Sebi has imposed a Rs 1 crore penalty on CDSL for cybersecurity failures that enabled a 2022 malware attack, disrupting depository operations and market settlements. The regulator cited inadequate protection of critical systems, weak access controls and poor security monitoring despite prescribed cybersecurity requirements.