Resources Categories
INDUSTRY FACT FILE · CAPITAL MARKETS
Applicable Cybersecurity Services and Codec Networks Bundles for Capital Markets
How Codec Networks services and bundled service models help capital market entities resolve their threats, comply with SEBI's CSCRF and reduce business impact.
|
In this document 1. Our approach 2. Mapping threats to services 3. Codec Networks service catalogue for the sector 4. Codec Networks bundles for the sector 5. Sector programmes built from the bundles 6. Packages: Foundation, Assurance and Continuous Resilience 7. Regulatory requirement-to-bundle mapping 8. Threat-to-bundle coverage matrix 9. Delivery methodology and deliverables 10. Why Codec Networks 11. Annex: indicative commercial ranges |
1. Our approach
Capital market entities need assurance mapped precisely to their CSCRF category. Codec Networks works on four principles:
- Start with the category: confirm the CSCRF category of each registration and the obligations that follow.
- Follow the trade: test onboarding, order entry, risk, clearing, settlement and depository services end to end.
- Use the right auditor: CSCRF requires CERT-In empanelled auditing organisations for cyber audits and VAPT.
- Prove closure: close findings within prescribed timelines and revalidate with evidence for SEBI and MIIs.
2. Mapping threats to services
The table maps the 18 threats identified in Document 4 of this set to the Codec Networks services that help mitigate them.
|
Threat / challenge |
Applicable Codec Networks services |
Intended outcome |
|
Trading account takeover |
Trading app and authentication testing, IAM & MFA bypass testing, SOC monitoring |
Fewer compromised accounts |
|
Fake apps and investment scams |
Brand and rogue-app monitoring, anti-phishing, takedown support |
Faster removal of impersonation |
|
DDoS and availability |
Resilience and architecture assessment, authorised availability testing |
Validated capacity and failover |
|
API abuse and algo manipulation |
API testing, algo change-control and risk-limit review |
Safer programmatic trading |
|
Ransomware |
Ransomware simulation, backup testing, EDR/XDR validation, IR retainer |
Tested recovery |
|
Insider and privileged misuse |
Privileged-access audit, insider simulation, log monitoring |
Accountable privileged actions |
|
Unauthorised transfers and pledges |
Back-office maker-checker and access testing |
Protected investor holdings |
|
Phishing and BEC |
Phishing simulation, awareness, DMARC review |
Reduced impersonation success |
|
Third-party compromise |
Third-party risk management, vendor assessments |
Managed vendor risk |
|
Software supply chain |
Supply-chain testing, update-integrity review |
Trusted software |
|
Cloud misconfiguration |
Assessment against SEBI's cloud framework, posture monitoring |
Compliant, monitored cloud use |
|
Investor data leakage |
DPDPA readiness, data discovery, DLP |
Reduced data exposure |
|
Settlement and file tampering |
File-integrity and reconciliation controls testing |
Trusted settlement data |
|
Market data and surveillance tampering |
Integrity and access review of data and surveillance systems |
Protected market integrity |
|
Weak detection and response |
Managed SOC, M-SOC readiness, SOC efficacy, playbooks |
Reliable 6-hour reporting |
|
Deepfake and AI fraud |
Deepfake testing, AI security review |
Verification that assumes impersonation |
|
Mule accounts |
Onboarding and transaction-monitoring review |
Earlier detection of misuse |
|
Backup and recovery failure |
DR testing against recovery objectives |
Proven recovery |
3. Codec Networks service catalogue for the sector
|
Service line |
Sector-relevant services |
|
Security Vulnerability Assessment & Penetration Testing |
CSCRF VAPT by a CERT-In empanelled auditor; trading app, web and API testing; network, cloud and database testing; revalidation |
|
Offensive security |
Red teaming and threat hunting for MIIs and Qualified REs; phishing and ransomware simulation; IAM & MFA bypass testing |
|
Information security audit & compliance |
CSCRF categorisation and gap assessments, CSCRF cyber audits, system audits, PCM audits, ISO/IEC 27001:2022, Cyber Capability Index support |
|
Cloud security |
Assessment against SEBI's cloud framework, cloud posture and IAM reviews, exit-readiness reviews |
|
24/7 Managed SOC & threat monitoring |
SOC-as-a-Service, M-SOC onboarding readiness, SOC efficacy measurement, SIEM, EDR/XDR, threat intelligence |
|
Data privacy & protection |
DPDPA readiness, investor data mapping, DLP, breach response |
|
Cyber forensics & threat analysis |
Incident triage, forensic investigation, root-cause analysis for SEBI reporting |
|
Board-level advisory |
Board and committee briefings, cyber risk quantification, crisis readiness |
|
Emerging technology security |
AI security testing and governance for surveillance, research and support tools |
4. Codec Networks bundles for the sector
Eleven of the twelve bundles in the Codec Networks Bundled Service Models apply directly to capital market entities; the Global Cyber Back-Office SPV Program (Bundle 12) is offered separately for international clients.
Figure 6: Codec Networks bundles applied to the sector.
|
Bundle |
Name |
Sector-relevant scope |
Best suited for |
Key deliverables |
|
B1 |
Cyber Assessment & VAPT Assurance Program |
CSCRF VAPT by CERT-In empanelled auditor, retest and revalidation |
All CSCRF categories |
VAPT reports, closure tracker, revalidation report |
|
B2 |
Application, API & DevSecOps Security Program |
Trading apps, APIs, algo platforms, secure SDLC |
Brokers and platform vendors |
Application and API risk report, code review report |
|
B3 |
Cloud, Infrastructure & Zero Trust Security Program |
SEBI cloud framework, colocation, segmentation |
REs using cloud or modernising infrastructure |
Cloud framework assessment, posture report |
|
B4 |
Regulatory Cybersecurity Audit & Compliance Assurance Program |
CSCRF cyber audits, system and PCM audits, evidence |
All SEBI regulated entities |
Audit report, compliance matrix, evidence index |
|
B5 |
GRC, ISO, SOC 2 & Cyber Maturity Program |
ISO 27001, policies, Cyber Capability Index support |
MIIs, Qualified and Mid-size REs |
Maturity scorecard, policy framework |
|
B6 |
Data Privacy, DPDPA & Data Protection Program |
Investor data mapping, consent, DLP, breach workflow |
Brokers, DPs, RTAs, KRAs |
Privacy gap assessment, data inventory |
|
B7 |
Managed SOC, MDR & Continuous Threat Monitoring Program |
24x7 SOC, M-SOC readiness, SOC efficacy, threat hunting |
Entities needing SOC under CSCRF |
SOC reports, efficacy metrics |
|
B8 |
Digital Forensics, Incident Response & Malware RCA Program |
Incident triage, forensics, 6-hour reporting support |
Any RE facing an incident |
Triage report, RCA |
|
B9 |
Third-Party Risk Management & Supply Chain Cyber Risk Program |
Trading, back-office and cloud vendor assessments |
REs relying on vendors |
Vendor risk assessments |
|
B10 |
Cyber Simulation, Awareness, Tabletop & Crisis Readiness Program |
Ransomware, phishing and tabletop exercises |
Boards, operations, trading desks |
Exercise and campaign reports |
|
B11 |
Emerging Technology, AI, Web3 & Future Security Program |
AI security testing and governance |
REs deploying AI tools |
AI risk assessment |
5. Sector programmes built from the bundles
Codec Networks packages the catalogue bundles into six capital markets programmes.
|
Programme |
Built from bundles |
Challenges addressed |
|
CSCRF Compliance Programme |
B4, B1, B5 |
Categorisation, cyber audits, VAPT and closure |
|
Trading Platform Security |
B2, B1 |
Apps, APIs, algo platforms and business logic |
|
SOC and M-SOC Readiness |
B7, B8 |
24x7 monitoring, SOC efficacy and 6-hour reporting |
|
Cloud Framework Assurance |
B3, B9 |
SEBI cloud framework compliance and vendor risk |
|
Investor Data Protection |
B6, B3 |
KYC and holdings data, DPDP readiness |
|
Market Resilience |
B10, B1, B8 |
DDoS, ransomware and recovery objectives |
6. Packages: Foundation, Assurance and Continuous Resilience
|
Package element |
Foundation |
Assurance |
Continuous Resilience |
|
Typical entity |
Small-size and self-certification REs |
Mid-size REs and growing brokers |
MIIs and Qualified REs |
|
Testing |
B1: annual VAPT |
B1 + B2: VAPT and trading platform testing |
B1 + B2 + B10: half-yearly VAPT, red teaming |
|
Audit and GRC |
B4: gap review and annual cyber audit |
B4 + B5: cyber audit, policies, evidence |
B4 + B5: half-yearly audits, Cyber Capability Index |
|
Cloud and privacy |
B3: cloud quick review |
B3 + B6: cloud framework and DPDPA |
B3 + B6 + B11: continuous assurance, AI governance |
|
Monitoring and response |
M-SOC onboarding readiness (B7) |
B7: 24x7 managed SOC + B8 |
B7: SOC efficacy, threat hunting + B8 |
|
Reporting |
Compliance checklist |
Consolidated risk and remediation reporting |
Board and IT committee reporting |
7. Regulatory requirement-to-bundle mapping
|
Requirement (SEBI CSCRF unless stated) |
How Codec Networks helps |
Bundle |
|
Cyber audit by a CERT-In empanelled auditor, frequency by category |
CSCRF cyber audit with closure tracking |
B4 |
|
VAPT by a CERT-In empanelled auditor, with time-bound closure and revalidation |
VAPT and revalidation |
B1 |
|
24x7 SOC (MIIs, Qualified, Mid-size); M-SOC onboarding (smaller REs); SOC efficacy |
Managed SOC, M-SOC readiness, efficacy metrics |
B7 |
|
Red teaming and threat hunting (MIIs and Qualified REs) |
Red team and threat hunting engagements |
B10, B7 |
|
Cyber Capability Index assessment (MIIs and Qualified REs) |
CCI assessment support |
B5 |
|
Cyber incidents reported to SEBI within six hours; CERT-In in parallel |
IR retainer, playbooks, reporting support |
B7, B8 |
|
SEBI cloud framework (March 2023) |
Cloud framework assessment |
B3 |
|
System audits and PCM audit framework |
System and PCM audits |
B4 |
|
DPDP safeguards and breach intimation (from May 2027) |
DPDPA programme |
B6 |
|
Auditor eligibility and independence CSCRF requires cyber audits, VAPT and related assessments to be performed by CERT-In empanelled IS auditing organisations. Codec Networks is CERT-In empanelled and confirms auditor eligibility and independence in each proposal. |
8. Threat-to-bundle coverage matrix
|
Threat / challenge |
Primary bundle |
Supporting bundles |
|
Trading account takeover |
B2 |
B7, B10 |
|
Fake apps and scams |
B7 |
B10 |
|
DDoS |
B3 |
B10 |
|
API and algo abuse |
B2 |
B7 |
|
Ransomware |
B7 |
B8, B10 |
|
Insider misuse |
B7 |
B8 |
|
Unauthorised transfers |
B4 |
B7 |
|
Phishing and BEC |
B10 |
B7 |
|
Third-party compromise |
B9 |
B3 |
|
Supply chain |
B9 |
B2 |
|
Cloud misconfiguration |
B3 |
B7 |
|
Investor data leakage |
B6 |
B3 |
|
Settlement tampering |
B4 |
B8 |
|
Data and surveillance tampering |
B4 |
B7 |
|
Weak detection |
B7 |
B8 |
|
Deepfake and AI fraud |
B10 |
B11 |
|
Mule accounts |
B7 |
B4 |
|
Recovery failure |
B10 |
B1 |
“Primary” and “supporting” indicate suggested combinations, not guaranteed mitigation or complete coverage.
9. Delivery methodology and deliverables
Figure 7: The Codec Networks delivery methodology.
Typical deliverables include a CSCRF categorisation and gap matrix, CERT-In empanelled cyber audit and VAPT reports, closure and revalidation reports, SOC efficacy metrics, a cloud framework assessment, Cyber Capability Index support and an evidence pack for SEBI and MIIs.
10. Why Codec Networks
- CERT-In empanelled for information security auditing services, and empanelled with NICSI for application audit and compliance services (start-up category).
- Certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018.
- Full stack: VAPT, regulatory audit, managed SOC, forensics, privacy and Board advisory from one partner, so findings, monitoring and closure stay connected.
- Capital markets depth: CSCRF audits, trading app, API, algo, OMS/RMS and back-office testing for exchanges, depositories, brokers and intermediaries.
- Recognised frameworks and tools: OWASP ASVS/MASVS and API Top 10, MITRE ATT&CK, NIST CSF, ISO 27001 and PCI DSS; tools such as Burp Suite, Nessus, Metasploit, Prowler and leading SIEM/EDR platforms.
- Certified people: CEH, OSCP, CPENT, CISA, ISO 27001 LA/LI, CHFI, CTIA and ECIH professionals.
Annex: Indicative commercial ranges
For internal sales reference only—remove this annex before sharing externally. Ranges are taken from the Codec Networks Bundled Service Models and are subject to scoping, asset counts, frequency and service levels.
|
Bundle |
Package examples and indicative ranges |
|
B1 VAPT Assurance |
Essential ₹1.5–5 lakh; Professional ₹5–15 lakh; Enterprise ₹15–40 lakh; Annual retainer ₹25 lakh–₹1.5 crore |
|
B2 AppSec & DevSecOps |
API Quick Check ₹2–6 lakh; AppSec Professional ₹8–20 lakh; DevSecOps Maturity ₹12–35 lakh; Secure SDLC retainer ₹3–15 lakh/month |
|
B3 Cloud & Zero Trust |
Cloud Essential ₹3–8 lakh; Professional ₹8–25 lakh; Enterprise ₹25–75 lakh; Continuous assurance ₹2–10 lakh/month |
|
B4 Regulatory Audit |
Gap review ₹5–15 lakh; Full regulatory audit ₹15–50 lakh; Multi-framework audit ₹30 lakh–₹1.25 crore; Annual retainer ₹3–20 lakh/month |
|
B5 GRC, ISO, SOC 2 |
ISO readiness ₹5–15 lakh; ISO implementation ₹15–45 lakh; SOC 2 readiness ₹15–60 lakh; GRC retainer ₹2–12 lakh/month |
|
B6 Privacy & DPDPA |
Quick assessment ₹3–10 lakh; Implementation ₹10–40 lakh; DPO-as-a-Service ₹2–8 lakh/month; Privacy retainer ₹3–15 lakh/month |
|
B7 Managed SOC |
Starter ₹2–5 lakh/month; Professional ₹5–15 lakh/month; Enterprise ₹15–50 lakh/month; co-managed per FTE/shift |
|
B8 Forensics & IR |
Triage ₹3–15 lakh; Full investigation ₹15–75 lakh; Ransomware response ₹25 lakh–₹1.5 crore; IR retainer ₹5–50 lakh/year |
|
B9 TPRM |
₹25,000–₹2 lakh per vendor; batch pricing for 50–500 vendors; retainer ₹3–25 lakh/month |
|
B10 Simulation & Tabletop |
Awareness ₹1–5 lakh; Phishing simulation ₹2–10 lakh; Tabletop ₹5–20 lakh; Cyber war-game ₹15–75 lakh; Annual retainer ₹10 lakh–₹1 crore/year |
|
B11 Emerging Tech |
AI/LLM risk review ₹5–25 lakh; Smart contract audit ₹5–50 lakh; Emerging tech retainer ₹5–25 lakh/month |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: Service scope, deliverables, monitoring coverage and service levels are confirmed during engagement scoping. Services support risk reduction and assurance but do not guarantee prevention of all cyber incidents or regulatory compliance. Regulatory references are summaries; confirm against the official instruments applicable to each entity.