Document text
NOTICE
Notice No.
20260514-27
Notice Date
14 May 2026
Category
Compliance
Segment
General
Department
DOSS
Subject
Submission of VAPT Report for the FY 2025-26
Attachments
Annexure1 ; Annexure2 ; Annexure3 ; Annexure4
To All Trading Members,
This is with reference to SEBI Circular No-SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated
August 20, 2024, on ‘Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated
Entities (REs) and subsequent clarification circulars dated December 31, 2024, March 28, 2025, April
30, 2025, August 28, 2025, and Frequently Asked Questions (FAQ) dated June 11, 2025 issued by
SEBI and Exchange circular Notice No. 20250926-63 dated 26th September, 2025 on ‘Clarifications
regarding VAPT timelines for FY 2025-26’.
As per point no 4.3.2 of the CSCRF circular dated August 20, 2024, REs/trading members shall plan
their VAPT activity at the beginning of each financial year. RE’s/trading members shall ensure that no
audit cycle shall be left unaudited (if any) due to the change in categorization. In all such cases, the
unaudited period shall be included in the current audit cycle.
For the implementation of CSCRF guidelines for VAPT audit by REs, following timelines have been
prescribed in consultation with SEBI, for the conduct & submission of VAPT Report for trading
members falling under Self-certification RE’s, Small-size RE’s, Mid-size RE’s and Qualified RE’s
(not categorized as QSB’s):
i)
Once in a Year - Financial Year (April 01, 2025 to March 31, 2026):
Yearly Submission
Due Date
Conduct of VAPT through Cert-in Auditor
June 30, 2026
Report shall be submitted after approval from respective IT Committee
July 31, 2026
Submission of ATR/Revalidation report through same Cert-in Auditor
providing closure status after approval from respective IT Committee
(If Applicable)
November 30,
2026
Note: VAPT activity shall be initiated by the REs after Financial Year (April 2025 – March 2026)
Further, there shall be no change in the timelines for the conduct & submission of VAPT report for
trading members categorised as QSBs and REs which have been identified as ‘Protected
systems’ and/or CII by NCIIPC. The submission timelines are as follows: -
ii)
Half-yearly period- October 01, 2025 – March 31, 2026 (applicable to QSBs & protected
REs)
VAPT for Half Yearly period ending March 31, 2026
Due Date
Conduct of VAPT through Cert-in Auditor and report shall be
submitted after approval from respective IT Committee
June 30, 2026
Submission of ATR/Revalidation report through same Cert-in Auditor
providing closure status after approval from respective IT Committee
(If Applicable)
September 30, 2026
The comprehensive scope of VAPT shall include all critical assets and infrastructure components
including (not limited to) Networking systems, Security devices, Servers, Databases, Applications,
Systems accessible through WAN, LAN as well as with public IP’s, websites, etc. The detailed scope
of VAPT and testing methodologies for conduct of VAPT activity (Half Yearly/Yearly) shall be in
accordance with Annexure – L of the SEBI CSCRF circular dated August 20, 2024, same is enclosed
as Annexure–1.
The updated formats of VAPT Audit report/Summary, Declaration from REs and Auditor, Assessment
Details in accordance with SEBI CSCRF has been enclosed as Annexure–2. Further as per SEBI
Circular no- SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2025/119 dated August 28, 2025- on Technical
Clarifications to CSCRF for SEBI Regulated Entities (REs), REs/trading members shall NOT submit
details of explicit vulnerabilities (detailed report) unless and otherwise asked for the details by
SEBI/Exchanges.
However, Trading Members/REs are required to maintain records of detailed VAPT report as per format
provided
in
Point
7
of
Annexure-
A
of
SEBI
circular
no.
SEBI/HO/ITD-
1/ITD_CSC_EXT/P/CIR/2024/113 dated August 20, 2024, and retain records of VAPT report along
with POCs for a minimum period of three years. The detailed report shall be required to submit by
REs/trading members as & when sought by SEBI/Exchanges.
For the conduct of VAPT and appointment of auditor/auditing organization, RE’s/Trading Members are
required to refer auditor selection norms provided in Annexure-3, which are in accordance with norms
specified in SEBI Cir no- SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated August 20, 2024.
Further, trading members and appointed auditor are requested to take note of SEBI Circular
No- HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 dated May 05, 2026, on “Advisory on
Emerging Advanced Artificial Intelligence (AI) Tools for Vulnerability Detection”.
Trading members are requested to take note of Annexure 1 of Exchange Circular No. 20260417-45
dated April 17, 2026, regarding actions for non-compliances observed in periodic submissions made
by Trading Members/REs related to submission of VAPT Report. The details of financial
disincentive(s)/ penalties/ disciplinary action(s) have been provided in Annexure-4.
The link for submission of VAPT audit reports/ Compliance related submissions shall be available
w.e.f. May 25, 2026.
All members are advised to take note of the above & bring the provisions of this circular to the notice
of the auditors and put in place adequate systems and procedures to ensure strict adherence to the
compliance requirements.
For and on behalf of BSE Ltd
Richa Gosh Dhananjay Mudgal
Deputy Vice President Asst. Vice President
Member Oversight Member Oversight
Enclosure:
Annexure 1 - Comprehensive scope of VAPT Audit Report
Annexure 2 - Formats of Declaration from RE/Auditor, VAPT Summary Audit report and
Assessment Details
Annexure 3 - Auditor selection norms
Annexure 4 – Actions for non-compliances observed in periodic submissions made by
Trading Members/REs related to submission of VAPT Report
In case of any clarifications, Members may contact our below offices:
Sr. No
Purpose
Contact No
Email ID
1.
VAPT Audit Process related
022-69158540
022-45720640
022-45720440
mscopr@bseindia.com
