Extension towards Adoption and Implementation of Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)
Summary
SEBI extends the compliance timeline for the Cybersecurity and Cyber Resilience Framework (CSCRF) by two months until August 31, 2025. This extension applies to all SEBI Regulated Entities except Market Infrastructure Institutions, KYC Registration Agencies, and Qualified Registrars to an Issue and Share Transfer Agents. Stock Exchanges and Depositories are directed to disseminate these provisions to their members and participants.
Text
Recognising the need for robust cybersecurity measures and protection of data and IT infrastructure, Securities and Exchange Board of India (SEBI) has issued ‘Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)’ vide circular SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated August 20, 2024.
SEBI has received multiple requests for CSCRF compliance timelines extension to ensure ease of compliance for them. Therefore, it has been decided to extend the compliance timelines by two (2) months, i.e., till August 31, 2025 to all REs, except Market Infrastructure Institutions (MIIs), KYC Registration Agencies (KRAs), and Qualified Registrars to an Issue and Share Transfer Agents (QRTAs).
Bring the provisions of this circulars to the notice of their members/ participants and also disseminate the same on their websites.
The provisions of this Circular shall come into force with immediate effect.
This circular is being issued in exercise of powers conferred under Section 11 (1) of the Securities and Exchange of India Act, 1992, to protect the interests of investors in securities and to promote the development of, and to regulate the securities market.
Source: SecMarx — Extension towards Adoption and Implementation of Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs). Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.