SEBI MII Cybersecurity Framework Audit
MII-grade cyber audit — 99.99% availability, capacity-tested, cross-MII coordinated.
Cybersecurity and cyber-resilience audit for Market Infrastructure Institutions — Stock Exchanges, Clearing Corporations and Depositories. Covers the SEBI MII cyber framework, the CSCRF MII tier, capacity planning, cyber-resilience drills and cross-MII coordination obligations.
- SEBI Cybersecurity & Cyber Resilience Framework (CSCRF) — MII tier (SEBI/HO/MIRSD/CRADT/CIR/P/2024/113 dated 20-Aug-2024 and successors)
- SEBI Cybersecurity & Cyber Resilience Framework for MIIs (SEBI/HO/MIRSD/CIR/P/2018/147)
- SEBI Business Continuity Plan & Disaster Recovery for MIIs
- SEBI Outsourcing by Stock Exchanges, Clearing Corporations & Depositories
- IOSCO Principles for Financial Market Infrastructures (PFMI)
- ISO 27001:2022 + ISO 22301 (BCP)
- NIST CSF 2.0 (cross-mapped)
- CERT-In incident-reporting obligations
Compliance is leverage, not paperwork.
MIIs sit at the apex of India's capital-market plumbing — a single outage propagates across every broker, AMC and investor. SEBI's MII cyber framework (originating with SEBI/HO/MIRSD/CIR/P/2018/147 and consolidated under CSCRF in 2024-25) mandates 99.99% availability, periodic capacity testing, red-team exercises, cross-MII cyber drills and quarterly SEBI reporting. Non-MII brokers run against the CSCRF Qualified / Mid-size / Small RE tiers — but MIIs face the strictest bar, with SEBI inspections, SOP-2 access reviews and ETP reporting layered on top. Macksofy's MII audit produces the cyber-resilience, capacity and cross-MII evidence pack SEBI's IT department reviews quarterly.
- Stock Exchanges (BSE, NSE, MSE, MCX, NCDEX, etc.)
- Clearing Corporations (NSCCL, ICCL, MCCIL, NCCL, etc.)
- Depositories (NSDL, CDSL)
- MII subsidiaries running critical capital-market services
- MII-style entities seeking IOSCO-aligned attestation
- MII technology providers (where SEBI access extends)
Aligned to the regulations that matter.
How we run a SEBI MII engagement.
Interactive walkthrough — every phase clickable, every activity documented, every artefact regulator-ready.
- Phase 01
1 · MII tier scoping
- Critical-system inventory (matching, clearing, settlement, depository)
- RTO / RPO + 99.99% availability commitment baseline
- Cross-MII dependency mapping
- SEBI / IT-Committee + IOSCO PFMI alignment
01Station 0101Phase 011 · MII tier scoping
- Critical-system inventory (matching, clearing, settlement, depository)
- RTO / RPO + 99.99% availability commitment baseline
- Cross-MII dependency mapping
- SEBI / IT-Committee + IOSCO PFMI alignment
- Phase 02
2 · Cybersecurity controls
- CSCRF MII-tier control assessment
- Identity, access, privileged-access, MFA evidence
- Network segmentation + microsegmentation
- Cryptographic-control + HSM lifecycle
02Station 0202Phase 022 · Cybersecurity controls
- CSCRF MII-tier control assessment
- Identity, access, privileged-access, MFA evidence
- Network segmentation + microsegmentation
- Cryptographic-control + HSM lifecycle
- Phase 03
3 · Cyber resilience & capacity
- Capacity-planning + stress-testing evidence
- Cyber-resilience drill (matching engine failover)
- Active-active / hot-DR validation
- Recovery-time + recovery-point empirical evidence
03Station 0303Phase 033 · Cyber resilience & capacity
- Capacity-planning + stress-testing evidence
- Cyber-resilience drill (matching engine failover)
- Active-active / hot-DR validation
- Recovery-time + recovery-point empirical evidence
- Phase 04
4 · Threat operations
- 24×7 SOC capability + use-case coverage
- Threat-intel ingestion + TTP coverage (ATT&CK)
- Red-team + purple-team exercise evidence
- Vulnerability + patch SLA per criticality
04Station 0404Phase 044 · Threat operations
- 24×7 SOC capability + use-case coverage
- Threat-intel ingestion + TTP coverage (ATT&CK)
- Red-team + purple-team exercise evidence
- Vulnerability + patch SLA per criticality
- Phase 05
5 · Cross-MII & ecosystem
- Cross-MII cyber-drill participation evidence
- Member / broker connectivity security audit
- Outsourcing + third-party risk per SEBI outsourcing circular
- Incident-reporting to SEBI + CERT-In (6h)
05Station 0505Phase 055 · Cross-MII & ecosystem
- Cross-MII cyber-drill participation evidence
- Member / broker connectivity security audit
- Outsourcing + third-party risk per SEBI outsourcing circular
- Incident-reporting to SEBI + CERT-In (6h)
- Phase 06
6 · Reporting & SEBI pack
- Quarterly SEBI cyber-report format
- CSCRF System Audit Report draft
- IT-Committee + Board cybersecurity dashboard
- Remediation tracker + 30-day retest
06Station 0606Phase 066 · Reporting & SEBI pack
- Quarterly SEBI cyber-report format
- CSCRF System Audit Report draft
- IT-Committee + Board cybersecurity dashboard
- Remediation tracker + 30-day retest
Everything you need to satisfy auditors.
- CSCRF MII-tier compliance attestation
- Capacity + cyber-resilience drill evidence pack
- Red-team + purple-team executive report
- Cross-MII coordination evidence file
- Quarterly SEBI cyber-report template + first submission
- IT-Committee + Board cybersecurity dashboard
- Member-connectivity security audit pack
- Free retest within 30 days + closure letter
CSCRF MII-tier audit + cross-MII drill facilitation
Outcome: Cross-MII drill cleared end-to-end; 99.99% availability empirically evidenced; SEBI quarterly report cycle reduced from 14 to 5 working days
Capacity test + cyber-resilience drill
Outcome: Matching-engine failover validated under simulated DDoS + insider scenarios; recovery-time empirical evidence accepted by SEBI without queries
The shape of a SEBI MII engagement.
Every number below is grounded in how Macksofy actually runs the engagement — not aspirational marketing copy.
What we actually examine.
Each pillar is a distinct workstream inside the engagement — scoped, evidenced, and signed off independently before the audit pack is assembled.
- MII availability & capacity3 pts
- Cyber resilience drills3 pts
- MII-tier security controls3 pts
- Threat operations & red-team3 pts
- Ecosystem & cross-MII3 pts
- SEBI reporting & governance3 pts
99.99% is not a marketing target — SEBI tests it quarter on quarter.
- Capacity-planning + stress-test evidence
- Active-active / hot-DR validation
- Latency + jitter monitoring at matching layer
Tested failover under cyber-incident scenarios, not just hardware faults.
- Annual cyber-resilience drill participation
- Cross-MII coordinated drill evidence
- Recovery-time empirical proof per critical system
CSCRF MII tier — the strictest control baseline in the SEBI universe.
- Privileged-access + MFA + JIT controls
- Network segmentation + microsegmentation
- Crypto + HSM lifecycle management
Continuous threat detection plus periodic adversary-emulation testing.
- 24×7 SOC use-case + ATT&CK coverage
- Threat-intel ingestion + sharing
- Red-team + purple-team annual exercise
The MII is only as resilient as the brokers, clearing members and inter-MII links it touches.
- Member-connectivity security audit
- Cross-MII drill + information sharing
- Outsourcing + third-party risk evidence
What the IT Committee, Board and SEBI see — in the cadence SEBI sets.
- Quarterly SEBI cyber report
- IT-Committee + Board cyber dashboard
- Incident reporting (SEBI + CERT-In 6h)
From kick-off to regulator-ready report.
The horizontal flow below shows the typical week-by-week shape of a SEBI MII engagement. Click any station for detail in the methodology section above.
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things compliance leads ask before signing.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements