Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)

Cybersecurity and Cyber Resilience Framework compliance extended with regulatory forbearance and data localisation provisions held in abeyance.

The circular clarifies CSCRF compliance: regulatory forbearance is granted for non compliance during the forbearance period if entities can demonstrate meaningful implementation steps and will be given an opportunity to show progress before any regulatory action. Compliance dates for KYC registration agencies and depository participants are extended to a later date, and the Data Localisation provisions of the Data Security Standard (PR.DS.S2) are held in abeyance pending further consultations. The clarifications are effective immediately.