SEBI CSCRF System & Cyber Audit — Market Infrastructure Institution

Audit footprint

• 300+ regulatory controls assessed against the SEBI Cyber Security and Cyber Resilience Framework
• 300+ technology assets and 100+ servers and network devices in scope
• 50+ critical applications covering trading, surveillance, clearing and settlement
• Three environments reviewed — production, disaster recovery and support

Scope of engagement

• Governance and risk — policy framework, committee structures and third-party risk management
• Access and privileged access — RBAC, segregation of duties, MFA and access recertification
• Change and configuration management — dev / test / prod segregation and rollback control
• Database, operations and asset management — audit logging, CMDB, SBOM and patch lifecycle
• Security operations — SOC, SIEM, incident response and threat intelligence
• Network and infrastructure security — segmentation, IDS / IPS, Active Directory and endpoint controls
• Cyber resilience and disaster recovery — BCP, RTO / RPO validation, DR testing and alternate site readiness

Outcome

The audit produced 79 risk-ranked observations — 5 critical, 12 high, 24 medium and 38 low — each mapped to the relevant CSCRF control with remediation guidance and evidence requirements. Compliance readiness and evidence quality were strengthened ahead of regulatory submission, Cyber Capability Index maturity improved, resilience and recovery preparedness were validated, and regulatory and operational risk exposure was measurably reduced.