Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 19 SEPTEMBER 2024

Cybersecurity And Cyber Resilience Framework By SEBI: A Step Towards Digital Safety

Saga Legal
Explore more from Saga Legal

On August 20, 2024, SEBI took a major step towards improving the cybersecurity landscape in India's financial sector by releasing the Cybersecurity and Cyber Resilience Framework for SEBI Regulated Entities, including but not limited to:

IndiaTechnology
Sanika Mehra
Sanika Mehra
Antra Ahuja
Antra Ahuja
Author LinkedIn connections

On August 20, 2024, the Securities and Exchange Board of India ("SEBI") took a major step towards improving the cybersecurity landscape in India's financial sector by releasing the Cybersecurity and Cyber Resilience Framework ("CSCRF") for SEBI Regulated Entities ("Regulated Entities/RE"), including but not limited to:

  1. Alternative Investment Funds (AIFs)
  2. Bankers to an Issue (BTI) and Self-Certified Syndicate Banks (SCSBs)
  3. Clearing Corporations
  4. Collective Investment Schemes (CIS)
  5. Credit Rating Agencies (CRAs)
  6. Custodians
  7. Depositories and Depository Participants
  8. Investment Advisors and Research Analysts
  9. KYC Registration Agencies
  10. Merchant Bankers

The applicability of various standards and guidelines of CSCRF is based on different categories of Regulated Entities. CSCRF follows a graded approach and classifies Regulated Entities in the following five broad categories:

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Use Of Artificial Intelligence (AI) In Courts

On June 3, 2026, the Supreme Court of India’s AI Committee released preliminary draft of the Regulations for Use of Artificial Intelligence (AI) in Courts, 2026 (“The Draft”). This marks a shift from scattered experiments with AI tools for translation, transcription, research and case management. With over 93,000 pending matters as of March 2026, the guidelines aim to ease processes for officials and citizens. AI could help reduce backlogs through automated cause-list preparation, transcription, research, and defect scrutiny, but its use also raises serious concerns.
IndiaTechnology
S.S. Rana & Co.
S.S. Rana & Co.
Article

Fintech In India: An Overview Of The Current Regulatory Landscape

India's fintech market is one of the fastest growing in the world, and it shows no sign of slowing down. Estimates put the market at about USD 145 billion at the end of 2025, growing at a compound annual rate of 30.55% to reach roughly USD 550 billion by 2030. India's fintech adoption rate is around 87%, reportedly the highest anywhere and well above the global average of roughly 64% to 67%. Add the world's second-largest digital population and the runway looks long.
IndiaTechnology
Legitpro Law
Legitpro Law
Article

CERT-In’s New AI-Vulnerability Guidelines: A Quick-Reference For OEMs, Tech Vendors And In-House Counsel

Cybersecurity regulation in India has, until now, largely spoken to the entity that suffers the breach. The 2022 CERT-In Directions issued under Section 70B of the Information Technology Act, 2000 fixed a six-hour reporting clock on the organisation that detects an incident. The new Guidelines flip the lens onto the entity upstream of that breach, the OEM or technology provider that built the product in the first place. For the first time, vendors supplying software, firmware, cloud platforms, or APIs into India carry direct, time-bound, and independently verifiable obligations of their own and not obligations that are merely passed through a customer contract, but obligations CERT-In itself may enforce.
IndiaTechnology
S.S. Rana & Co.
S.S. Rana & Co.
Article

Cybersecurity Is Now A Contract Risk: What India's New Power-Sector Regulations Mean For Technology Vendors

For most technology vendors, cybersecurity has been a promise made to a customer, set out in a statement of work and enforced, if at all, through the contract. For vendors supplying India's power sector, that is changing. The Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026, notified on 31 July 2026 under the Electricity Act, 2003, impose obligations directly on vendors, alongside a far more demanding set of requirements for the power-sector entities they serve. Most of these provisions come into force on 1 April 2027.
IndiaTechnology
Legitpro Law
Legitpro Law
Article

FDI In E-Commerce: India's Export-Focused Carve-Out Under Press Note 3 (2026 Series)

On 23 July 2026, the Department for Promotion of Industry and Internal Trade (DPIIT), Ministry of Commerce and Industry, issued Press Note No. 3 (2026 Series) a document whose brevity belies the significance of what it achieves. In a little over two pages, the Government of India has quietly dismantled one of the most longstanding restrictions in its FDI policy architecture: the blanket prohibition on foreign investment in inventory-based e-commerce. The caveat, however, is precise and deliberate: the permission is confined exclusively to exports of goods manufactured or produced in India.
IndiaGovernment, Public Sector
Saga Legal
Saga Legal
Article

Gratuity Liability For Contract Labour: The Principal Employer's Exposure After The ONGC Ruling

On 9 September 2026, a Supreme Court Bench of Justice Ahsanuddin Amanullah and Justice Manmohan allowed a batch of appeals by Oil and Natural Gas Corporation Limited (“ONGC”) and set aside a Bombay High Court judgment that had fastened liability for gratuity on ONGC in respect of workers engaged through contractors in M/s Oil and Natural Gas Corporation Ltd v. Suryakand D. Lad.
IndiaEmployment and HR
Saga Legal
Saga Legal