iy3r
SEBI's CSCRF mandates cybersecurity compliance for every regulated entity in India's securities market.
Core trick
Extracts the SEBI CSCRF into YAML-frontmatter Markdown so Claude Code skills can run gap analysis and generate policies.
Description
SEBI's CSCRF mandates cybersecurity compliance for every regulated entity in India's securities market. The framework spans seven functions across 200+ pages of standards and guidelines. Compliance typically requires expensive consultants and months of manual work.
I built a complete compliance-as-code platform using Claude Code.
The entire CSCRF is extracted verbatim into structured Markdown with YAML frontmatter—every standard, guideline, and applicability rule preserved exactly. 3 Claude Code skills (/ciso, /ciso-policy, /ciso-assess) orchestrate five specialist agents delivering a full compliance lifecycle: entity profiling, gap analysis, policy generation with regulatory traceability, and a 90-day remediation roadmap.
The system is context-efficient, quality-gated, and deterministic. A validation suite ensures correctness. What once took months and tens of thousands of dollars now takes a single conversation.
README excerpt
# CSCRF — Structured Extraction A clean, machine-readable representation of SEBI's [Cybersecurity and Cyber Resilience Framework (CSCRF)](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) v1.0 for Regulated Entities (REs) in the Indian securities market. Every objective, standard, and guideline from the framework is extracted verbatim into structured Markdown files with YAML frontmatter — making the entire framework parseable, queryable, and composable. ## Why CSCRF is published as a PDF. That makes it hard to search, filter, or build tooling on top of. This repo fixes that by turning the framework into structured data you can work with programmatically: - **Compliance-as-code** — filter guidelines by RE type, mandatory status, or standard code with a YAML parser - **Policy authoring** — reference specific guidelines from Typst, LaTeX, or any document toolchain - **RAG / LLM retrieval** — each file is a self-contained unit sized for embedding and retrieval - **Audit preparation** — trace guidelines back to standards and vice versa ## Repository Structure ``` cscrf/ ├── SCHEMA.md # Canonical schema — start here for all conventions ├── pyproject.toml # Python deps (pyyaml) + optional eval deps (anthropic) ├── framework/ │ ├── governance/ # GV.OC, GV.OV, GV.PO, GV.RM, GV.RR, GV.SC │ ├── identify/ # ID.AM, ID.RA │ ├── protect/