SEBI CSCRF, on every cloud finding.
CSCRF gives patches a week, two weeks or a month by severity, audit findings three months, and anything older a decision by the IT Committee. NxSCORE puts those dates on each cloud finding and keeps the record the committee reviews every quarter.
You will recognise this if
- Your cloud inventory has to be current within three working days of a change, and it is rebuilt before each audit.
- Patches for high-severity issues have a week, and the clock is kept in a spreadsheet.
- Audit findings older than three months go to the IT Committee, and nobody is sure which ones they are.
- Every quarter, the IT Committee asks for patch compliance and gets a slide built by hand.
What SEBI CSCRF asks of your cloud.
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024, with clarifications of 31 December 2024 and 28 August 2025. Each clause beside the figure NxSCORE reports against it every quarter.
| Clause | What it asks | What the quarterly pack shows |
|---|---|---|
| PR.MA.S3 (11); §4.3.3 | Patches within 1 week, 2 weeks or 1 month by severity; VAPT findings closed within 3 months | Findings closed in the quarter, the share closed by their fix-by date, and what is past it |
| §4.3.4, §4.4.4 | Findings open past 3 months need IT Committee approval, and go on a risk register | Exceptions active, and those expiring within 90 days |
| GV.PO (9); PR.MA.S3 (10) | The IT Committee reviews every quarter, patch compliance included | The pack itself: found, closed, time to fix, recurrence, exceptions and evidence, per quarter |
| PR.IP standard 1 | Baseline configuration and hardening | Baseline controls failing in at least one account at the latest assessment |
| ID.AM.S1, ID.AM.S4 | An asset inventory that includes cloud assets, kept current | The cloud resources NxSCORE knows across the assessed accounts |
| PR.AA.S8 (2) | Logs retained as CERT-In directs | Whether the logging controls pass, and which fail |
CSCRF applies to SEBI regulated entities by category. The patch timelines below are for market infrastructure institutions and qualified regulated entities; other entities set their own. Entities also regulated by RBI may meet some of these rules through RBI’s framework.
From the clause to a date on every finding.
The deadline stops being a number in a policy document. Every cloud finding carries its own date, and everyone can see which are past it.
- 01
Fix-by dates from the rule you follow.
Each finding’s fix-by date runs from the day NxSCORE first saw it, by severity. Two choices in Settings: the patch timelines for MIIs and qualified REs, or 3 months for VAPT and cyber audit findings.
Fix-by dates, SEBISettings- Patches, high7 days
- Patches, moderate14 days
- Patches, low30 days
- VAPT and audit findings90 days
- 02
What is past its date, today.
Every open finding is overdue, due this week, on track or risk accepted. Your analyst works the overdue and the nearly due first, and writes the fix your engineers run.
A finding closes only when a later assessment no longer sees it, so the date it closed is the date it was really fixed.
PrioritiesExample- Public access on 58 buckets, prod-paymentsDue this week
- IMDSv1 on 44 instances, data-lakeOverdue
- Unused key, svc-reportingOn track
- Port 22 open on bastion-drRisk accepted
- 03
Exceptions with a reason, a decider and an end date.
A finding past its date needs a decision. Anyone can ask to accept the risk; your security team decides, with a reason and an expiry no more than 12 months away, and the pack lists every exception active and every one expiring in the next 90 days. That is the list your IT Committee approves.
Exception, bastion-drRisk acceptedFinding Port 22 open on bastion-dr Reason Vendor access until the DR site moves to Session Manager Asked by infra team Decided by Security team Expires 31 March 2027, then counts against its fix-by date again - 04
Closed once, and kept closed.
A resource that fails again after a fix is counted as back again, not as new. When the same cause keeps returning, NxSCORE proposes a prevention plan for your team to agree and apply, and marks it verified after 14 days without the problem coming back.
Prevention plan, public bucketsApplied- Came backFixed three times this quarter, failed again each time.
- AgreedA guardrail on new buckets, agreed with the platform team.
- AppliedIn place. Watching for the problem to return.
- VerifiedAfter 14 days without it coming back.
Every date kept in one record. Now, the quarter in one pack.
Every quarter, a pack your committee can sign.
The figures your committee asks for, from the record your team works in, laid out against SEBI CSCRF’s clauses.
- 05
Checked every day, not before the meeting.
Every connected account is assessed every day, through read-only access. The baseline controls, the logging controls and the resources seen are part of the record the pack is built from.
NxSCORE assesses every cloud account you connect daily, so the resources it knows follow your changes from one day to the next. SEBI put CSCRF’s India-only storage standard in abeyance on 31 December 2024; check the current position with SEBI.
Daily assessmentRead-onlyBaseline Controls failing in at least one account Logging CloudTrail in every region, log validation, trail bucket logging and encryption, flow logs Inventory Every resource seen in the assessed accounts - 06
Your figures, laid out against SEBI CSCRF.
The pack covers the last four quarters: findings found and closed, the median time to fix, what closed within its fix-by date, what failed again, prevention plans, exceptions, and evidence accepted or waiting.
Its SEBI CSCRF sheet says which clause each figure speaks to. It never says you comply: that is for you, your auditors and the regulator.
SEBI CSCRF mappingExamplePR.MA.S3 (11); §4.3.3 41 findings closed this quarter, 88% within fix-by dates; 6 open past their date. Exceptions 9 exceptions active; 2 expire within 90 days. Recurrence 3 resources failed again after a fix; 4 prevention plans in place, 2 verified. - 07
Prepared, reviewed and approved by three people.
Data that arrives after the pack is prepared cannot change what was signed. Set it to run every quarter, and it goes to your committee by email only once an owner has approved it.
Board pack, Q3 2026Signed- PreparedThe workbook is frozen and its SHA-256 recorded.
- ReviewedBy someone who did not prepare it.
- ApprovedBy a workspace owner. The sign-off sheet names all three.
Questions about SEBI CSCRF and the cloud.
How quickly must patches be applied under SEBI CSCRF?
For market infrastructure institutions and qualified regulated entities, high-severity patches within one week, moderate within two weeks and low within one month, under PR.MA.S3. Other regulated entities set their own timelines. NxSCORE can apply these as fix-by dates.
What happens to findings open for more than three months?
Under §4.3.4 and §4.4.4, they need the IT Committee’s approval and go on the risk register. In NxSCORE each one is an exception with its reason and expiry, and the quarterly pack lists them for the committee.
Does the quarterly pack say we comply with CSCRF?
No. It lays your own figures for the quarter against the CSCRF clauses they speak to. Whether you comply is for you, your auditors and SEBI to judge.
Can NxSCORE keep our cloud inventory current?
NxSCORE assesses every connected account daily, and the pack reports the cloud resources it knows across them. It is a view of your cloud, read-only, alongside the inventory you keep for SEBI.
See what is past its date before the IT Committee does.
Connect one cloud account and apply the SEBI fix-by dates. After the first assessment, your analyst takes you through what is overdue, what needs the committee’s decision, and how the quarter’s pack reads against CSCRF.