INDUSTRY FACT FILE · ASSET MANAGEMENT

Cybersecurity FAQs for Asset and Investment Managers

Forty frequently asked questions and answers in five categories, written for Boards, trustees, CXOs, CISOs, investment, operations and compliance teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: SEBI CSCRF, system audits and compliance 3.  Category 3: Investor journeys, apps and data 4.  Category 4: Fund operations, insider risk and resilience 5.  Category 5: Third parties, cloud and emerging technology

Audience: Boards, trustees, CEOs, CIOs and CISOs

Q1. Why is cybersecurity critical for asset managers?

Asset managers handle investors' savings and personal data and rely on many partners. Incidents can cause investor losses, incorrect NAVs, regulatory action and loss of trust. SEBI's CSCRF makes cyber resilience a graded, Board-overseen obligation.

Q2. What are the biggest cyber risks for asset managers?

Redemption and bank-mandate fraud, investor account takeover, front-running and order leakage, ransomware at AMCs and service providers, phishing and BEC, investor data leakage, RTA and vendor compromise, pricing data tampering and impersonation scams.

Q3. What role do trustees play?

Trustees oversee AMCs on behalf of unitholders and expect assurance on technology and cyber risk, including significant incidents, audit findings and remediation progress.

Q4. How should cyber risk be reported to the Board and trustees?

Report CSCRF and system audit status, open findings and closure, incidents and root causes, SOC performance, third-party risks, fraud trends and recovery-test results.

Q5. Do small PMS and AIF managers need to worry about cybersecurity?

Yes. Smaller managers are often targeted by BEC and impersonation, and CSCRF applies baseline requirements to smaller categories, including Market SOC onboarding unless they run their own SOC.

Q6. How should groups with several SEBI registrations approach compliance?

Map all registrations together; an entity registered in multiple capacities generally follows the highest applicable CSCRF category.

Q7. How much should a manager invest in cybersecurity?

Meet mandated audits, VAPT and SOC requirements first, then invest in investor-journey controls, insider monitoring and third-party assurance in proportion to size and risk.

Q8. How can Codec Networks help?

Codec Networks provides CSCRF assessments, CERT-In empanelled cyber audits and VAPT, MF system audits, investor app and API testing, insider controls reviews, third-party assessments, privacy programmes, BCP/DR reviews and managed SOC.

Audience: Compliance officers, CISOs and internal audit

Q9. Does CSCRF apply to AMCs, PMs and AIF managers?

Yes. SEBI's CSCRF (20 August 2024) applies to specified regulated entities including AMCs, portfolio managers and AIF managers, graded into categories; compliance for these entities was due by 31 August 2025.

Q10. How are AMCs categorised under CSCRF?

AMCs are categorised by assets under management into Qualified, Mid-size or Small-size REs; portfolio managers and AIF managers have their own thresholds. SEBI revised thresholds in April 2025.

Q11. Who can perform CSCRF cyber audits and VAPT?

CERT-In empanelled IS auditing organisations. Codec Networks is CERT-In empanelled.

Q12. How quickly must incidents be reported to SEBI?

Within six hours of detection under CSCRF, with follow-up reporting and root-cause analysis. CERT-In's six-hour requirement applies in parallel.

Q13. Do mutual fund system audits still apply?

Yes. SEBI's system audit framework for mutual funds and AMCs (2019) continues to require periodic audits of systems and processes, alongside CSCRF.

Q14. What does SEBI expect when using cloud services?

SEBI's framework for adoption of cloud services (6 March 2023) sets expectations on governance, shared responsibility, data security, vendor risk and exit readiness.

Q15. How do investment advisers fit in?

Investment advisers and research analysts are SEBI regulated; they should confirm how CSCRF applies to them and, at minimum, meet CERT-In and DPDP obligations and protect client data.

Q16. What evidence should managers keep?

Policies, audit and VAPT reports, closure and revalidation evidence, SOC reports, incident records, vendor assessments and Board and trustee reviews.

Audience: Operations, investor services, digital and product teams

Q17. How do fraudsters steal redemptions?

By changing an investor's contact details or bank mandate—often after a SIM swap—and then redeeming. Controls must make these changes hard to abuse.

Q18. What controls stop redemption fraud?

Cooling periods after contact or bank changes, alerts to old and new channels, step-up verification for high-value redemptions, SIM-change signals and joint AMC–RTA monitoring.

Q19. What should investor app testing cover?

Authentication, device binding, session management, transaction and bank-change flows, data storage, communication security and backend APIs.

Q20. How should distributor and platform APIs be secured?

Strong authentication, object-level authorisation, data minimisation, rate limiting, monitoring and regular testing, with security terms in partner agreements.

Q21. Where does investor data live?

Across AMCs, RTAs, KRAs, distributors, platforms, call centres and fund accountants. Data mapping must cover all of them.

Q22. When do DPDP obligations apply?

The DPDP Rules, 2025 were notified on 13 November 2025 with phased commencement; most data-fiduciary obligations, including safeguards and breach intimation, take effect in May 2027.

Q23. How should we fight impersonation scams?

Monitor social media and app stores, take down fakes quickly, publish official channels and educate investors.

Q24. Do deepfakes really threaten fund houses?

Yes. Deepfake videos of well-known fund managers have been used to promote fraudulent schemes; brand monitoring, takedowns and investor education are essential.

Audience: CIOs, dealing, fund accounting and operations teams

Q25. How can AMCs prevent front-running?

Control dealing rooms (recorded lines, device restrictions), deploy DLP on dealing and research systems, monitor access and surveil employee and associate trading.

Q26. How should pricing and NAV data be protected?

Authenticate and validate pricing feeds, apply tolerance checks, log and approve overrides, and assess pricing and fund accounting vendors.

Q27. Do managers need a SOC?

Larger categories need a 24x7 SOC under CSCRF; smaller REs onboard to the Market SOC unless they run their own. Managed SOC services make coverage practical.

Q28. What should incident response plans include?

Classification, roles, escalation, containment, recovery, evidence preservation, communication with investors, trustees and regulators, and 6-hour SEBI and CERT-In reporting.

Q29. How long must logs be retained?

CERT-In requires ICT logs for a rolling 180 days within India; CSCRF expects strong log retention aligned with applicable guidelines.

Q30. How should managers prepare for ransomware?

Segment critical systems, keep isolated and tested backups, monitor endpoints 24x7, test recovery and rehearse the response and reporting process.

Q31. How often should BCP and DR be tested?

Regularly and realistically, against defined recovery objectives, including scenarios involving key service providers.

Q32. When should forensic experts be engaged?

As soon as a material incident, fraud or insider case is suspected, to preserve evidence and support reporting.

Audience: Vendor management, technology and innovation teams

Q33. How should RTAs and other providers be assessed?

Classify providers by criticality, assess security before onboarding and periodically, include security, incident-notification and audit clauses, and review their audit reports.

Q34. What about distributors and platforms?

Assess their integrations and data handling, minimise data shared and include security obligations in agreements.

Q35. Can managers use public cloud?

Yes, in line with SEBI's cloud framework, with governance, data security, vendor risk management and exit readiness.

Q36. What cloud mistakes are most common?

Public storage, excessive permissions, missing encryption and incomplete logging.

Q37. How should AIF managers protect deal data?

Use secure data rooms, strong email security against BEC, verification for capital-call and payment instructions and least-privilege access.

Q38. What risks come with AI tools?

Leakage of confidential or personal data, prompt-injection attacks and unreliable outputs; AI tools should be governed and tested.

Q39. Should managers adopt ISO 27001?

Not mandated for most managers, but it provides a strong governance framework and helps meet institutional investor due diligence.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your registrations, CSCRF category, systems, service providers and audit calendar; Codec Networks will propose a gap assessment, audit and testing plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Requirements depend on each entity's registrations and CSCRF category; confirm obligations against SEBI's current circulars.