Most senior CISOs at SEBI Regulated Entities know the master CSCRF circular of 20 August 2024. Fewer can name all seven instruments in the stack (now eight with the 5 May 2026 AI Advisory). Not being able to name them is why compliance filings get made against superseded language and why board decks quote clauses that were softened months ago. This lesson fixes that. The stack matters more than any individual instrument because SEBI expects Regulated Entities to demonstrate that they are current — that their compliance programme reflects the latest guidance, not just the guidance from the year they onboarded. A compliance filing that cites the master circular alone, without acknowledging the April 2025 clarifications and the August 2025 Technical Clarifications, is treated by SEBI inspectors as evidence that the CISO office has not maintained its reading discipline.
Why the stack keeps evolving
SEBI regulates a live market ecosystem, not a static compliance surface. Every material cyber incident affecting an Indian Regulated Entity, every large-scale industry consultation, every material advance in threat sophistication (AI-driven attacks being the most recent), triggers Board-level and inter-regulator conversation at SEBI that eventually produces additional guidance. The May 2026 AI Advisory is the visible tip of an iceberg of internal SEBI dialogue on emerging threats; expect further advisories through 2026-2027 on cloud-supply-chain risk, quantum-computing transition, and cross-border attack coordination. The seven-instrument stack (soon to be an eight-instrument stack, and growing) is the pattern, not the exception.
The seven instruments, in order
| # | Date | Instrument | What it did |
|---|---|---|---|
| 1 | 20 Aug 2024 | Master CSCRF circular — SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 [L1-C1] | 205-page baseline framework. Consolidates all prior SEBI cyber circulars. |
| 2 | Dec 2024 | PR.DS.S2 abeyance | Data-localisation control PR.DS.S2 suspended pending consultation. Still suspended today. |
| 3 | 28 Mar 2025 | First extension — SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/45 [L1-C2] | Non-MII/KRA/QRTA deadline moved from 1 April 2025 to 30 June 2025. |
| 4 | 30 Apr 2025 | Clarifications — SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/60 [L1-C3] | Broker exemption threshold (<1000 clients AND <₹1000cr trading volume). AIF and PMS re-categorisation. KRAs reclassified from MII to Qualified RE. |
| 5 | 11 Jun 2025 | FAQ document [L1-C4] | 76 questions across 17 sections. The practitioner reference for edge cases. |
| 6 | 30 Jun 2025 | Second extension | Non-MII/KRA/QRTA deadline moved to 31 August 2025. Final extension. |
| 7 | 28 Aug 2025 | Technical Clarifications — SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/119 [L1-C5] | Principle of Exclusivity + Principle of Equivalence. ISO 27001 becomes voluntary. RTO 2h / RPO 15min reaffirmed. M-SOC onboarding clarified. NCIIPC overlay acknowledged. |
| 8 | 5 May 2026 | AI Vulnerability Detection Advisory — SEBI/HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 | Names AI-driven vulnerability detection tools (Claude Mythos cited by name) as an emerging systemic threat. Constitutes the cyber-suraksha.ai task force. Directs Regulated Entities to plan for autonomous and agentic mitigation. Endorses virtual patching where vendor patches are unavailable. |
Reading the 5 May 2026 AI Advisory in operational terms
The May 2026 AI Advisory is a circular under Section 11(1) of the SEBI Act, 1992, which means Annexure-A commitments carry the same enforceable weight as the original CSCRF master circular obligations. Practitioner reading: every Regulated Entity CISO must add three items to the compliance register within the following six months of the advisory. First, a task-force alignment memo referencing cyber-suraksha.ai and stating which of the RE's teams engage with it. Second, an AI-driven-threat threat-model addition to the annual VAPT scope, specifically covering autonomous and agentic attack scenarios. Third, a virtual-patching policy documenting the circumstances in which virtual patches will be deployed (typically zero-day windows before vendor patches are available), the approval process, and the monitoring that confirms the virtual patch is effective while the vendor patch is awaited.
Where to obtain the primary PDFs
Every SEBI circular is published on sebi.gov.in under Legal → Circulars, filtered by department (ITD-1 for cyber). The master circular URL and the subsequent clarifications each have permanent SEBI URLs; bookmark them individually and pull them into your compliance library rather than relying on secondary aggregators. For the FAQs and Technical Clarifications, SEBI attaches the PDFs to the linked circular; open the linked circular first, then navigate to the attached FAQ or clarification. This may seem procedural, but it is what an inspector expects to see when they ask "where do you obtain your CSCRF text?" A bookmarked SEBI URL beats a cached PDF on your laptop.
What is in force today
Since 31 August 2025, CSCRF is fully in force for every category of SEBI Regulated Entity. MIIs, KRAs and QRTAs have been operating under CSCRF since 1 January 2025. There is no further extension.
The practitioner reading of "fully in force" is that a SEBI inspection or a CERT-In-empanelled auditor now examines: full compliance with the master circular; the operational implementations shaped by the April 2025 clarifications; the FAQ interpretations that resolve edge cases; and the Aug 2025 Technical Clarifications that introduce the Principle of Equivalence used to reduce duplicate audit burden.
Why the circular number matters
Every SEBI circular carries a unique number in the form SEBI/HO/[Department]/[Sub-code]/P/CIR/[Year]/[SeqNo]. Get the number wrong in your board paper or your regulatory filing and you signal amateurism. The right prefix for CSCRF is SEBI/HO/ITD-1/ITD_CSC_EXT. Some secondary sources cite ITD_CSC_POD1; that is incorrect. The correct middle segment is ITD_CSC_EXT.
Practical filing rule: every CSCRF-related document your team produces (board deck, audit report, incident report, CCI submission) should cite the specific circular number and date of every provision it relies on. This is the single most important habit to build inside the DPO or CISO team.
Which instrument to read for which question
- Framework structure and control catalogue: Master circular of 20 August 2024. Full 205 pages.
- Data localisation status: Master circular baseline + December 2024 PR.DS.S2 abeyance. Watch for reactivation.
- Your entity's categorisation and applicability: Master circular + 30 April 2025 clarifications (broker exemption + AIF/PMS + KRA reclassification).
- Edge-case operational questions: 11 June 2025 FAQ (76 questions, 17 sections). This is the document your CISO team should have printed and dog-eared.
- Multi-regulator overlap: 28 August 2025 Technical Clarifications, specifically the Principle of Exclusivity and Principle of Equivalence.
- Effective dates and any grace period: The extension circulars (28 March 2025 and 30 June 2025) plus the master circular. Since 31 August 2025 all grace periods are exhausted.
The trap secondary sources set
Vendor blogs and CSCRF guides published between August 2024 and April 2025 do not reflect the April 2025 clarifications or the August 2025 Technical Clarifications. They still describe ISO 27001 as mandatory, treat PR.DS.S2 as active, and use the pre-April 2025 categorisation. A CISO relying on a vendor blog dated December 2024 is nine months out of date on some material points.
The practitioner rule: for any material claim, cite the SEBI circular directly. Where a secondary source is used, note the source date and cross-check against the seven-instrument stack for any subsequent amendment.
The manual verification checklist inside this course
The primary CSCRF PDFs (master circular, Annexure K CCI template, June 2025 FAQ, April 2025 clarifications body) are not consistently machine-readable. Every lesson in this course is anchored to primary sources where feasible and to reputable practitioner sources where the primary is not accessible via automation. A 16-item manual verification checklist inside this course flags each item that requires human confirmation before the CISO acts on it. If your job is at stake on the accuracy of a specific number (a CCI parameter weight, an audit revalidation window, a broker exemption threshold), consult the primary SEBI PDF before you file.