SEBI CSCRF 2026: Building Your SOC From Compliance Mandate

SEBI's Cybersecurity and Cyber Resilience Framework has moved from advisory guidance to mandatory compliance for regulated entities. The framework covers stock brokers, depository participants, mutual fund houses, asset management companies, registrars, and other market intermediaries. At its core, CSCRF requires regulated entities to establish comprehensive cybersecurity governance, implement technical controls, maintain a Security Operations Center capability, conduct regular audits, and report cyber incidents to SEBI within specified timelines. The SOC requirement is where most mid-size regulated entities face their biggest implementation challenge. SEBI does not prescribe whether you must build an in-house SOC or contract a managed SOC provider, but it does require that you have continuous monitoring capabilities, incident detection and response processes, and documented escalation procedures. For organizations classified as high-category regulated entities based on their client count, transaction volume, and asset base, the expectations are more stringent, including 24x7 monitoring capabilities and dedicated security personnel. The deadline pressure is real — SEBI has begun including CSCRF compliance in its inspection framework, and non-compliance findings can result in regulatory action.

The first option is an in-house SOC — building your own team, infrastructure, and processes. This gives you maximum control but requires significant investment in people, technology, and ongoing operations. For most mid-size regulated entities, this is prohibitively expensive. A fully staffed 24x7 SOC requires minimum 8-12 security analysts, a SIEM platform, threat intelligence feeds, incident response tooling, and continuous training. Annual costs typically start at 2-3 crore. The second option is a fully managed SOC from a third-party provider. You outsource the monitoring, detection, and initial response functions to a specialized vendor. This is the most cost-effective approach for organizations without existing security operations capabilities. The critical factor is choosing a provider who understands SEBI CSCRF requirements specifically, not just general cybersecurity monitoring. Your managed SOC provider must be able to support SEBI's incident reporting timelines and provide compliance-ready reporting. The third option is a hybrid SOC — you maintain a small internal security team that handles governance, compliance reporting, and strategic security decisions, while a managed SOC provider handles day-to-day monitoring and detection. This is increasingly the preferred model for mid-to-large regulated entities because it balances cost efficiency with organizational control over compliance reporting.

CSCRF organizes its requirements across several domains, and your SOC operations must address multiple domains simultaneously. For the Identify domain, your SOC must maintain an updated asset inventory and understand the critical information assets within your environment. This feeds directly into detection rule configuration — you cannot detect attacks against systems you do not know exist. For the Protect domain, your SOC must monitor security controls effectiveness and flag configuration drift. This includes monitoring for unauthorized changes to firewall rules, access control configurations, and endpoint protection status. For the Detect domain, this is the SOC's primary function — continuous monitoring of security events, correlation of logs from multiple sources, detection of anomalous behavior, and identification of potential security incidents. SEBI expects that your detection capabilities cover network intrusion, malware, unauthorized access, data exfiltration, and insider threat scenarios. For the Respond domain, your SOC must have documented incident response procedures aligned with SEBI's reporting requirements. Cyber incidents must be reported to SEBI and CERT-In within 6 hours of detection, which means your SOC must have clear escalation paths and pre-approved incident classification criteria. For the Recover domain, your SOC must support business continuity and disaster recovery processes, including post-incident analysis and lessons learned.

Phase one is assessment and planning — 4-6 weeks. Conduct a gap analysis of your current cybersecurity capabilities against CSCRF requirements. Identify which SOC model fits your organization's size, budget, and risk profile. Document your critical assets, data flows, and existing security controls. This phase produces your CSCRF compliance roadmap. Phase two is SOC setup — 8-12 weeks. If building in-house or hybrid, procure and configure your SIEM platform, deploy log collectors across your infrastructure, and begin onboarding log sources. If using a managed SOC, complete vendor selection, negotiate SLAs aligned with SEBI requirements, and begin the integration process. Critical log sources include firewalls, intrusion detection systems, endpoint protection, active directory, application servers, and database audit logs. Phase three is policy and process development — concurrent with phase two. Develop your incident response plan with SEBI-specific reporting procedures, create escalation matrices, define incident classification criteria, and document your SOC operating procedures. These documents will be reviewed during your CSCRF compliance audit. Phase four is testing and validation — 4 weeks. Conduct tabletop exercises simulating different cyber incident scenarios. Test your incident reporting workflow end-to-end, including SEBI portal submission. Validate that your detection rules are generating alerts for known attack patterns. Run a simulated audit to identify documentation gaps before the actual compliance assessment.

The first pitfall is treating CSCRF as a one-time project rather than an ongoing program. SEBI expects continuous compliance, not point-in-time certification. Your SOC must demonstrate operational effectiveness over time through consistent monitoring, regular incident drills, and periodic control reviews. The second pitfall is inadequate log coverage. We frequently find regulated entities that have deployed a SIEM but only onboarded a fraction of their critical log sources. If your trading platform generates logs that are not being ingested by your SOC, you have a detection gap that will surface during an audit. The third pitfall is poor vendor management when using a managed SOC. Your compliance obligation does not transfer to the vendor — it remains yours. Ensure your managed SOC contract includes SEBI-specific SLAs, compliance reporting formats, incident escalation timelines, and the right to audit the provider's operations. The fourth pitfall is insufficient skilled personnel. Even with a managed SOC, SEBI expects the regulated entity to have designated personnel responsible for cybersecurity governance. This typically means a CISO or equivalent role, even if filled part-time in smaller organizations. Document the roles, responsibilities, and reporting lines for cybersecurity governance within your organization.

A: SEBI requires continuous monitoring capabilities, which effectively mandates SOC functionality. Whether you build in-house, use managed services, or adopt a hybrid model is your choice.

A: Cyber incidents must be reported to SEBI and CERT-In within 6 hours of detection. Your SOC must have processes to support this timeline.

A: A managed SOC can support compliance, but the regulated entity retains accountability. Ensure your provider understands SEBI-specific reporting requirements and include them in your SLA.