SEBI CSCRF for Research Analysts: A Plain-English Checklist

SEBI's Cyber Security and Cyber Resilience Framework (CSCRF) reads like it was written for stock exchanges and clearing corporations — but it applies, in scaled form, to every SEBI Regulated Entity, including a one-person Research Analyst or Investment Adviser practice with a single website. Here's what it actually asks of a small practice, distilled into a checklist you can action this week.

What CSCRF is, in one paragraph

CSCRF asks every regulated entity to protect its IT systems, websites and client data, with the depth of controls scaled to the size of the entity — a stock exchange needs a security operations centre; a solo RA needs solid basic hygiene. It sits alongside SEBI's other RA/IA obligations, not instead of them. Our full website security guide for SEBI intermediaries covers the reasoning and threats in more depth; this article is the condensed checklist version.

The checklist

Website & server

• ☐ HTTPS enforced site-wide, with a valid, auto-renewing SSL/TLS certificate.
• ☐ Hosting and CMS/plugins kept on a current, patched version.
• ☐ A web application firewall (WAF) in front of the site — most CDNs like Cloudflare include one.
• ☐ No sensitive files (backups, config, admin panels) publicly reachable without authentication.

Email & accounts

• ☐ SPF, DKIM and DMARC configured on your domain, so your email can't be spoofed easily.
• ☐ Strong, unique passwords for every admin login — no shared or reused passwords.
• ☐ Two-factor authentication turned on wherever it's offered (email, hosting, domain registrar, CMS).

Availability

• ☐ Basic DDoS protection — again, usually included free with a CDN in front of the site.
• ☐ A plan for what "down" means and who you'd contact to bring the site back up.

Data & recovery

• ☐ Regular, tested backups of the site and any client data stored on it.
• ☐ A clear list of who has access to what — hosting, domain, CMS, email — and access revoked promptly when someone (a past developer, an ex-employee) no longer needs it.
• ☐ A short, written incident-response step: who you'd notify first if you suspected a breach.

Common mistakes small RA/IA practices make

1. Reusing one password across hosting, domain registrar, email and CMS — a single leaked password then compromises everything.
2. Leaving old developer or ex-employee access active long after the relationship ended.
3. No backups, or backups that have never actually been tested by restoring them.
4. Treating this as a one-time task instead of an ongoing routine — patching, password rotation and access review need to happen on a schedule, not once.

How Arihant Intellect helps

Every website we build for a SEBI RA or IA ships hardened by default — HTTPS, security headers, CDN/WAF, and no exposed admin surface — following the same checklist above. If you already have a site and just want it checked, we offer a free website security check against this list.

Frequently asked questions

What is SEBI's CSCRF?

SEBI's Cyber Security and Cyber Resilience Framework — it asks regulated entities, including RAs and IAs, to protect their IT systems, websites and client data, scaled to the size of the entity.

Does CSCRF apply to a solo Research Analyst?

Yes, in a scaled way — basic cyber-hygiene is still expected. Confirm the specific requirements for your category on sebi.gov.in.

What's the single highest-priority item?

HTTPS with a valid certificate, and two-factor authentication wherever it's available — these block most opportunistic attacks and cost nothing extra on most hosting.

This article is an informational summary by Arihant Intellect (a web & IT service provider, not a SEBI-registered intermediary), condensing general cyber-hygiene practice against SEBI's CSCRF, and is not legal or compliance advice. Always verify the current framework and applicability on the official SEBI website, sebi.gov.in, and consult your compliance officer. See also our full website security guide for SEBI intermediaries.