two years, six months of it online (PR.AA guidelines); continuous monitoring through a SOC — own, third-party or the exchanges' Market SOC (DE.CM); incident reporting to SEBI and CERT-In within six hours for incidents covered by the CERT-In Directions, with stockbrokers and DPs also reporting to their exchange or depository (RS.CO); a two-hour resumption objective and a 15-minute RPO for critical systems (RC.RP, as clarified in August 2025); VAPT and cyber audits by CERT-In empanelled auditors; and, under the cloud framework, MeitY-empanelled cloud data centres with STQC audit status, data kept within India, and keys under the RE's control.
For trading members that are Qualified REs, or mid-size and small REs offering internet-based or algo trading, the exchanges have set the half-yearly cyber audit for the period ending 30 September 2026: done by a CERT-In empanelled auditor and submitted after IT Committee approval by 31 December 2026, with the action-taken report by 31 March 2027. AWS publishes guides to both SEBI frameworks and its MeitY empanelment letters through AWS Artifact; they help due diligence, but the controls, evidence and audit remain the RE's.
This page is general information, not legal or regulatory advice. Confirm your obligations with your compliance team, your exchange or depository, and the current circulars on the SEBI website.
The SEBI documents that apply, and what changed since August 2024
- CSCRF, 20 Aug 2024 (CIR/2024/113): five RE categories (MIIs, Qualified REs, mid-size, small-size, self-certification), standards organised by cybersecurity function (Governance, Identify, Protect, Detect, Respond, Recover, Evolve) and cyber-resilience goal.
- Clarifications, 31 Dec 2024 (CIR/2024/184): regulatory forbearance to 31 Mar 2025; KRAs and DPs moved to 1 Apr 2025; the data-localisation standard PR.DS.S2 kept in abeyance until further notification.
- Clarifications, 30 Apr 2025 (CIR/2025/60): revised criteria and thresholds for categorising depository participants, among other points.
- Extensions: 28 Mar 2025 (CIR/2025/45) to 30 Jun 2025, then 30 Jun 2025 (CIR/2025/96) to 31 Aug 2025 for all REs except MIIs, KRAs and QRTAs.
- FAQs, 11 June 2025 (CSCRF and cloud framework). One answer notes SEBI is consulting further to finalise its data-localisation guidelines, and says encryption keys and key management should be handled within India.
- Technical clarifications, 28 Aug 2025 (CIR/2025/119): two-hour resumption objective wording aligned to IOSCO; RPO 15 minutes for critical systems; ISO 27001 for Qualified REs now encouraged, not mandatory; REs to follow CERT-In's Comprehensive Cyber Security Audit Policy Guidelines.
- Cloud framework, 6 Mar 2023 (SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/033): nine principles, from governance and CSP selection to data localisation, security controls, BCP and vendor lock-in. CSCRF Annexure-J points to it.
Source
- SEBI CSCRF, CIR/2024/113, 20 Aug 2024
- Clarifications, CIR/2024/184, 31 Dec 2024
- Extension, CIR/2025/45, 28 Mar 2025
- Extension, CIR/2025/96, 30 Jun 2025
- Technical clarifications, CIR/2025/119, 28 Aug 2025
- SEBI FAQs on CSCRF and cloud framework, June 2025
- SEBI Framework for Adoption of Cloud Services, SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/033, 6 Mar 2023
How this differs from the RBI and CERT-In rules
- Stockbrokers and DPs report covered incidents to SEBI, CERT-In and their exchange or depository within six hours; RBI-regulated banks report on DAKSH. Banks: see our RBI Cybersecurity Directions control map.
- CERT-In's 2022 Directions (180-day logs in India, six-hour reporting) still apply alongside CSCRF. CSCRF's own floor for user-access logs on critical systems is two years.
The CSCRF → AWS control map
| Criterion | What it asks (summary) | AWS service / setting | Evidence to keep |
|---|---|---|---|
| ID.AM (asset management); critical-systems definition | Inventory and classify critical systems (on-premises and cloud); Board/Partners approve the list | AWS Config resource inventory; tagging policy; AWS Organizations account list | Approved critical-systems list mapped to accounts and tags; Config inventory export |
| PR.AA guidelines (access) | Need-to-use, least privilege, periodic access reviews, account lockout | IAM Identity Center with MFA; service control policies; IAM Access Analyzer | Access review records; Access Analyzer findings and closures |
| PR.AA guideline (e) | User-access logs to critical systems kept ≥ 2 years, ≥ 6 months online | Organisation CloudTrail trail; CloudWatch Logs retention; S3 lifecycle to archive tiers; S3 Object Lock | Retention settings per log group and bucket; Object Lock configuration |
| PR.AA.S8 (log collection and retention) | All log sources identified and collected; retention per IT Act, DPDP, CERT-In | CloudTrail, VPC Flow Logs, service and application logs to a central S3 log archive in an India Region | Log-source inventory; approved retention policy |
| DE.CM (continuous monitoring / SOC) | SOC monitoring; efficacy measured half-yearly (MIIs, Qualified) or yearly report (others) | GuardDuty, Security Hub CSPM and Inspector findings via EventBridge to the SOC or Market SOC feed | Data-source onboarding list; SOC efficacy report |
| RS.CO.S1–S3 (incident reporting) | SEBI and CERT-In within 6 h for CERT-In-covered incidents; SEBI portal details within 24 h; brokers/DPs also to exchange/depository | EventBridge → SNS/on-call; findings exported to S3 | Detection time; submission times to SEBI, CERT-In and exchange |
| RC.RP (recovery), Aug 2025 clarification | Resume critical operations within 2 h; RPO 15 min for critical systems; periodic restore drills | AWS Backup cross-Region copy; restore testing; AWS Elastic Disaster Recovery; IaC | Drill reports; measured RTO/RPO; restore test results |
| Cloud framework Principle 2 | CSP data centres MeitY-empanelled with valid STQC audit status (incl. logs, DR) | Workloads, logs and backups in ap-south-1 / ap-south-2; SCPs or Control Tower Region deny | MeitY empanelment letters from AWS Artifact; Region-restriction policy |
| Cloud framework Principle 3 | Data, logs and keys owned by the RE; data within India | India Regions only; S3 and backup copy rules kept in-country | Data-flow map; Region-restriction evidence |
| Cloud framework 6.2.9 (keys) | BYOK/BYOE where applicable; keys in a dedicated, fault-tolerant HSM | AWS KMS customer managed keys (imported key material); AWS CloudHSM clusters across AZs | Key policies; HSM cluster configuration; key-management SOP |
| CSCRF 4.3 (VAPT) | Planned at start of FY; periodicity by category | Amazon Inspector for continuous scanning; independent PT under AWS's penetration-testing policy | VAPT plan; reports; closure tracker |
| CSCRF 4.4 (cyber audit) | CERT-In empanelled auditor; 100% critical, 25% non-critical sample | Read-only audit access; AWS Artifact reports for the CSP layer | Audit scope; TOR compliance status; management comments |
Logs, SOC and incident reporting
- Collect logs from all sources — system, application, network, database, security, performance, audit-trail and event logs — under a documented retention policy that follows the IT Act, DPDP Act, CERT-In and other government rules (PR.AA.S8). User-access records to critical systems: at least two years, six months online (PR.AA guidelines).
- SOC for continuous monitoring (DE.CM): own or group SOC, third-party SOC, or the Market SOC set up by BSE and NSE; small-size and self-certification REs are onboarded to the Market SOC. MIIs and Qualified REs measure SOC efficacy half-yearly; others obtain a yearly efficacy report from their SOC provider.
- Reporting (RS.CO): incidents covered by the CERT-In Directions go to SEBI and CERT-In within six hours of noticing or detection (SEBI by email to mkt_incidents@sebi.gov.in), with details on SEBI's incident reporting portal within 24 hours; stockbrokers and DPs also report to the exchanges or depositories within six hours. Other incidents within 24 hours.
- On AWS: organisation CloudTrail trail, CloudWatch Logs, VPC Flow Logs and service logs to an S3 log archive in Mumbai or Hyderabad with S3 Object Lock and lifecycle rules set to the policy; GuardDuty, Security Hub CSPM and Amazon Inspector findings through EventBridge to the SOC.
Cloud framework: CSP, data location and keys
- CSP selection (Principle 2): data — including logs, DC, DR and near-DR — stored and processed in MeitY-empanelled CSP data centres with valid STQC audit status. AWS lists MeitY empanelment letters for the Mumbai and Hyderabad Regions in AWS Artifact.
- Data ownership and localisation (Principle 3): the RE owns its data, logs and keys; data resides and is processed within India. The December 2024 abeyance names CSCRF standard PR.DS.S2; it does not mention the 2023 cloud framework. Check the current position with your compliance team.
- Keys (cloud framework 6.2.9): BYOK and BYOE where applicable, or a documented risk assessment with equivalent mitigations; keys generated and stored in a dedicated HSM, designed for fault tolerance. On AWS: AWS KMS customer managed keys with imported key material, or AWS CloudHSM for single-tenant HSMs.
- Accountability: the RE stays accountable for everything run by the CSP (CSCRF summary; cloud framework Principle 4); responsibilities must be written into the CSP agreement.
Recovery: the two-hour objective and 15-minute RPO
- RC.RP as clarified on 28 Aug 2025: design and test systems to resume critical operations within two hours of a disruption, even in extreme but plausible scenarios; plan for cases where that isn't met; RPO 15 minutes for critical systems. Test restoration of backups periodically.
- On AWS: AWS Backup with cross-Region copy (Mumbai ↔ Hyderabad, Hyderabad is opt-in), AWS Backup restore testing, AWS Elastic Disaster Recovery for server replication, and infrastructure as code for an identical DR environment.
VAPT and the cyber audit
- Unless stated otherwise, CSCRF audits are by a CERT-In empanelled IS auditing organisation. Cyber audit covers 100% of critical systems and 25% of non-critical systems on a sample basis, with the sampling rationale stated (CSCRF 4.4). Frequency: at least twice a year for MIIs, Qualified REs, and mid-size and small REs offering IBT or algo trading; at least once a year for the rest (Table 21).
- VAPT is planned at the start of the financial year (4.3.2). AWS allows penetration tests on listed services without prior approval; DoS testing is prohibited.
Half-yearly cyber audit prep checklist (period ending 30 Sep 2026)
Applies to trading members that are Qualified REs, or mid-size and small REs offering IBT or algo trading (per BSE, NSE and MCX notices).
- Confirm your category for FY 2026-27 and get it approved by the Board, Designated Director, Proprietor/Partner or technical committee; the auditor will validate it.
- Appoint a CERT-In empanelled auditing organisation that meets the exchange's selection norms (including the three-consecutive-year limit and cooling-off).
- Fix scope: 100% of critical systems, 25% of non-critical systems, with sampling rationale; include cloud accounts, vendor links and business applications.
- Assemble evidence by TOR item: the A2-T1 evidence column, plus SOC efficacy, VAPT reports and closure, DR drill results, and AWS Artifact reports for the CSP layer.
- Get the report approved by your IT Committee and add management comments; every TOR item must show Compliant / Non-Compliant / Not Applicable, with justification for N/A.
- Submit by 31 December 2026. The BSE and NSE submission links open on or after 16 October 2026; MCX's opens 25 October 2026.
- Plan the ATR / revalidation report through the auditor by 31 March 2027.
Beyond India
The method here — take each requirement, name the control that meets it, and decide what evidence proves it — works for any securities regulator's rules on AWS. The circulars, categories and dates in this guide are specific to SEBI.
Where Upvantix fits
Upvantix is an AWS Select Tier Services Partner. We can help an RE's technology team review its AWS accounts against this map — logging and retention, SOC feeds, key management, backup and recovery testing, and the evidence for each — before the auditor arrives. We are not SEBI, we are not a CERT-In empanelled auditor, we do not conduct or sign the CSCRF cyber audit or VAPT, and we do not give legal or regulatory opinions.
This guide summarises SEBI's CSCRF (20 August 2024) and its clarifications, extensions and FAQs (December 2024 to August 2025), SEBI's cloud framework (6 March 2023), exchange notices of 7–8 October 2026 and AWS documentation, as read on 12 October 2026. It is general information, not legal or regulatory advice. Circulars, exchange timelines and AWS features change; confirm your obligations with your compliance team, your exchange or depository, and the SEBI website.
Common questions about SEBI CSCRF on AWS
What is SEBI CSCRF?
The Cybersecurity and Cyber Resilience Framework for SEBI-regulated entities, issued by circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 on 20 August 2024. It sets cybersecurity standards for REs according to their category, from market infrastructure institutions to small and self-certification REs.
When did CSCRF compliance become due?
CSCRF set a glide path: 1 January 2025 for the six RE categories that already had a SEBI cybersecurity circular, and 1 April 2025 for REs covered for the first time. SEBI extended compliance for most REs, finally to 31 August 2025 (circular of 30 June 2025); MIIs, KRAs and QRTAs were excluded from that extension.
Who must complete the half-yearly cyber audit for the period ending 30 September 2026?
Per BSE, NSE and MCX notices, trading members that are Qualified REs, or mid-size and small REs offering internet-based or algo trading. The audit is by a CERT-In empanelled auditor, submitted after IT Committee approval by 31 December 2026.
Can a SEBI-regulated entity use AWS?
Yes, subject to SEBI's cloud framework: CSP data centres must be MeitY-empanelled with valid STQC audit status, data stays within India, and the RE remains accountable. AWS publishes MeitY empanelment letters for its Mumbai and Hyderabad Regions in AWS Artifact.
How fast must a stockbroker report a cyber incident?
Incidents covered by the CERT-In Directions go to SEBI and CERT-In, and to the stock exchange, within six hours of noticing or detection, with details on SEBI's incident portal within 24 hours. Other incidents within 24 hours.
Is data localisation under CSCRF in force?
SEBI kept CSCRF's data-localisation standard PR.DS.S2 in abeyance on 31 December 2024, and the August 2025 clarifications still describe it that way. SEBI's 2023 cloud framework separately requires data to reside in India, and SEBI's June 2025 FAQs say it is still consulting on final data-localisation guidelines; confirm the current position with your compliance team.
Can Upvantix conduct our CSCRF cyber audit?
No. The audit must be done by a CERT-In empanelled auditing organisation, and Upvantix is not one. As an AWS Select Tier Services Partner, Upvantix can help prepare AWS controls and evidence before the audit.