Work out your SEBI CSCRF Cyber Capability Index

Work out your index

Enter the percentage your own figures produce against each formula. The calculator opens on a worked assessment for a mid-maturity entity, so the tables below are readable as a reference even without entering anything.

The 23 parameters and what each is worth

The weightings are lopsided, and that is the first thing worth knowing. Vulnerability alone carries 18 of the 100 marks and Critical Assets Identified another 9, so those two are more than a quarter of the index between them. Physical Security Incidents, Planning, Personnel Security Screening and System and Communication Protection carry one mark each. An improvement plan that works through the parameters in order will spend most of its effort at the wrong end.

Three of the 23 are not ordinary ratios, and together they carry 10 marks. Parameter 12 is inverse — it counts physical security incidents that allowed unauthorised entry, so its target is 0% and a lower number is better. Parameter 21 is expressly a non-quantifiable measure: Table 27 gives it no formula and no target at all, only implementation evidence about the policy document, its revision frequency and its approval. Parameter 22 defers to the SOC efficacy score defined at Annexure-N, so it is not computed here at all — you enter the score you already hold.

Two of the targets are not 100% either. Security Budget targets 10% of the IT budget, and Critical Assets Identified targets 50% of the systems integrated with your SOC. Reaching a target earns the full weightage; exceeding it earns nothing further.

How SEBI says to score it

The scoring rules are not in the framework. They are in SEBI’s CSCRF FAQ, which is a separate document, and they are specific enough that a calculator built without them will be wrong in ways nobody notices.

• Partial scoring is pro rata. SEBI’s own worked example: an entity reaching 30% against a target of 50%, on a parameter carrying 5 marks, is awarded 3.
• Scores may carry two decimal places, and the highest score for any category is capped at that category’s weightage — there is no credit above target.
• An undefined value resolves per parameter, not uniformly. Where a formula divides zero by zero, the framework does not fall back to a single convention. On parameter 2, no vulnerabilities identified and none mitigated takes the maximum marks. On parameter 14, nobody with access and nobody screened takes zero. A calculator applying one rule to both is wrong in one direction or the other.
• Everything runs on the financial year, and compliance is submitted along with the cyber audit report to the relevant reporting authority.

What the score gets you

A high score is not a pass. The Fail row carries a second limb — it applies at 50 or below, or where the “RE has scored below the cut-off in at least one domain/ sub-domain”. That makes Fail a floor test as well as a total, so an entity scoring in the eighties still fails on one weak domain. SEBI does not publish what the cut-off is; it appears nowhere in the framework. No calculator can determine that limb, this one included, and one that reports a clean pass on the aggregate alone is answering a question SEBI did not ask.

The bands are printed as whole numbers while the score itself may carry two decimals, so a figure such as 90.5 sits between two printed ranges. This tool reads such a score downward, into the band its integer part falls in.

Mid-size, Small-size and Self-certification REs have no CCI obligation at all. If you are not sure which category you are in, that is a different question and the CSCRF category finder answers it — and it is worth answering first, because the category is fixed at the start of the financial year and holds all year.

What the index cannot tell you

• Whether you pass. The domain cut-off limb sits outside the arithmetic and outside the published framework.
• Whether the numbers are evidenced. Implementation evidence goes to SEBI only on demand, but it has to exist. For an MII every item is verified by the auditor conducting the third-party assessment, so an unevidenced figure is a finding rather than a score.
• Anything an outsider can see. Every parameter here is measured from inside. Expired certificates, exposed services and leaked credentials — the things a counterparty or a regulator can observe without asking — sit outside the index entirely.
• What your assessor will conclude. This is a working figure for a conversation, not a submission.

For the framework as a whole, category by category, see the CSCRF compliance guide, or work out your incident-reporting deadlines with the incident reporting clock.

This tool is indicative and is not a submission. Parameters, formulas, targets and weightages are from Annexure-K, Table 27 of the CSCRF, and the rating bands from Table 24 — both read from SEBI’s own framework document, which carries the annexures the circular’s landing page does not. The scoring rules are from SEBI’s CSCRF FAQ. Your reporting authority determines the score that counts. Every instrument cited here was verified against the issuing regulator's own notification on 31 August 2026.