INDUSTRY FACT FILE · CAPITAL MARKETS

Cybersecurity FAQs for Capital Market Entities

Forty frequently asked questions and answers in five categories, written for Boards, CXOs, CISOs, compliance, technology and operations teams at exchanges, depositories, brokers and intermediaries.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: SEBI CSCRF, audits and compliance 3.  Category 3: Trading platforms, APIs and applications 4.  Category 4: SOC, incident response and forensics 5.  Category 5: Third parties, cloud, privacy and emerging technology

Audience: Board members, MD & CEO, CISO, risk heads

Q1. Why is cybersecurity critical for capital market entities?

Market participants hold investor assets and data and run time-critical trading and settlement systems. Incidents can harm investors, disrupt markets and trigger SEBI action. CSCRF makes cyber resilience a Board-overseen, recurring compliance obligation.

Q2. What are the biggest cyber risks in capital markets?

Trading account takeover, fake apps and investment scams, DDoS, API and algo abuse, ransomware at brokers, DPs and RTAs, unauthorised transfers and pledges, insider misuse, vendor and supply-chain compromise, data leakage and slow detection.

Q3. What does CSCRF expect from the Board?

A Board-approved cybersecurity and cyber resilience policy, defined roles including a CISO, oversight of audit findings and periodic review of the entity's cyber posture.

Q4. How should cyber risk be reported to the Board?

Report CSCRF compliance status, open audit and VAPT findings and their closure timelines, incidents and root causes, SOC performance, vendor risks and recovery-test results.

Q5. Why does a small broker need to care about CSCRF?

Small-size and self-certification REs still have baseline obligations, audits and SOC requirements—including onboarding to the Market SOC unless they run their own SOC.

Q6. How does an entity registered in several capacities comply?

An entity registered in more than one capacity generally follows the highest applicable CSCRF category, so it should map all registrations together.

Q7. How much should an entity spend on cybersecurity?

Spending should follow the CSCRF category and risk: meet mandated audits, VAPT and SOC requirements first, then invest in resilience, threat hunting and governance as size and complexity grow.

Q8. How can Codec Networks help?

Codec Networks provides CSCRF categorisation and gap assessments, CERT-In empanelled cyber audits and VAPT, system and PCM audits, trading platform security, cloud framework assessments, managed SOC and incident response.

Audience: Compliance officers, CISOs, internal audit

Q9. What is SEBI's CSCRF?

The Cybersecurity and Cyber Resilience Framework (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024) consolidates SEBI's cybersecurity requirements into a graded framework for regulated entities, aligned with recognised international standards.

Q10. When did CSCRF compliance become due?

MIIs, KYC registration agencies and qualified RTAs had to comply by 1 January 2025. After extensions in 2025, all other regulated entities had to comply by 31 August 2025.

Q11. What are the CSCRF categories?

Market Infrastructure Institutions, Qualified REs, Mid-size REs, Small-size REs and Self-certification REs, determined by criteria such as client numbers, trading volumes or assets under management. SEBI revised the thresholds in April 2025.

Q12. Who can perform CSCRF cyber audits and VAPT?

CSCRF requires cyber audits and VAPT to be performed by CERT-In empanelled IS auditing organisations. Codec Networks is CERT-In empanelled.

Q13. How often are cyber audits required?

Frequency depends on category: MIIs and Qualified REs are audited more frequently (twice a year), while most other REs are audited annually, with more frequent audits for entities providing internet or algorithmic trading.

Q14. How quickly must incidents be reported?

Cyber incidents must be reported to SEBI within six hours of detection, followed by further updates and root-cause analysis. CERT-In's Directions separately require reporting within six hours.

Q15. What is the Cyber Capability Index?

A CSCRF maturity measure: MIIs undergo third-party assessments and Qualified REs perform self-assessments, with results reported to SEBI.

Q16. What other SEBI requirements matter?

SEBI's March 2023 framework for adoption of cloud services, system audit requirements for various intermediaries and the June 2024 system audit framework for professional clearing members, together with exchange and depository circulars.

Audience: CTOs, trading technology, product and AppSec teams

Q17. What should trading app security testing cover?

Authentication and device binding, session management, order and fund-flow logic, data storage, communication security, tampering resistance and backend API security.

Q18. Why is API security important for brokers?

APIs power trading apps, partner platforms and algo access. Weak authorisation or rate limiting can allow account abuse, data exposure or erroneous order flows.

Q19. How should algo trading platforms be secured?

Through secure development and testing of strategies, change approval, vendor code review, pre-trade risk limits, kill switches and real-time monitoring of order rates and anomalies.

Q20. How do we protect against DDoS?

Combine upstream DDoS protection, capacity planning, architecture resilience, failover testing and monitoring, and test them under realistic load.

Q21. How do we stop account takeover?

Use strong and risk-based authentication, device binding, alerts for new devices and unusual trades, and investor education against phishing.

Q22. What about OMS/RMS and back-office systems?

Restrict and monitor privileged access, enforce maker-checker for sensitive actions, patch promptly and include these systems in VAPT and audits.

Q23. How should vendors' software be assured?

Assess vendor security, review secure-development practices, verify update integrity and include audit and incident-notification clauses in contracts.

Q24. Do mobile app security requirements apply under CSCRF?

CSCRF covers application security; SEBI's August 2025 clarifications made certain mobile app security provisions recommendatory. Strong mobile app security remains essential for investor protection.

Audience: SOC managers, incident response, operations and surveillance teams

Q25. Who needs a 24x7 SOC under CSCRF?

MIIs, Qualified REs and Mid-size REs require 24x7 SOC coverage—own, group, managed or the Market SOC as permitted. Small-size and self-certification REs must onboard to the Market SOC unless they run their own SOC.

Q26. What is the Market SOC?

A SOC operated by NSE and BSE that smaller regulated entities can onboard to for security monitoring under CSCRF.

Q27. How is SOC efficacy measured?

CSCRF requires periodic measurement of SOC efficacy—more frequently for MIIs and Qualified REs—covering detection coverage, response performance and continuous improvement.

Q28. What should an incident response plan include?

Classification, roles, escalation, containment, recovery, evidence preservation, communication with investors, MIIs and regulators, and the 6-hour SEBI and CERT-In reporting workflow.

Q29. How long must logs be kept?

CERT-In requires ICT logs for a rolling 180 days within India; CSCRF expects strong log retention aligned with applicable government guidelines and standards.

Q30. When are red teaming and threat hunting required?

CSCRF requires red teaming and threat hunting for MIIs and Qualified REs at defined frequencies; other entities benefit from periodic exercises.

Q31. When should forensic investigators be engaged?

As soon as a material incident is suspected, to preserve evidence, determine scope and support SEBI reporting and root-cause analysis.

Q32. How should we prepare for ransomware?

Segment critical systems, keep isolated and tested backups, monitor endpoints 24x7, test recovery against objectives and rehearse the incident and reporting process.

Audience: Vendor management, cloud and infrastructure, data protection and innovation teams

Q33. How does SEBI regulate cloud adoption?

SEBI's framework for adoption of cloud services (6 March 2023) sets governance, shared-responsibility, data security, vendor risk and exit-readiness expectations for regulated entities using cloud.

Q34. How should third-party risk be managed?

Identify vendors with access to critical systems or data, assess them before onboarding and periodically, include security and audit clauses in contracts and monitor high-risk vendors.

Q35. Does data localisation apply?

Certain CSCRF data-localisation provisions were placed in abeyance in December 2024 until further notification. Entities should track SEBI's latest position and other applicable rules.

Q36. When do DPDP obligations apply?

The DPDP Rules, 2025 were notified on 13 November 2025 with phased commencement; most data-fiduciary obligations, including safeguards and breach intimation, take effect in May 2027.

Q37. How should investor KYC data be protected?

Minimise collection, encrypt at rest and in transit, restrict and log access, monitor cloud storage for exposure and define retention and deletion rules.

Q38. What are the risks of AI in capital markets?

AI used in surveillance, research, advisory and support can introduce model manipulation, data leakage and prompt-injection risks; SEBI has issued advisories on AI-related cyber risk, and AI systems should be tested and governed.

Q39. How do deepfakes affect market participants?

Deepfakes can impersonate executives, advisers or company officials to mislead investors or authorise transactions. Verification, monitoring and awareness reduce the risk.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your registrations, CSCRF category, systems and audit calendar. Codec Networks will propose a categorisation and gap assessment, cyber audit and VAPT plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. CSCRF requirements depend on each entity's category; confirm obligations against SEBI's current circulars, clarifications and FAQs.