Cyber resilience controls for SEBI regulated entities
SEBI's Cybersecurity and Cyber Resilience Framework sets one set of expectations for stock brokers, depository participants, mutual funds, market infrastructure institutions and other regulated entities. Ciyora helps you operate the identity, detection and posture controls it asks for, and keep the evidence.
About the framework
SEBI issued the Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities in August 2024. It organises requirements around governance and the cyber resilience functions of identify, protect, detect, respond and recover, and it scales expectations by the category of the regulated entity.
Among its themes are identity and privileged access management, continuous security monitoring through a security operations centre, vulnerability assessment, secure configuration, incident response and reporting, and periodic audits. The mapping below is organised by those functions.
Hosting location
Ciyora is hosted in India and data stays in India. SEBI requirements can include expectations about where data is stored and processed, so confirm the hosting arrangements meet your obligations before you adopt the hosted service.
How Ciyora maps to the requirement areas
Each row names a control area, what Ciyora does for it, and the evidence it can produce. Your own policies, people and processes still matter: the platform helps you operate and evidence the controls.
| Requirement area | How Ciyora helps | Evidence you can produce | Modules |
|---|---|---|---|
| Governance | Role-based administration, approval workflows with reasons, data retention settings and a tamper-evident audit trail. | Audit exports, approval records and governance reports for your board and auditors. | Comply, Fortress |
| Identify | Inventory of endpoints, servers, domains, certificates and cloud resources; identities and non-human identities with owners; SaaS catalogue. | Asset and identity inventories with owner and risk. | Discover, Fortress |
| Protect: identity and access | Access requests and reviews, separation of duties, just-in-time privilege, credential vault, MFA step-up for sensitive actions, recorded privileged sessions. | Access review evidence packs, privileged access and SoD reports, session recordings. | Fortress |
| Protect: network and configuration | Zero-trust network access with deny-by-default policy and device posture; cloud posture against benchmarks. | Policy version history, posture findings and control pass rates. | VPN, Armor |
| Detect | Log collection, detection rules mapped to MITRE ATT&CK, XDR correlation, behaviour analytics and threat intelligence; a console your SOC can run on. | ATT&CK coverage, alert and incident history. | Detect, Neural Mesh |
| Respond | Incident management with owners, timelines and confirmed response actions; response rules and playbooks. | Incident timelines with detection and action times for reporting. | Detect |
| Recover | Break-glass access with dual control for emergencies; versioned network policy with roll back. | Break-glass activation records and policy history. | Fortress, VPN |
| Vulnerability management | Vulnerabilities ranked by CVSS, EPSS and CISA KEV, scans and attack-surface discovery. | Vulnerability status by asset over time. | Discover |
Please note. Ciyora is not a certification and does not make an organization compliant on its own. This page describes how Ciyora capabilities map to requirement areas and help you produce evidence. Always read the current text of the regulation or standard and take advice from your compliance team, auditors or legal counsel.
Walk through your control set with us
Bring your latest audit observations or gap assessment, and we will show where Ciyora fits and where it does not.