SEBI CSCRF Practitioner Certification

The single most under-taught part of CSCRF. Every vendor mentions CCI exists; nobody walks the 23-parameter methodology, the six maturity bands, the MII half-yearly third-party assessment cadence, the Qualified RE annual self-assessment cadence, the 15-day submission window, or how REs game CCI and how SEBI is countering that. This module ships the CCI Calculator spreadsheet as course collateral.

1. 1. What the CCI is and why SEBI cares 10 min
2. 2. The 23 CCI parameters and their weightages 12 min
3. 3. The submission workflow and the 15-day rule 9 min
4. 4. How REs game CCI and what SEBI is doing about it 9 min

The CISO role as CSCRF defines it, and what the Indian market actually pays. Reporting line rules that prevent the CISO from sitting under the CTO. Board Technology Committee cadence for MIIs and Qualified REs.

Cyber Crisis Management Plan design. Certifications that move the CISO shortlist (CISM + CISSP + ISO 27001 LA). Salary bands from ₹35 lakh (mid) through ₹3.5 crore (MII Group CISO).

1. 1. The CISO mandate under CSCRF 9 min
2. 2. The Board Technology Committee cadence 8 min
3. 3. Cyber Crisis Management Plan and drills 8 min
4. 4. CISO career: salary bands, certifications, career map 10 min

The single most consequential architecture decision under CSCRF. In-house 24×7 SOC at ₹3-8 crore/year vs Managed SOC at ₹40 lakh-₹2 crore/year vs Market SOC operated by BSE (Blue Sapphire) and NSE (Aujas). Named M-SOC vendors serving SEBI REs (Aujas, Sequretek, TCS, Wipro, IBM, LTIMindtree, K7, SISA, SecurityHQ).

SIEM stack choices from Splunk Enterprise Security through Wazuh. The 10 contract clauses to negotiate with your M-SOC provider.

1. 1. The three approved SOC architectures 9 min
2. 2. Cost economics: in-house vs M-SOC 9 min
3. 3. M-SOC vendor selection and contract 10 min
4. 4. SIEM stack selection 9 min

Audit cadence by RE class (twice a year for MII/Qualified/IBT-Algo, once a year for others, self-cert exempt). 100% critical + 25% non-critical scope rule. VAPT scope across web, mobile, infrastructure, APIs, cloud and third-party integrations.

Cost bands from ₹8 lakh (SME broker) through ₹2 crore (MII). 3-month remediation cap. 6-month revalidation.

Named CERT-In empanelled auditors. Sample RFP. Auditor evidence pack you can adapt.

1. 1. Cyber audit cadence and scope 8 min
2. 2. VAPT scope and cost bands 9 min
3. 3. Named CERT-In empanelled auditors and how to evaluate them 9 min
4. 4. Managing findings to closure and the NSE Inspection ATR 8 min

The 6-hour SEBI + CERT-In dual clock and the incident report template that satisfies both regulators from one incident record. Cloud framework: MeitY-empanelled CSP requirement plus STQC audit plus Indian data residency. Status of PR.DS.S2 data-localisation control (in abeyance since December 2024).

RTO 2 hours / RPO 15 minutes for critical operations. SEBI Interoperability Framework (live 1 April 2025): 75-min intimation + 15-min alt-venue invoke. Real case studies: Angel One February 2025 AWS breach (₹8 million users, stock -11%), NSE February 2021 outage (₹72.64 crore settlement).

1. 1. The 6-hour dual clock: SEBI and CERT-In 9 min
2. 2. Cloud, MeitY empanelment, and data residency 8 min
3. 3. RTO 2 hours, RPO 15 minutes, and the interoperability framework 8 min
4. 4. Real incident case studies at SEBI REs 10 min

The Principle of Exclusivity and Principle of Equivalence from the 28 August 2025 Technical Clarifications, and how to use them to reduce duplicate audit effort across multiple financial-sector regulators. Single-view crosswalk of CSCRF ↔ CERT-In Directions 2022 ↔ RBI IT Framework and PDS Direction 2018 ↔ DPDP Rules 2025 ↔ NCIIPC Protected Systems. Category-specific playbooks: Broker vs AMC vs KRA vs Depository vs MII.

SBOM obligation. The board deck template a CISO can adapt for the next quarterly IT Committee.

1. 1. The Principle of Exclusivity and the Principle of Equivalence 9 min
2. 2. The single-view cross-regulator crosswalk 9 min
3. 3. Category-specific playbooks: broker vs AMC vs KRA vs Depository vs MII 10 min
4. 4. SBOM and the quarterly board deck template 8 min

Final certification exam covering all seven content modules. Every question is anchored to a specific SEBI circular clause, FAQ answer, sectoral overlay or case study cited in the course. Randomised order, shuffled options, explanations shown after each question and cite the source.

Lessons coming soon.