Does the cyber security framework (CSCRF) apply to me?
In force
If research analysis is your only SEBI registration, no. SEBI's cyber security framework expressly excludes you from having to report compliance with it.
That changes if you are also registered in another capacity, such as a broker. Then you are categorised under the framework like any other entity in that category.
What does still apply is the advisory on Software as a Service. If you run your business on cloud tools, you report compliance with it half-yearly to SEBI, using SEBI's prescribed sentence.
This one is worth knowing because the framework is widely assumed to catch everybody.
What SEBI says, word for word
CSCRF, Table 8“All RAs who are not registered in other categories of REs shall be excluded from submission of compliance with CSCRF. However, SEBI SaaS circular... dated November 03, 2020 is applicable to RAs.”Source: SEBI Circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, dated August 20, 2024 (Cyber Security and Cyber Resilience Framework) Open document ↗
Master Circular, ¶8.4“The compliance of the advisory shall be reported half yearly by research analysts to SEBI with an undertaking, "Compliance of the SEBI circular for Advisory for Financial Sector Organizations regarding Software as a Service (SaaS) based solutions has been made."”Source: SEBI Master Circular No. HO/38/12/11(1)2026-MIRSD-POD/I/4360/2026, dated February 6, 2026 Open document ↗
More on Governance
- Do I need to appoint a compliance officer?
- What are the rules if I use AI tools in my research process?
- Who can conduct my annual compliance audit — does it have to be ICAI or ICSI?
- Do I need an accessibility audit of my website? (deadline 31 January 2027)
- Do I need written internal policies, and what must they cover?
- What must I do with the compliance audit report once it is done?
- What may I outsource, and what stays my responsibility?