Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
ComplianceIndia SBOM Compliance
India · CERT-In · SEBI · RBI

India SBOM compliance

The one map to CERT-In, SEBI CSCRF and RBI software-supply-chain rules — who they cover, what they mandate, and the deadlines

India now has three overlapping software-supply-chain regimes, and which ones apply depends on who you are. CERT-In's Technical Guidelines make a Software Bill of Materials the baseline expectation for government, public-sector and software-export entities. SEBI's CSCRF mandates SBOM for its regulated entities (exchanges, brokers, AMCs). RBI's IT-governance and cyber-resilience directions push the same expectations into banks and NBFCs. On top of that sits CERT-In's mandatory 6-hour incident-reporting duty under Section 70B of the IT Act.

This page is the map: which framework applies to you, what each one actually requires, the deadlines that matter, and where they overlap so one SBOM programme can satisfy several. Each framework links to a deep-dive.

At a glance
3 regimesCERT-In · SEBI CSCRF · RBI
SBOMCommon baseline across all three
31 Aug 2025SEBI CSCRF go-live for most REs
6 hoursCERT-In incident-reporting window
CERT-In, SEBI CSCRF and RBI software-supply-chain and cyber-resilience frameworks
Why this matters

One supply-chain programme, three overlapping Indian mandates

The frameworks were written by different regulators for different sectors, but they converge on the same core demand: know what your software is made of, track its vulnerabilities, and be able to prove it. A machine-readable SBOM — increasingly a whole xBOM family (SBOM, CBOM, QBOM, AIBOM, HBOM) under CERT-In v2.0 — is the artefact that satisfies all three.

The practical win is consolidation: an SBOM programme built to CERT-In's minimum elements, with VEX/CSAF vulnerability status and reachability-based prioritisation, covers most of what SEBI CSCRF and RBI expect too. Build it once, map it to each regulator's control language, and you avoid running three parallel compliance efforts.

How O3 helps

Find it before attackers do. Catch it if they try. Fix it fast.

Across these requirements, O3 runs one continuous loop on your own software so issues surface, get caught, and get fixed before they become an incident.

1 · Find it first

Test like an AI-assisted attacker

An agentic pentest probes your app across 50+ vulnerability classes the way a real attacker chains them, so exploitable flaws surface in your build before someone outside finds them.

2 · Catch it live

Detect and block exploitation at runtime

A kernel-level eBPF agent watches process trees and syscalls, recognises an attack sequence as it unfolds, and restricts the offending process on the spot rather than taking down the host.

3 · Fix it fast

Auto-patch what is reachable

Reachability ranks what genuinely matters, then autofix opens a pull request with the change, so remediation starts inside tight fix windows instead of sitting in a queue.

Risk-based prioritisation

From alert flood to a short list

KEV + EPSS + reachability turn a raw scan into the few findings that actually need action now.

Raw findings in dependency tree~12,400
Vulnerable & version-matched~4,700
Reachable in your code~1,360
KEV / high-EPSS · act now~370

Illustrative funnel. Reachability removes the bulk of unexploitable noise before triage.

Who it covers

Which framework applies to you

Start here — the regime you must meet depends on your sector.

CERT-In v2.0SEBI CSCRF (Aug 2024)RBI IT Governance MD (Nov 2023)
Government, PSU, essential services, software exporters → CERT-In Technical Guidelines (SBOM/CBOM/QBOM/AIBOM/HBOM v2.0) and the mandatory Section 70B incident-reporting duty.
SEBI-regulated entities (stock exchanges, depositories, brokers, mutual funds/AMCs, etc.) → SEBI CSCRF, which carries a field-level SBOM mandate and VAPT via CERT-In-empanelled auditors.
Banks and NBFCs → RBI's IT Governance Master Direction and Cyber Security Framework — secure SDLC, third-party/supply-chain risk, VAPT and incident reporting.
Almost everyone operating in India → CERT-In's 6-hour incident-reporting obligation applies regardless of sector.
Where O3 helps

O3 produces the SBOM (and CBOM/AIBOM) once, tracks reachable vulnerabilities against it, and maps the same evidence to each regulator's controls — so one programme answers CERT-In, SEBI and RBI.

What they mandate

The shared core: SBOM, VEX, VAPT

Different words, same substance. These three demands recur across all the Indian frameworks.

CERT-In SBOM Guidelines v2.0 (Table 5, §6)
A machine-readable SBOM to CERT-In's minimum elements (Table 5): component names, versions, suppliers, hashes, licences and relationships — in CycloneDX or SPDX.
Vulnerability status communicated via VEX and CSAF (CERT-In §6), not raw scanner dumps — so consumers know which listed CVEs actually affect the product.
VAPT / security testing, in SEBI's case via CERT-In-empanelled auditors, plus secure-SDLC and third-party-risk controls under RBI.
Where O3 helps

O3's reachability analysis converts a raw SBOM into a prioritised, VEX-ready view — which CVEs are actually reachable in your code — which is exactly the signal these frameworks want and scanners can't give.

Deadlines

The dates that matter

Compliance is time-boxed. Track the go-live dates per regime.

SEBI CSCRF timelinesRBI notified dates
CERT-In Directions (incident reporting): in force since 27 June 2022 — already live.
SEBI CSCRF: circular issued August 2024; go-live for most regulated entities from 31 August 2025 (phased for some categories).
RBI: the IT Governance, Risk, Controls and Assurance Master Direction (Nov 2023) and the Cyber Security Framework apply on their notified timelines to banks/NBFCs.
CERT-In SBOM Guidelines v2.0: published 09 July 2025 — the reference standard for the xBOM family.
Where O3 helps

O3 gives you a continuously-current SBOM + vulnerability posture, so you can produce evidence on the regulator's timeline instead of scrambling before an audit.

The whole framework

The three regimes, side by side

All 7 requirement areas, each with the reference and a vendor-neutral note on how teams meet it.

4CERT-In
CERT-In Guidelines + 70B
3SEBI
SEBI CSCRF
3RBI
RBI IT Governance + Cyber
3Shared
SBOM · VEX · VAPT
Requirement area
SBOM mandateCERT-In v2.0 · SEBI CSCRF · RBIMachine-readable inventory of software components; CERT-In defines the minimum elements.
Extended xBOMCERT-In v2.0CBOM (crypto), QBOM (quantum readiness), AIBOM (AI), HBOM (hardware) beyond the classic SBOM.
Vulnerability statusCERT-In §6Communicate via VEX and CSAF, not raw scan output.
VAPT / security testingSEBI CSCRF · RBISEBI: via CERT-In-empanelled auditors. RBI: secure SDLC + VAPT.
Incident reportingCERT-In Sec 70BReport listed incidents within 6 hours of noticing; 180-day log retention.
Third-party / supply-chain riskRBI · SEBIAssess and monitor suppliers and outsourced software.
Applicabilitysector-specificGov/PSU/exporters → CERT-In; SEBI REs → CSCRF; banks/NBFCs → RBI; all → 70B reporting.

Run one SBOM programme, satisfy all three

O3 generates the SBOM/CBOM/AIBOM, ranks vulnerabilities by real reachability, keeps a VEX-ready status, and maps the evidence to CERT-In, SEBI and RBI controls — so India compliance is one workflow, not three.

Frameworks are linked individually below
FAQ

Common
questions.

Everything teams ask before rolling this out. Still stuck? Reach our team.

  • Yes, depending on your sector. CERT-In's Technical Guidelines make a Software Bill of Materials the baseline expectation for government, public-sector and software-export entities; SEBI's CSCRF mandates SBOM for its regulated entities; and RBI's directions drive the same expectations into banks and NBFCs. A single SBOM programme built to CERT-In's minimum elements can satisfy all three.
  • Three main ones: CERT-In's Technical Guidelines on SBOM/CBOM/QBOM/AIBOM/HBOM (v2.0, July 2025), SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF, 2024), and RBI's IT Governance Master Direction and Cyber Security Framework for banks and NBFCs.
  • CERT-In sets the technical standard (what an SBOM must contain and the wider xBOM family). SEBI CSCRF applies that to securities-market entities with a field-level SBOM mandate and CERT-In-empanelled VAPT. RBI applies equivalent expectations to banks and NBFCs through secure-SDLC and supply-chain-risk controls. They overlap heavily, so one programme can cover several.
  • CERT-In's incident-reporting Directions have been in force since June 2022. SEBI CSCRF goes live for most regulated entities from 31 August 2025. RBI's directions apply on their notified timelines. CERT-In's SBOM Guidelines v2.0 were published on 09 July 2025.
  • Largely, yes. Build the SBOM to CERT-In's minimum elements with VEX/CSAF vulnerability status and reachability-based prioritisation, then map that same evidence to SEBI's and RBI's control language. The core demand — a machine-readable component inventory with tracked, prioritised vulnerabilities — is common to all three.

See O3 Security in Action

See why security and engineering leaders trust O3
to secure their entire software supply chain.