Extension towards Adoption and Implementation of Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities

The record

What it says

• Extends the CSCRF compliance timeline by a further two months, to 31 August 2025.
• Again excludes MIIs, KRAs and QRTAs, whose timelines were not extended by either circular.
• Is the source of the 31 August 2025 date — that deadline is the product of two extensions rather than of the original framework.

Read the instrument

The link below goes to the issuing regulator’s own copy. Where a regulator serves its text through a PDF viewer or a query-string URL, it points at the document rather than at a landing page that may not render it.

• SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/96 — SEBI’s own copy

Instruments that change what this one requires

Not a reading list. Each of these alters the obligation on this page — the amendment that moved a date, the sibling that binds the entity class this one excludes, or the separate track it is routinely merged with.

• SEBI CSCRF SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 — SEBI regulated entities, graded into five categories with obligations scaled to the category.
• First extension, March 2025 SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/45 — Moved the CSCRF deadline to 30 June 2025, excluding MIIs, KRAs and QRTAs.
• Technical clarifications, August 2025 SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/119 — Technical readings of the CSCRF standards, issued three days before the deadline fell.

This record is one entry in the Indian cyber regulation register, which publishes the same fields for every instrument as an open dataset. Indicative, and not legal advice: whether an instrument reaches your organisation turns on your licences and registrations, and is a determination for your legal team.