Zerodha cyber-security and the SEBI CSCRF framework for brokers

Sat, 20 Jun 2026 00:00:00 +0000

Zerodha is a SEBI-registered stock broker bound by the SEBI Cyber Security and Cyber Resilience Framework (CSCRF), issued by circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated 20 August 2024, which sets cyber-security obligations on regulated entities around five resilience goals: anticipate, withstand, contain, recover, and evolve. The broker’s own posture, an in-house security team, external consultants, and a bug bounty programme, operates inside that regulatory floor rather than in place of it.

This article separates the two layers that determine how secure a Zerodha account is. The first is the regulatory layer: what SEBI requires of every broker through the CSCRF and the two-factor login mandate. The second is the broker layer: what Zerodha does on top of the floor, and where the protections end. It also sets the realistic boundary, what a framework can and cannot guarantee, so an investor knows which risks the broker carries and which remain their own. For the steps an account holder controls, see how to secure your trading account ; for the record of reported incidents, see Zerodha hack and security incidents .

Cyber Resilience on WebNotes

Zerodha cyber-security and the SEBI CSCRF framework for brokers