Cyber Security and Cyber Resilience Framework (CSCRF) for Stock Brokers and Depository Participants

The Cyber Security and Cyber Resilience Framework (CSCRF) is a structured approach mandated by SEBI for stock brokers and depository participants to safeguard their IT infrastructure. It outlines preventive, detective and corrective controls to mitigate cyber threats that could affect client assets and market integrity. Understanding CSCRF is essential for the NISM Series XVI exam because questions often test regulatory compliance, risk assessment and incident response procedures.

Learning Objectives

1Define CSCRF and its relevance to stock brokers and depository participants.
2Identify the key components and roles within the framework.
3Explain the risk assessment methodology and reporting obligations.
4Apply cyber resilience measures to typical brokerage scenarios.

What is the Cyber Security and Cyber Resilience Framework (CSCRF)?

CSCRF is a comprehensive set of policies, processes and technical controls prescribed by SEBI to ensure that stock brokers and depository participants can prevent, detect, respond to and recover from cyber incidents. The framework aligns with global standards such as ISO/IEC 27001 but is tailored to the Indian securities market environment.

The primary aim is to protect client data, transaction integrity and the overall stability of the trading ecosystem. It requires entities to adopt a risk‑based approach, meaning that the depth of controls should correspond to the level of cyber risk identified.

For the NISM exam, candidates must know the definition, the regulatory basis (SEBI (Stock Brokers) Regulations, 1992 and SEBI (Depositories) Regulations, 1996), and why cyber resilience is treated as a systemic risk factor.

Regulatory compliance – non‑adherence can attract penalties or suspension.
Investor confidence – robust cyber controls enhance market credibility.

ℹ️Common Exam Trap

Students often confuse CSCRF with generic IT security policies. Remember that CSCRF is a SEBI‑specific framework with mandatory reporting timelines and audit frequencies.

Key Components of CSCRF

The framework is divided into six inter‑linked components: Governance, Risk Management, Asset Management, Threat Management, Incident Management and Recovery. Each component has defined responsibilities for senior management, IT teams and compliance officers.

Governance establishes the cyber‑security policy, appoints a Chief Information Security Officer (CISO) and defines escalation matrices. Risk Management requires periodic cyber‑risk assessments and the maintenance of a risk register.

During the exam, expect scenario‑based questions that ask which component addresses a particular activity, such as patch management (Asset Management) or post‑incident review (Recovery).

CSCRF Components and Their Core Functions

Component	Core Function	Primary Owner
Governance	Policy formulation, CISO appointment, oversight	Board / Senior Management
Risk Management	Identify, assess, treat cyber risks; maintain risk register	Risk & Compliance Team
Asset Management	Inventory of hardware/software, patch management	IT Operations
Threat Management	Vulnerability scanning, threat intelligence	Security Operations Center
Incident Management	Detection, containment, reporting within 24 hrs	Incident Response Team
Recovery	Business continuity, data restoration, post‑mortem analysis	BC/DR Team

Roles of Stock Brokers vs Depository Participants

While both entities fall under CSCRF, their exposure differs. Stock brokers handle order flow, client portals and trading platforms, making them prime targets for phishing and transaction manipulation. Depository participants, on the other hand, maintain electronic holdings (demat accounts) and thus focus heavily on data integrity and unauthorized access prevention.

Regulatory expectations reflect this distinction. Brokers must implement two‑factor authentication for trade execution, whereas depositories must enforce strict segregation of duties for account creation and modification.

Exam questions may present a breach scenario and ask which entity bears primary responsibility for a specific control – recall the functional split above.

⚠️Pitfall to Avoid

Do not assume that a single control (e.g., firewalls) satisfies the entire CSCRF. The framework demands layered defenses across all six components.

Risk Assessment and Scoring

∑Formula: Cyber Risk Score

R = L \times I

Where:

R= Overall cyber risk score (arbitrary units)

L= Likelihood of the threat occurring (scale 1‑5)

I= Impact on business if the threat materialises (scale 1‑5)

Worked Example

Given Likelihood L = 3 (possible) and Impact I = 4 (high): Step 1: R = 3 \times 4 Step 2: R = 12 Verification: 3 \times 4 = 12.

The risk score helps prioritize remediation. A score of 12, as in the example, would be classified as ‘High’ and trigger immediate corrective actions under the Incident Management component.

SEBI requires brokers and depositories to perform this assessment at least annually and whenever a significant change to the IT environment occurs (e.g., new trading platform launch).

In the exam, you may be asked to calculate the risk score for a given likelihood‑impact pair or to identify the appropriate remediation tier based on the score.

Incident Response & Reporting

When a cyber incident is detected, the Incident Management component mandates a predefined response workflow: detection, containment, eradication, recovery, and post‑incident review. The timeline for reporting to SEBI is within 24 hours of confirming a material breach.

Key elements of the report include the nature of the incident, affected systems, impact assessment, remedial steps taken and recommendations to prevent recurrence.

Exam candidates should memorize the 24‑hour reporting rule and the five‑step response process, as they frequently appear in multiple‑choice questions.

Typical Distribution of Cyber Incidents Reported by Brokers (2023)

Legend

Phishing (35%)

Malware (25%)

DDoS (20%)

Insider Threat (10%)

Other (10%)

Example: NISM‑Style Scenario: Phishing Attack on a Broker

Scenario

A mid‑size stock broker receives an email that appears to be from the clearing corporation, requesting login credentials to a settlement system. An employee complies, and the attacker initiates unauthorized trades worth INR 2 crore.

Solution

Step 1: The incident is flagged by the Security Operations Center during real‑time monitoring (Threat Management). Step 2: The broker follows the Incident Management workflow – isolates the compromised workstation, disables the compromised credentials, and notifies SEBI within 24 hours (Reporting). Step 3: A risk assessment is performed; Likelihood = 4 (high) and Impact = 5 (critical), yielding a risk score of 20, which classifies the breach as ‘Critical’ requiring immediate remediation. Step 4: Post‑incident, the broker updates its phishing awareness training, revises email filtering rules and conducts a board‑level review (Governance).

Conclusion

The scenario illustrates how each CSCRF component interacts during a real breach and reinforces the exam‑relevant 24‑hour reporting requirement.

Regulatory Requirements (SEBI & NISM)

SEBI circulars (e.g., Circular No. 12/2021) mandate that all stock brokers and depository participants must implement CSCRF by a specified compliance date and undergo annual third‑party audits. Non‑compliance can lead to monetary penalties, suspension of trading permissions, or even cancellation of registration.

NISM’s syllabus emphasizes that candidates should be able to identify the key regulatory documents, the audit frequency (annual) and the minimum content of the cyber‑risk register.

Typical exam questions may present a statement about audit frequency and ask whether it is true or false – recall the annual audit requirement.

ℹ️Exam Tip

When a question mentions ‘mandatory cyber‑risk register’, remember it must contain asset classification, threat description, likelihood, impact and mitigation status.

Cyber Resilience Measures

Resilience goes beyond prevention; it ensures continuity of critical services during and after an attack. Measures include redundant data centres, regular backups, disaster‑recovery drills and real‑time replication of trading data.

For brokers, resilience also means maintaining alternative order routing paths to avoid market disruption. Depository participants focus on immutable audit trails for demat transactions.

In the exam, you may be asked to match a resilience measure with the entity that primarily implements it – keep the broker‑vs‑depository distinction in mind.

Testing, Audits and Continuous Improvement

Annual penetration testing, vulnerability scanning and compliance audits are compulsory under CSCRF. The audit report must be submitted to SEBI and any critical findings must be remediated within 30 days.

Continuous improvement is driven by lessons learned from incident post‑mortems, changes in threat intelligence feeds and periodic updates to the risk register.

Exam candidates should know the audit timeline (annual) and the remediation window (30 days for critical findings).

⭐Exam Takeaways

CSCRF is a SEBI‑mandated framework covering Governance, Risk Management, Asset Management, Threat Management, Incident Management and Recovery.
Stock brokers focus on trade‑execution security; depository participants prioritize demat account integrity.
Risk Score = Likelihood × Impact; a score ≥12 is classified as High and triggers immediate action.
Material cyber incidents must be reported to SEBI within 24 hours of confirmation.
Annual third‑party audits and a 30‑day remediation period for critical findings are regulatory must‑haves.

Practice Questions

8 questions on Cyber Security and Cyber Resilience Framework (CSCRF) for Stock Brokers and Depository Participants

What does CSCRF stand for?

Within how many hours must a material cyber incident be reported to SEBI?

Which CSCRF component is primarily responsible for patch management?

If the likelihood is 2 and impact is 5, what is the cyber risk score?

A broker implements two‑factor authentication for trade execution, while a depository enforces segregation of duties for account creation. Which statement best reflects this distinction?

A cyber threat is assessed with likelihood 4 and impact 3. According to CSCRF, what classification does the resulting risk score receive and what action is required?

How often must stock brokers and depository participants undergo third‑party audits under CSCRF, and within how many days must critical findings be remediated?

Who is the primary owner of the Incident Management component in CSCRF?

←Raising of Bill for Delivery Regulatory Structure of Commodities Market→