SEBI CSCRF Compliance: SIEM, SOC & the M-SOC Option

TL;DR — SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued 20 August 2024, consolidated years of circulars into one graded standard built around five goals — Anticipate, Withstand, Contain, Recover, Evolve — and makes a SOC mandatory for every regulated entity (RE). Larger REs run their own SOC; smaller ones can onboard to the Market-SOC (M-SOC) operated via NSE/BSE. After extensions, the implementation date moved to 31 August 2025 for most REs.

SEBI's CSCRF is one of the most prescriptive cyber frameworks in Indian financial services, and it applies far beyond the exchanges — stockbrokers, depository participants, mutual funds, KRAs, investment advisers and more. If you are a SEBI-registered entity, "we'll get to security" is no longer a posture the framework permits.

What CSCRF actually mandates

The framework is graded by entity size (MIIs, Qualified REs, Mid-size, Small, and Self-certification), but the monitoring backbone is common:

A Security Operations Centre — own, group, or the Market-SOC
Continuous security monitoring, log collection and retention
VAPT, and for many REs, SBOM, data classification and ISO 27001-aligned controls
Incident reporting to SEBI and CERT-In
Governance mapped to the five cyber-resilience goals

The trap for smaller REs Many mid-size and small REs assume CSCRF is "for the exchanges." It is not. Every RE needs a SOC — and self-certification does not mean self-exempt. Missing the monitoring and reporting requirements is a compliance failure regardless of firm size.

The M-SOC vs your own SOC

SEBI mandated NSE and BSE to stand up a Market-SOC (M-SOC) so smaller REs and self-certification REs have a cost-effective onboarding path. That's a genuine option — but it is a shared, standardised service, not tuned to your environment, and it doesn't remove your accountability for detection and reporting.

Where a dedicated managed SOC helps For REs that want detection tuned to their own estate — and one console covering SIEM, continuous VA, DMARC/dark-web and asset telemetry — Ayati One provides a managed 24×7 SOC at flat per-asset pricing, with logs kept in India and reporting-clock support built into analyst workflow.

Mapping CSCRF to controls

CSCRF goal	Operational requirement	Ayati One
Anticipate	Threat intel, continuous VA	Threat-intel correlation + VA add-on
Withstand	Hardening, monitoring	24×7 SIEM + AI-SOC
Contain	Detection + response	Analyst triage, response playbooks
Recover	Case history, forensics	Full audit trail, retained logs
Evolve	Reporting, improvement	Board-ready reporting to SEBI/CERT-In

Frequently asked questions

When did CSCRF come into force?

Issued August 2024; after two extensions, the implementation date moved to 31 August 2025 for most REs, with MIIs, KRAs and Qualified RTAs on the original schedule. Confirm your category's date against the latest SEBI circular — timelines have shifted before.

We're a small RE — is the M-SOC enough?

It can satisfy the baseline, but it's a shared service. If you want detection tuned to your systems and one platform across monitoring, VA and dark-web, a dedicated managed SOC is the stronger posture. Talk to us.

Does CSCRF require data to stay in India?

CSCRF emphasises monitoring, retention and reporting; keeping telemetry in-country is the cleanest way to evidence it and aligns with the broader DPDP direction.

Meeting SEBI CSCRF? Talk to our SOC engineers about a managed SOC tuned to your estate, with flat per-asset pricing and India data residency.

SEBI CSCRF Compliance: SIEM, SOC & the M-SOC Option

What CSCRF actually mandates

The M-SOC vs your own SOC

Mapping CSCRF to controls

Frequently asked questions

When did CSCRF come into force?

We're a small RE — is the M-SOC enough?

Does CSCRF require data to stay in India?

Explore the full series

Put this into practice.