What SEBI CSCRF asks of an awareness programme

An awareness programme run by a SEBI-regulated entity answers to two separate parts of the same circular. The Protect function carries the training obligation, at PR.AT on page 63. The Govern function carries an obligation to assess how aware the workforce actually is, and it is written twenty-four pages further on, under risk management. A programme calendar assembled from PR.AT alone will carry the first and not the second.

This piece sets out what each asks, at what cadence, and which regulated entities carry which. Every reference is to SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), Version 1.0, circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024.

What PR.AT establishes

CSCRF §3.2, PR.AT: Awareness and Training, p. 63. The objective is stated for personnel and partners: that they "are provided cybersecurity awareness education, and are trained to perform their cybersecurity related duties".

Standard item 1 turns the objective into a requirement:

"Mandatory programs for building awareness … shall be established. Such programs shall be conducted on a periodic basis…"

Two words in that sentence set the shape of the programme. Mandatory governs establishment. Periodic governs frequency.

Standard items 2 to 5 name the populations the programme reaches beyond general staff: privileged users, third parties, senior executives and the Board (with a "dedicated program … for Board members"), and physical and information security personnel.

That list changes how coverage has to be recorded. A single organisation-wide completion percentage cannot demonstrate that the Board received a programme designed for the Board, or that privileged users received something distinct from what general staff received. Coverage has to be held by cohort, because the Standard is written by cohort.

What the Guidelines expect the programme to address

CSCRF PR.AT Guidelines, pp. 103–104. Where the Standard sets the obligation, the Guidelines describe its content. Item 2:

"REs shall ensure that their employees are aware of potential risks including social engineering attacks, phishing, etc."

Item 3 is more emphatic:

"…thoughtfully designed security awareness campaigns that stress the avoidance of clicking on links and attachments in email, shall be established as an essential pillar of defence."

Item 4 extends the population outwards:

"REs shall conduct periodic training programs … Wherever possible, this shall be extended to outsourced staff, third-party service providers, etc."

An RE that has scoped its awareness programme to payroll employees has scoped it more narrowly than the Guideline contemplates. The programme record should show that the extension to outsourced staff and third-party service providers was at least considered.

Including those same groups in a test is governed by a separate instrument. CERT-In's Comprehensive Cyber Security Audit Policy Guidelines, CISG-2025-02, Version 1.0, 25 July 2025, §15.2.2(iii), pp. 55–56, limits social engineering and process testing to the group of employees explicitly included within the agreed audit scope, and requires specific written consent from the target organisation before external entities such as customers, business partners or vendors are involved. Training scope is defined by the CSCRF Guideline; testing scope is defined by the CERT-In Guidelines.

"Periodic" in the Standard, "Annually" in the table

Read PR.AT alone and the cadence is periodic. Read the circular's periodic-compliance table and the cadence is a figure. Row 9:

"9. Cybersecurity training program (PR.AT.S1) — All REs — Annually"

Both are the same obligation stated at two levels of the same circular, and each does a different job.

The Standard establishes the character of the obligation: a programme that is established once and then conducted repeatedly. That is the work periodic does.

The periodic-compliance table converts that character into a calendar: an interval, attached to a standard reference, applied across a stated population of REs. Annually, for All REs, against PR.AT.S1.

A compliance calendar should cite the table row, because the table is where the interval is stated. A programme charter should cite PR.AT.S1, because the Standard is where the obligation and its cohorts are defined. A document that cites only one of the two cites half the requirement. Two documents inside the same organisation, each citing a different half, will look like they disagree.

The same applies when summarising the requirement publicly. Write periodic and name the Standard; write Annually and name the table row. The circular supports both words, each in its own place.

The assessment obligation, and where it is written

CSCRF GV.RM Guidelines, "Risk Management", item 1(e), p. 87, standards column GV.RM.S3:

"REs shall periodically assess level of employee cybersecurity awareness, for e.g., through phishing test success rate, etc."

Applicability is taken from the row heading where this guideline block begins on p. 86: "All REs except small-size, self-certification REs (Mandatory)."

Three things sit in that one sentence.

• It is a "shall", and it is marked Mandatory for the REs it reaches.
• It attaches to the level of awareness in the employee population. PR.AT.S1 is discharged by conducting the programme. GV.RM.S3 is discharged by measuring the result.
• It names phishing test success rate, and it names it with the words "for e.g." in front. Those three words are part of the clause and belong in any summary of it. The obligation is the periodic assessment; phishing test success rate is the regulator's illustration of how one is done.

This clause is the one most often missed, and the reason is structural. A reader looking for the awareness requirement opens the Protect function, finds PR.AT, and stops there. The measurement half was written into governance and risk management instead.

Which REs carry which

CSCRF applies across RE categories, and the three awareness-related obligations above do not reach the same set of entities. The carve-outs are stated in the circular, in three different places.

The third row is the Cyber Capability Index measure, and it carries a precision that is easy to lose. Annexure-K, p. 166, Measure 3, "Security Training Measure [PR.AT.S1]", states the measure as the "Percentage (%) of information system security personnel that have received security training within the past one year", with a target of 100% and a weighting of 5%.

The denominator is information system security personnel, not the workforce. An RE that reports a workforce-wide completion figure against Measure 3 has used the wrong denominator, and the figure will not match the evidence the measure asks for. Per the GV.OV Guidelines, item 1, p. 85, the index is third-party assessed for MIIs and self-assessed for Qualified REs.

What a programme should be able to produce

Everything above resolves into three artefacts, and the third is the one most programmes have least of.

1. A programme charter and calendar citing PR.AT.S1 for the obligation and periodic-compliance table row 9 for the annual interval, with the cycle dated.
2. Coverage recorded by cohort: general staff, privileged users, third parties, senior executives, the Board's dedicated programme, and physical and information security personnel, plus the extension to outsourced staff and third-party service providers where Guideline item 4 was applied.
3. An assessment series under GV.RM.S3: the awareness level measured periodically, with the method recorded and prior results retained, so that one cycle can be read against the next.

Annexure-K states what evidence looks like for the scored measure, and it is the clearest statement in the circular of what an assessment will ask to see: "1. Details of the training/awareness sessions scheduled within the past 1 year. 2. Cyber audit observation against Standard 1 mentioned in 'Protect: Awareness and Training' header…"

The second item is the one to plan for: it puts PR.AT Standard 1 in front of a cyber auditor, so the programme is assessed on the record it kept.

Where the awareness assessment under GV.RM.S3 is carried out by a CERT-In empanelled auditing organisation, the conduct of that assessment is governed by CISG-2025-02 §15.2.2(iii), pp. 55–56: the testing must use anonymised or statistical techniques, no individual is personally identified or penalised, and the stated purpose is to evaluate overall awareness and the effectiveness of security processes. The output is therefore a statement about a population, the same object GV.RM.S3 asks about when it says "level of employee cybersecurity awareness".