evidoria

← Back to browse

Good practice Imported

C-SAC — SEBI's AI-Enabled Cybersecurity Audit Compliance Platform for India's Market Infrastructure

India · Mumbai · See the India profile · See the Mumbai profile

Evidence: Observational / pre–post Top 83% 40/100 · Ask Evidence Copilot about this practice

SEBI's AI-enabled C-SAC platform analyses the mandatory cyber-audit reports regulated entities submit, producing comparative risk scores to focus supervisory attention. In FY2025-26 it processed reports from 8 market infrastructure institutions and 23 mutual funds.

8
Market infrastructure institutions covered (FY2025-26)
23
Mutual funds covered (FY2025-26)

Details

Promoter
Securities and Exchange Board of India (SEBI)
Period
2025–2026
Keywords
financial regulation, cybersecurity, capital markets supervision

Context

C-SAC (Cyber-Sec Audit Compliance) is an AI-enabled platform built by India's Securities and Exchange Board (SEBI) to automate analysis of the mandatory cyber-audit reports that regulated market entities must submit under India's Cybersecurity and Cyber Resilience Framework.

Objectives

Automate a previously labour-intensive manual review process and generate comparative risk scores to support SEBI's risk-based supervision.

Activities

The platform ingests cyber-audit reports filed through SEBI's SI Portal, flags compliance gaps and risk areas, and produces comparative risk scores across regulated entities.

Results

In FY2025-26 the platform processed reports from 8 market infrastructure institutions and 23 mutual funds — SEBI's first disclosed usage figures for the tool.

Conclusions

Coverage to date is small relative to the thousands of entities SEBI regulates, and neither SEBI nor independent reporting has published accuracy, false-positive rates, or an evaluation of whether the AI-generated scores changed supervisory outcomes; the scoring methodology itself remains undisclosed.

Implementation
Indicative cost
Medium (€50k–€500k)
Time to results
Short (< 1 year)
Staffing & skills
SEBI internal supervisory/technology team

Conditions for success

  • Consistent report submission by regulated entities via the SI Portal
  • Public disclosure of the risk-scoring methodology to build trust

Common failure modes

  • No published accuracy or false-positive rate
  • Coverage still limited relative to SEBI's full regulated universe

Commonly funded by

National / regional programmes

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Similar practices you may find useful