BFSI compliance
RBI and SEBI CSCRF Cybersecurity Compliance
By the Invield security team · Updated 7 October 2026
Indian financial regulators expect regulated entities to prove cyber resilience, not just have policies. SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) and the RBI's Master Direction on IT governance set out what boards, CISOs and IT teams must put in place.
Invield helps banks, NBFCs, stockbrokers, depository participants, asset managers and fintechs close the gaps: assessment, policies, technical testing and 24/7 monitoring.
Key points
- SEBI CSCRF was issued on 20 August 2024 and applies to SEBI-regulated entities in five categories, from market infrastructure institutions to small-size entities.
- The RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 November 2023) applies from 1 April 2024 to banks, NBFCs and credit information companies.
- Both expect board-level governance, regular VAPT and audits, continuous monitoring and tested incident response.
- CERT-In's 6-hour incident reporting rule applies alongside both.
SEBI CSCRF at a glance
CSCRF replaced earlier SEBI cybersecurity circulars with one framework. Requirements are graded by category, so larger entities have more obligations:
- Market Infrastructure Institutions (MIIs)
- Qualified Regulated Entities
- Mid-size Regulated Entities
- Small-size Regulated Entities
- Self-certification Regulated Entities
The framework is organised around cyber resilience goals: govern, identify, protect, detect, respond and recover. Typical expectations include a board-approved cybersecurity policy, asset inventory, VAPT, periodic cyber audits, security operations centre (SOC) monitoring, incident response, and backup and recovery testing.
SEBI extended compliance timelines for most entities to 31 August 2025, but not for MIIs, KRAs and QRTAs. Data localisation requirements were put on hold. Check the latest SEBI circulars for your category, because clarifications continue to be issued.
RBI IT governance and cybersecurity
The RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices consolidates earlier guidance for banks, NBFCs and credit information companies. Key expectations include:
- A board-level IT Strategy Committee and clear IT governance
- A designated Chief Information Security Officer (CISO)
- Information security and cyber risk management, including VAPT
- Risk-based information systems (IS) audit
- Business continuity and disaster recovery planning and testing
- Oversight of IT outsourcing and vendors
Other RBI directions, such as those for digital payment security controls, may also apply depending on your business.
How Invield helps
| Requirement | How we help |
|---|---|
| Gap assessment | Map your current controls against CSCRF or the RBI Master Direction and give a prioritised plan |
| Policies and governance | Board-approved policies, roles, risk registers and reporting packs |
| VAPT | VAPT of applications, APIs, networks and cloud with audit-ready reports |
| Adversary simulation | Red teaming to test detection and response |
| SOC and monitoring | 24/7 monitoring on Invield AI SIEM, with CERT-In log retention |
| Incident response | Playbooks, drills and incident response support, including 6-hour CERT-In reporting |
| Audit readiness | Evidence collection and support during your cyber audit |
Frequently asked questions
Book a BFSI compliance gap assessment
Tell us your entity type and we will scope a CSCRF or RBI gap assessment on a free call.