ISO 27001 Under SEBI's CSCRF:
Who Must Certify, and How Far

For the top two categories of regulated entities, yes. Under the CSCRF (SEBI circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, dated 20 August 2024), Market Infrastructure Institutions (MIIs) and Qualified REs are required to obtain ISO 27001 certification — guideline PR.IP.S16 of the framework. Mid-size, small-size, and self-certification REs are not required to certify, though the CSCRF's cybersecurity controls still apply to them in proportion to their category.

SEBI's CSCRF FAQs (June 2025, FAQ 58) state the scope "shall include (but not limited to) PDC site, DR site, NDR site, SOC, and Colocation facility." In other words, a certificate scoped to a head office alone does not satisfy the framework — the certified ISMS boundary must wrap the regulated technology estate, including recovery sites and the security operations function.

If any in-scope facility or function (PDC, DR, NDR, SOC, colocation) is outsourced, CSCRF FAQ 58 is explicit: "it must be ensured that those third-party service providers are also ISO 27001 certified for the services being outsourced to them." That flow-down clause is the part most REs discover late — vendor certificates must cover the specific outsourced service, not just the vendor's corporate office.

MIIs are the market infrastructure institutions — stock exchanges, depositories, and clearing corporations. The Qualified RE category, per the CSCRF's categorisation thresholds, sweeps in larger intermediaries: banks and NBFCs operating as SEBI REs, mutual funds/AMCs, RTAs, custodians, clearing members, and other financial institutions above the framework's size thresholds — plus Qualified Stock Brokers (QSBs), who carry enhanced obligations including half-yearly VAPT and cyber audits. Where you land determines whether ISO 27001 certification is required or the controls apply without certification.

CSCRF compliance is verified through cyber audits by CERT-In-empanelled auditors, with periodicity depending on your RE category (half-yearly for MIIs and QSBs; annual for most Qualified REs) — all periodicities run on the financial year. VAPT findings must be closed within three months of report submission. The ISO 27001 certificate complements, not replaces, these audits: certification evidences the ISMS; the CERT-In-empanelled audit tests CSCRF-specific controls.

Typically three things. First, scope: your existing certificate probably does not cover the full PDC/DR/NDR/SOC/colocation boundary CSCRF expects. Second, CSCRF-specific requirements that ISO 27001 does not prescribe — the Cyber Capability Index (CCI) for MIIs and Qualified REs, SBOM requirements, Market-SOC onboarding decisions, and SEBI's incident-reporting flows. Third, evidence cadence: CSCRF's financial-year audit and VAPT timelines are stricter than a standard three-year certification cycle. A gap assessment against both instruments at once is the efficient path — that is exactly what we run.