Picture of the author
Kratikal's Logo
Contact Us
Regulatory Compliance

SEBI Compliance Audit

  • Overview
  • Clients
  • FAQs

Guidelines of SEBI - A Complete Overview

“Cyber Security and Resilience Framework for Stock Exchanges and Depositories”.

With a developing economy, more and more people are inclined towards growing their finances with the stock market and mutual funds. Watching this, SEBI has issued three circulars for the Cyber Security Audit for the trading Members of the stock market, Exchanges Depositories and intermediaries.

The idea behind this cyber resilience framework audit is to enhance security practices amidst increasing cyber threats and attacks. This eventually strengthens the integrity of trading facilities on the trading software pursuant to their system respectively.

Who all are Involved?



Wealth Management

Asset Management

Mutual Funds

Trustee Companies

Asset Management Company

Association of Mutual Funds in India


The Purpose of the Audit is to pick out the discrepancies or inadequacies of the system, if any, by the compliance desiderata and the consequences of such hiatuses. The checklist, also known as the Cyber Resilience Framework checklist, highlights several domains that must be taken into consideration while auditing the stock market, Exchanges Depositories and intermediaries.

The circulars are as follows:

  • 1) SEBI/HO/MIRSD/CIR/PB/2018/147 - for stockbrokers and depositories
  • 2) CIR/MRD/CSC/148/2018- for Stock Exchanges, Clearing Corporations and Depositories
  • 3) SEBI/HO/IMD/DF2/CIR/P/2019/12- for Asset Management Companies or Mutual Funds

Our Approach

Finally, all the information and understandings are compiled in a well-documented scope, determining the boundaries and applicability of the SEBI Cyber Resilience audit, referring to the pain point and the requirements of the stakeholders. The Scope encompasses the work systems, number of departments and location of the organization.

Once the scope, objective and criteria for the audit have been defined, the board members must draft an audit plan.
The board members (auditee) along with auditors should streamline the nature, timing and extent of tests of controls and substantive procedures, along with examining the network security measures.

After defining what and what not has to be audited, a proper audit schedule must be published with the approval of both parties. The audit schedule includes a proper timeline suggesting which departments must be audited within a time range.

Once the audit schedule is published, the auditors will examine the pre-implemented documents and controls in the auditee’s organization. The purpose of the audit is to determine if there are any discrepancies or certain observations in the depository’s organization.

After conducting the audit, the auditing body will nail down their observations, areas of improvement, and minor and significant Non-conformities against the departments which were being audited. All of these observations will be further compiled in a summary report along with the standard checklist that had been followed.

What Constitutes Critical Assets?


Kratikal Insights




Organizations’ Security


Small and mid-size
enterprises (SMEs)


Threats Recorded in
GCTx Database


What is the mandate for Market Infrastructure Institutions (MII) by SEBI?

According to circular no. CIR/MRD/CSC/148/2018, SEBI has mandated all Market Infrastructure Institutions (MIIs) to have Cyber Security Operation Center (C-SOC) serving throughout, manned by professional security analysts to identify, monitor, and rectify the threats.

There is a mandate for all the Mutual Funds and AMCs to conduct VAPT for the new systems before deploying them for the needful.

Data encompassing Sensitive Personal Data, Personally Identifiable Information, Sensitive Financial Data and Business Critical Systems are critical assets as per SEBI Cyber Resilience Framework.