← Frameworks / SEBI CSCRF / Control Mappings

Machine-readable: JSON API guide

SEBI Cybersecurity and Cyber Resilience Framework for Regulated Entities

Securities and Exchange Board of India mandatory cybersecurity framework for all SEBI-regulated entities including stock exchanges, depositories, clearing corporations, mutual funds, brokers, and portfolio managers. 5 cyber resilience goals (anticipate, withstand, contain, recover, evolve) across 41 control areas covering governance, risk assessment, asset management, identity and access management, data protection, network security, application security, endpoint security, vulnerability management, security monitoring, incident management, business continuity, third-party risk, and cloud security. Entity classification into 5 categories with graded compliance requirements.

Controls: 208
Total Mappings: 371
Publisher: Securities and Exchange Board of India (SEBI) Version: 2024
SEBI CSCRF → SP 800-53 SP 800-53 → SEBI CSCRF Coverage Analysis
AC (15) AT (6) AU (14) CA (7) CM (14) CP (13) IA (7) IR (9) MA (6) MP (5) PE (17) PL (5) PM (22) PS (6) PT (4) RA (9) SA (11) SC (19) SI (13) SR (6)

AC Access Control

Control Name SEBI CSCRF References
AC-01 Policy and Procedures
PR.AA
AC-02 Account Management
PR.AA
AC-03 Access Enforcement
PR.AA
AC-04 Information Flow Enforcement
DATALOCEMAIL-SECPR.AAPR.DSPR.NS
AC-05 Separation of Duties
PR.AA
AC-06 Least Privilege
PR.AA
AC-07 Unsuccessful Logon Attempts
PR.AA
AC-10 Concurrent Session Control
PR.AA
AC-11 Device Lock
PR.AA
AC-12 Session Termination
PR.AA
AC-17 Remote Access
PR.AA
AC-19 Access Control for Mobile Devices
PR.ES
AC-20 Use of External Systems
PR.CS
AC-23 Data Mining Protection
PR.DS
AC-24 Access Control Decisions
PR.AA

AT Awareness and Training

Control Name SEBI CSCRF References
AT-01 Policy and Procedures
CAPACITYPR.AT
AT-02 Literacy Training and Awareness
CAPACITYPR.AT
AT-03 Role-based Training
CAPACITYPR.AT
AT-04 Training Records
CAPACITYPR.AT
AT-05 Contacts with Security Groups and Associations
CAPACITYPR.AT
AT-06 Training Feedback
CAPACITYPR.AT

AU Audit and Accountability

Control Name SEBI CSCRF References
AU-01 Policy and Procedures
DE.AU
AU-02 Event Logging
DE.AU
AU-03 Content of Audit Records
DE.AU
AU-04 Audit Log Storage Capacity
DE.AU
AU-05 Response to Audit Logging Process Failures
DE.AU
AU-06 Audit Record Review, Analysis, and Reporting
AUDITDE.AUDE.CMRS.ANSOC
AU-07 Audit Record Reduction and Report Generation
DE.AU
AU-08 Time Stamps
DE.AU
AU-09 Protection of Audit Information
DE.AURS.AN
AU-10 Non-repudiation
DE.AURS.AN
AU-11 Audit Record Retention
DE.AURS.AN
AU-12 Audit Record Generation
DE.AUDE.DP
AU-13 Monitoring for Information Disclosure
DE.CM
AU-14 Session Audit
DE.AU

CA Security Assessment and Authorization

Control Name SEBI CSCRF References
CA-02 Control Assessments
AUDITCCICERTIFDE.VAGV.OVRC.IMRS.IMVAPT
CA-03 Information Exchange
PR.CS
CA-05 Plan of Action and Milestones
AUDITGV.OVRC.IMRS.IM
CA-06 Authorization
AUDITCERTIFGV.OV
CA-07 Continuous Monitoring
AUDITCCIDE.CMGV.OVRS.IMSOC
CA-08 Penetration Testing
DE.VAVAPT
CA-09 Internal System Connections
CERTIF

CM Configuration Management

Control Name SEBI CSCRF References
CM-01 Policy and Procedures
PR.IP
CM-02 Baseline Configuration
PR.IP
CM-03 Configuration Change Control
PR.IP
CM-04 Impact Analyses
PR.IP
CM-05 Access Restrictions for Change
PR.IP
CM-06 Configuration Settings
PR.ESPR.IP
CM-07 Least Functionality
PR.ESPR.IP
CM-08 System Component Inventory
ID.AM
CM-09 Configuration Management Plan
ID.AM
CM-10 Software Usage Restrictions
PR.ESPR.IP
CM-11 User-installed Software
PR.ESPR.IP
CM-12 Information Location
ID.AM
CM-13 Data Action Mapping
ID.AM
CM-14 Signed Components
PR.ESPR.IP

CP Contingency Planning

Control Name SEBI CSCRF References
CP-01 Policy and Procedures
BCP-DRRC.RP
CP-02 Contingency Plan
BCP-DRCCMPRC.CORC.IMRC.RP
CP-03 Contingency Training
BCP-DRCCMP
CP-04 Contingency Plan Testing
BCP-DRCCMPRC.IMRC.RP
CP-05 Contingency Plan Update
BCP-DR
CP-06 Alternate Storage Site
BCP-DRRC.RP
CP-07 Alternate Processing Site
BCP-DRRC.RP
CP-08 Telecommunications Services
BCP-DRRC.RP
CP-09 System Backup
BCP-DRRC.RP
CP-10 System Recovery and Reconstitution
BCP-DRRC.RP
CP-11 Alternate Communications Protocols
BCP-DRRC.RP
CP-12 Safe Mode
RC.RP
CP-13 Alternative Security Mechanisms
RC.RP

IA Identification and Authentication

Control Name SEBI CSCRF References
IA-01 Policy and Procedures
PR.AA
IA-02 Identification and Authentication (Organizational Users)
PR.AA
IA-04 Identifier Management
PR.AA
IA-05 Authenticator Management
PR.AA
IA-06 Authentication Feedback
PR.AA
IA-08 Identification and Authentication (Non-organizational Users)
PR.AA
IA-12 Identity Proofing
PR.AA

IR Incident Response

Control Name SEBI CSCRF References
IR-01 Policy and Procedures
CCMPRS.MA
IR-02 Incident Response Training
RS.MA
IR-03 Incident Response Testing
CCMPRS.MA
IR-04 Incident Handling
DE.CMRS.ANRS.IMRS.MASOC
IR-05 Incident Monitoring
RS.ANRS.IMRS.MASOC
IR-06 Incident Reporting
RC.CORS.CO
IR-07 Incident Response Assistance
RS.MA
IR-08 Incident Response Plan
CCMPRS.IMRS.MA
IR-09 Information Spillage Response
RS.ANRS.MA

MA Maintenance

Control Name SEBI CSCRF References
MA-01 Policy and Procedures
PR.MA
MA-02 Controlled Maintenance
PR.MA
MA-03 Maintenance Tools
PR.MA
MA-04 Nonlocal Maintenance
PR.MA
MA-05 Maintenance Personnel
PR.MA
MA-06 Timely Maintenance
PR.MA

MP Media Protection

Control Name SEBI CSCRF References
MP-01 Policy and Procedures
PR.DS
MP-02 Media Access
PR.DS
MP-04 Media Storage
PR.DS
MP-05 Media Transport
PR.DS
MP-06 Media Sanitization
PR.DS

PE Physical and Environmental Protection

Control Name SEBI CSCRF References
PE-01 Policy and Procedures
PR.PE
PE-02 Physical Access Authorizations
PR.PE
PE-03 Physical Access Control
PR.PE
PE-04 Access Control for Transmission
PR.PE
PE-05 Access Control for Output Devices
PR.PE
PE-06 Monitoring Physical Access
PR.PE
PE-08 Visitor Access Records
PR.PE
PE-09 Power Equipment and Cabling
PR.PE
PE-10 Emergency Shutoff
PR.PE
PE-11 Emergency Power
PR.PE
PE-12 Emergency Lighting
PR.PE
PE-13 Fire Protection
PR.PE
PE-14 Environmental Controls
PR.PE
PE-15 Water Damage Protection
PR.PE
PE-17 Alternate Work Site
PR.PE
PE-18 Location of System Components
PR.PE
PE-20 Asset Monitoring and Tracking
PR.PE

PL Planning

Control Name SEBI CSCRF References
PL-01 Policy and Procedures
GV.PO
PL-02 System Security and Privacy Plans
CLASSIFYGV.PO
PL-04 Rules of Behavior
GV.PO
PL-08 Security and Privacy Architectures
GV.OC
PL-09 Central Management
GV.RM

PM Program Management

Control Name SEBI CSCRF References
PM-01 Information Security Program Plan
CERTIFCLASSIFYGV.OCGV.POGV.RM
PM-02 Information Security Program Leadership Role
GV.RR
PM-04 Plan of Action and Milestones Process
RC.IMRS.IM
PM-05 System Inventory
ID.AM
PM-06 Measures of Performance
AUDITCCIGV.OV
PM-07 Enterprise Architecture
GV.OC
PM-08 Critical Infrastructure Plan
BCP-DRCCMPGV.OC
PM-09 Risk Management Strategy
CCMPCYBER-INSGV.OCGV.POGV.RM
PM-10 Authorization Process
CERTIFCLASSIFYGV.PO
PM-11 Mission and Business Process Definition
BCP-DRCLASSIFYCYBER-INSGV.OCGV.PO
PM-13 Security and Privacy Workforce
CAPACITYGV.RRPR.AT
PM-14 Testing, Training, and Monitoring
AUDITCCIDE.CMDE.VAGV.OVRC.IMSOCVAPT
PM-15 Security and Privacy Groups and Associations
CAPACITYPR.ATRS.CO
PM-16 Threat Awareness Program
DE.DPID.RARS.COSOC
PM-24 Data Integrity Board
GV.PO
PM-26 Complaint Management
RC.CORS.CO
PM-27 Privacy Reporting
CAPACITYRC.CO
PM-28 Risk Framing
GV.OCGV.RM
PM-29 Risk Management Program Leadership Roles
GV.RM
PM-30 Supply Chain Risk Management Strategy
GV.RMGV.SC
PM-31 Continuous Monitoring Strategy
CCIDE.CMGV.OV
PM-32 Purposing
CLASSIFYGV.OC

PS Personnel Security

Control Name SEBI CSCRF References
PS-01 Policy and Procedures
GV.RR
PS-02 Position Risk Designation
GV.RR
PS-03 Personnel Screening
GV.RR
PS-06 Access Agreements
GV.RR
PS-07 External Personnel Security
GV.RRGV.SC
PS-09 Position Descriptions
GV.RR

PT Personally Identifiable Information Processing and Transparency

Control Name SEBI CSCRF References
PT-02 Authority to Process Personally Identifiable Information
DATALOCPR.DS
PT-03 Personally Identifiable Information Processing Purposes
PR.DS
PT-04 Consent
DATALOC
PT-05 Privacy Notice
DATALOC

RA Risk Assessment

Control Name SEBI CSCRF References
RA-01 Policy and Procedures
GV.RMID.RA
RA-02 Security Categorization
CLASSIFYID.AMID.RA
RA-03 Risk Assessment
GV.RMID.RA
RA-05 Vulnerability Monitoring and Scanning
DE.DPDE.VAID.RAVAPT
RA-06 Technical Surveillance Countermeasures Survey
DE.VAVAPT
RA-07 Risk Response
DE.VAGV.RMID.RAVAPT
RA-08 Privacy Impact Assessments
ID.RA
RA-09 Criticality Analysis
DE.VAGV.OCGV.RMID.AMID.RAVAPT
RA-10 Threat Hunting
DE.CMDE.DPDE.VAID.RASOCVAPT

SA System and Services Acquisition

Control Name SEBI CSCRF References
SA-03 System Development Life Cycle
PR.ASPR.IP
SA-04 Acquisition Process
GV.SCPR.AS
SA-08 Security and Privacy Engineering Principles
PR.ASPR.IP
SA-09 External System Services
GV.SCPR.CS
SA-10 Developer Configuration Management
PR.ASPR.IP
SA-11 Developer Testing and Evaluation
PR.ASPR.IP
SA-15 Development Process, Standards, and Tools
PR.ASPR.IP
SA-17 Developer Security and Privacy Architecture and Design
PR.AS
SA-20 Customized Development of Critical Components
PR.AS
SA-21 Developer Screening
GV.SCPR.AS
SA-22 Unsupported System Components
GV.SC

SC System and Communications Protection

Control Name SEBI CSCRF References
SC-01 Policy and Procedures
PR.NS
SC-05 Denial-of-service Protection
PR.NS
SC-07 Boundary Protection
EMAIL-SECPR.CSPR.NS
SC-08 Transmission Confidentiality and Integrity
EMAIL-SECPR.CSPR.DSPR.NS
SC-12 Cryptographic Key Establishment and Management
DATALOCPR.DS
SC-13 Cryptographic Protection
DATALOCEMAIL-SECPR.DS
SC-18 Mobile Code
PR.ES
SC-20 Secure Name/Address Resolution Service (Authoritative Source)
PR.NS
SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
PR.NS
SC-22 Architecture and Provisioning for Name/Address Resolution Service
PR.NS
SC-24 Fail in Known State
RC.RP
SC-26 Decoys
DE.CMSOC
SC-28 Protection of Information at Rest
DATALOCPR.CSPR.DS
SC-32 System Partitioning
PR.NS
SC-35 External Malicious Code Identification
DE.CM
SC-39 Process Isolation
PR.NS
SC-41 Port and I/O Device Access
PR.ES
SC-44 Detonation Chambers
DE.DPPR.NS
SC-47 Alternate Communications Paths
PR.NS

SI System and Information Integrity

Control Name SEBI CSCRF References
SI-02 Flaw Remediation
PR.IP
SI-03 Malicious Code Protection
DE.DPPR.ES
SI-04 System Monitoring
DE.CMDE.DPPR.NSRS.ANSOC
SI-05 Security Alerts, Advisories, and Directives
DE.DPRS.CO
SI-07 Software, Firmware, and Information Integrity
PR.ESPR.IP
SI-08 Spam Protection
EMAIL-SEC
SI-10 Information Input Validation
PR.AS
SI-12 Information Management and Retention
DATALOCPR.DS
SI-13 Predictable Failure Prevention
PR.MA
SI-16 Memory Protection
PR.ES
SI-17 Fail-safe Procedures
RC.RP
SI-19 De-identification
PR.DS
SI-20 Tainting
PR.DS

SR Supply Chain Risk Management

Control Name SEBI CSCRF References
SR-01 Policy and Procedures
GV.SCPR.CS
SR-02 Supply Chain Risk Management Plan
GV.SC
SR-03 Supply Chain Controls and Processes
GV.SC
SR-04 Provenance
PR.AS
SR-05 Acquisition Strategies, Tools, and Methods
GV.SC
SR-06 Supplier Assessments and Reviews
GV.SCPR.CS