ISO 27001 in India
An ISMS gives a SEBI-regulated entity a base. The framework builds further on top.
The Cybersecurity and Cyber Resilience Framework (CSCRF) from SEBI sets the cyber expectations for entities it regulates. An ISO 27001 certificate does not discharge them. What a working ISMS can do is supply much of the evidence the framework draws on for governance, risk and control, so the regulator's own requirements land on a system that already runs.
Back to ISO 27001 services01 · The instrument
The circular, and why you must read the current version
One base circular, followed by clarifications and extensions.
The framework was issued by SEBI as the circular titled Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs), dated 20 August 2024 (its reference number is given in the sources note at the foot of this page). SEBI has since issued further circulars that clarify it, revise how entities are categorised and extend timelines, and has published FAQs. Check the current set on SEBI's site before relying on any detail here.
Obligations scale with the category an entity falls into, which depends on its type and size. Which category you are in decides how much of the framework applies to you, so settle that first.
This page describes the framework at a general level only. It is not a statement of your obligations; confirm them against the circulars that apply to your category.
02 · What it asks
What the framework asks for, at a high level
Governance, protection, detection, response and recovery, with regulator-facing reporting and audit.
- Board-approved governanceA cybersecurity policy, defined roles, and oversight by the board or an equivalent body.
- Knowing what you haveAn inventory of critical systems and data, and an assessment of risk to them.
- Protective controlsAccess, data security, patching, and security of the third parties you rely on.
- Detection and monitoringSecurity monitoring through a security operations capability, own or shared, depending on category.
- Response and reportingHandling incidents and reporting them to the authorities on stated timelines.
- Recovery and testingContinuity, recovery and periodic testing, with audit of the whole by qualified auditors.
03 · Where ISO helps
Where an ISO 27001 ISMS does the heavy lifting
The management system parts transfer best.
- A defined scope and an asset inventory that already names critical systems.
- A documented risk method, register and treatment plan, reviewed by management.
- Topic policies on access, cryptography, suppliers, logging and incidents, already approved and communicated.
- An internal audit and management review cycle that gives the board regular, recorded oversight.
- Supplier controls under Annex A that set a pattern for assessing technology vendors.
- Corrective action records that show findings are closed, which a cyber auditor can sample.
04 · Where SEBI goes further
Where the regulator's requirements go beyond the standard
ISO 27001 sets no reporting deadline, no regulator audit format and no SOC mandate.
ISO 27001 gives you
- A risk-based choice of controls
- Your own audit rhythm, checked by a certification body
- Incident management you define
- Monitoring sized by your risk assessment
SEBI's framework adds
- Prescribed controls and reporting formats by category
- Cyber audits by auditors who meet SEBI's criteria
- Reporting of incidents to the authorities on fixed timelines
- Security monitoring coverage set by the regulator
A certificate is evidence that your ISMS met the standard on the audit dates. It is not a SEBI compliance submission.
05 · Evidence map
Mapping ISMS evidence to framework areas
Use what exists; fill what does not.
| Framework area | ISMS evidence that helps | Usually still needed |
|---|---|---|
| Governance | Approved security policy, roles, management review minutes | Board or committee approvals in the form SEBI expects |
| Identify | Asset inventory, risk register, SoA | Classification of critical systems as the framework defines them |
| Protect | Access reviews, change records, supplier assessments | Any prescribed control the framework sets for your category |
| Detect | Logging and monitoring records under Annex A | Monitoring coverage of the kind the circular requires |
| Respond | Incident procedure and incident log | Regulator and CERT-In reporting on the required timelines |
| Recover | Continuity plans and test records | Drills and recovery objectives in SEBI's terms |
| Audit | Internal audit reports, certification audit reports | The periodic cyber audit and its submission to SEBI or the relevant institution |
Sources: the SEBI circular of 20 August 2024 on the framework, whose reference carries the ITD-1 and ITD_CSC_EXT markers and ends in the serial 113 of 2024 (title, number and date confirmed from SEBI's site), and SEBI's later clarification and extension circulars and FAQs, named only; ISO/IEC 27001:2022 clause titles and Annex A names. Specific obligations are flagged for verification against the current circulars.
Questions about SEBI's framework and ISO 27001
Does an ISO 27001 certificate make us CSCRF compliant?
No. It supports compliance; it does not replace it.
The certificate shows your ISMS conformed to the standard when audited. SEBI's framework sets its own requirements, audits and reporting. A strong ISMS makes those easier to meet and evidence, but each still has to be met on its own terms.
Can our ISO certification body do the SEBI cyber audit?
Only if it meets SEBI's auditor criteria. Check the circular.
The cyber audit is a separate exercise with its own auditor eligibility and reporting. A certification audit is not a substitute. Confirm the auditor criteria for your category in the current circulars.
Which category are we in?
It depends on your entity type and size thresholds.
SEBI revised the categorisation thresholds after the original circular. Read the latest clarification for your entity type, and record your category and its basis, because it drives everything else.
Should the ISMS scope cover everything the framework covers?
Ideally the systems overlap, so evidence is reused.
If your ISMS covers only one product while the framework applies to your regulated operations, much of the ISMS evidence will not help. Aligning scope with the regulated systems gives the best reuse.
Find out what your ISMS already covers.
Auditify can map your ISO 27001 controls against SEBI's framework and list the gaps the regulator's own requirements leave. Your compliance team or counsel should confirm how the circulars apply to your entity.