Building something awesome.
★ TPRM Insights
7 min read · Third-Party Risk · July 2026
The SEBI CSCRF third-party risk mandate is reshaping how India's stock brokers, mutual funds, depositories, and RTAs govern their vendor ecosystems. The Cybersecurity and Cyber Resilience Framework extends direct regulatory accountability to the vendors, cloud providers, and IT service partners that regulated entities depend on. For risk and compliance leaders, vendor oversight is no longer a best practice — it is an examinable obligation.
★ Key Takeaways
The SEBI CSCRF (Cybersecurity and Cyber Resilience Framework) is a unified security and resilience standard that SEBI introduced to replace the fragmented, entity-specific cyber circulars previously issued for stock brokers, depositories, mutual funds, KRAs, RTAs, and other market infrastructure institutions. It consolidates governance, identification, protection, detection, response, and recovery requirements into a single framework — and explicitly requires regulated entities to extend these controls to their third parties.
For TPRM teams, the significance is that CSCRF treats vendor cyber posture as an extension of the regulated entity's own posture. A breach at an outsourced data centre, a cloud hosting partner, or a fintech API vendor is no longer 'their problem' — SEBI expects the regulated entity to have assessed, monitored, and contractually controlled that risk in advance. Intermediaries that cannot demonstrate this oversight face the same scrutiny as if the failure originated internally.
CSCRF scope extends to any third party that stores, processes, or has access to a regulated entity's systems or client data — not just IT vendors. This includes cloud infrastructure providers, SaaS application vendors, outsourced call centres and back-office processors, payment gateway integrations, and even sub-contractors engaged by a primary vendor.
The framework's fourth-party implications are significant: if a mutual fund's RTA outsources KYC verification to a smaller vendor, that sub-vendor's security posture falls within the regulated entity's due diligence perimeter. Risk teams that have historically assessed only tier-1, contracted vendors will need to extend visibility further down the supply chain to stay CSCRF-compliant, particularly for critical and outsourced functions identified under SEBI's risk categorisation.
Operationalising CSCRF third-party controls starts with mapping every vendor against SEBI's criticality tiers and matching assessment depth to that tier. Critical vendors — those supporting trading, settlement, custody, or client data — require deeper due diligence, more frequent reassessment, and continuous monitoring rather than static annual questionnaires.
In practice, this means building a vendor inventory that captures data access levels, sub-processor relationships, and cyber incident history; embedding CSCRF-aligned clauses — breach notification timelines, audit rights, exit assistance — into vendor contracts; and maintaining monitoring cadences that can produce evidence on demand during a SEBI inspection. Manual, spreadsheet-driven tracking struggles to keep pace here: intermediaries with hundreds of vendors need a system that flags control gaps and re-assessment due dates automatically, rather than relying on point-in-time audits that go stale within months.
When a vendor fails to meet CSCRF requirements, the regulated entity — not the vendor — bears the primary regulatory consequence. SEBI holds the intermediary accountable for third-party gaps, which can trigger inspection findings, remediation timelines, and in severe cases, penalties or restrictions on outsourcing arrangements.
This makes remediation tracking as important as initial assessment. A vendor found non-compliant during onboarding due diligence or a periodic review needs a documented corrective action plan with an owner, a deadline, and evidence of closure — not just a flagged risk that sits unresolved. Entities that can show a closed-loop remediation process, from finding to verified fix, are far better positioned in a regulatory review than those that can only show the finding was identified.
SEBI CSCRF shares its core philosophy with frameworks like RBI's outsourcing norms and the EU's DORA — all three treat third-party cyber risk as inseparable from the regulated entity's own resilience obligations, and all three push toward continuous rather than point-in-time oversight. Where CSCRF differs is its unification of previously separate circulars into one standard applied uniformly across stock brokers, depositories, RTAs, and other market infrastructure institutions, reducing ambiguity about which rules apply to which entity type.
For global or multi-jurisdiction financial groups, this convergence is good news: a TPRM programme already built to satisfy DORA's ICT third-party risk requirements or RBI's outsourcing guidelines will map closely onto CSCRF's expectations, requiring incremental rather than ground-up adjustments to vendor governance.
SEBI CSCRF marks a shift from cyber circulars as a compliance checkbox to third-party risk as a continuously monitored, board-visible discipline. For stock brokers, RTAs, depositories, and AMCs, intermediaries that treat vendor oversight as a static annual exercise will struggle to produce the evidence SEBI now expects on demand.
Crest helps capital market intermediaries move from spreadsheet-based vendor tracking to continuous, AI-powered third-party risk monitoring — mapping vendors to criticality tiers, surfacing control gaps in real time, and keeping remediation evidence audit-ready. If your team is preparing for CSCRF compliance, schedule a demo to see how Crest can shorten that path.
★ Frequently Asked Questions
SEBI CSCRF (Cybersecurity and Cyber Resilience Framework) is a unified regulatory standard covering governance, identification, protection, detection, response, and recovery requirements for SEBI-regulated market intermediaries, including their third-party vendors. It replaces earlier entity-specific cyber circulars with one consistent framework.
CSCRF applies to stock brokers, depositories, mutual funds and AMCs, RTAs, KYC Registration Agencies, clearing corporations, and other SEBI-registered market infrastructure institutions. It also extends indirectly to the third-party vendors and sub-processors these entities rely on.
SEBI CSCRF expects ongoing oversight proportional to vendor criticality, not a single annual checkbox exercise. Critical vendors supporting trading, settlement, or client data require more frequent reassessment and evidence that monitoring is active, not just documented.
The SEBI-regulated entity remains primarily accountable, even when the failure originates at a vendor or sub-vendor. Regulators expect the intermediary to have assessed, contracted for, and monitored that risk in advance, so liability does not shift away simply because a third party was involved.
All three frameworks share the same underlying principle: third-party cyber risk is treated as an extension of the regulated entity's own risk. A TPRM programme already aligned to RBI outsourcing norms or DORA's ICT third-party requirements will need only incremental changes to meet CSCRF expectations.
★ See Crest in Action
Intelligence over information. Control over chaos. Insight over effort.
Published by the Crest Editorial Team · crest.digital
Crest Perspective
Risk programmes that treat third-party governance as a compliance checkbox are consistently underprepared when a material vendor incident occurs. The programmes that withstand regulatory scrutiny are those where risk tiering is documented, escalation paths are tested before they are needed, and the board receives accurate, timely information about the organisation’s most critical vendor dependencies.
AI-powered TPRM, compliance automation and GRC intelligence for enterprise teams.
Request a Demo →Ready to get started?
Bring structure, automation, and continuous intelligence to your GRC Process — without adding headcount.
★ Schedule a Demo