Description
BSE prescribes VAPT audit submission timelines for FY 2025-26 under SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), with deadlines varying by trading member category.
Summary
BSE has issued detailed timelines for the conduct and submission of Vulnerability Assessment and Penetration Testing (VAPT) reports for FY 2025-26, in compliance with SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF) circular dated August 20, 2024. Deadlines differ based on the categorization of trading members — standard REs submit yearly while QSBs and protected systems follow a half-yearly schedule.
Key Points
- Applicable to all trading members under SEBI’s CSCRF framework
- VAPT must be conducted through CERT-In empanelled auditors
- Two submission tracks: yearly (for Self-certification, Small, Mid, and Qualified REs not classified as QSBs) and half-yearly (for QSBs and REs identified as ‘Protected Systems’ or CII by NCIIPC)
- VAPT activity for yearly filers shall be initiated after the financial year ends (post March 2026)
- Trading members must NOT submit detailed vulnerability reports unless specifically requested by SEBI/Exchanges
- Detailed VAPT records must be maintained internally as per prescribed format
- Scope covers all critical assets: networking systems, security devices, servers, databases, applications, WAN/LAN-accessible systems, public IP systems, and websites
Regulatory Changes
This circular consolidates and clarifies VAPT timelines pursuant to multiple SEBI clarification circulars:
- SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated August 20, 2024 (original CSCRF framework)
- Subsequent clarification circulars dated December 31, 2024; March 28, 2025; April 30, 2025; August 28, 2025
- SEBI FAQ dated June 11, 2025
- BSE Exchange Circular Notice No. 20250926-63 dated September 26, 2025
- SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/119 dated August 28, 2025 (Technical Clarifications to CSCRF)
Key change: Trading members are explicitly prohibited from submitting detailed vulnerability reports unless asked by SEBI/Exchanges.
Compliance Requirements
For Self-certification REs, Small-size REs, Mid-size REs, and Qualified REs (not QSBs):
- Conduct VAPT through a CERT-In empanelled auditor covering FY April 1, 2025 – March 31, 2026
- Submit report post IT Committee approval
- If applicable, submit ATR/Revalidation report via the same auditor with closure status after IT Committee approval
For QSBs and REs identified as Protected Systems/CII by NCIIPC:
- Conduct VAPT through CERT-In auditor for the half-yearly period October 1, 2025 – March 31, 2026
- Submit report post IT Committee approval
- If applicable, submit ATR/Revalidation report
All Trading Members:
- Maintain detailed VAPT records internally in prescribed SEBI format
- Do not submit detailed vulnerability data unless specifically requested
- Ensure no audit cycle is left unaudited due to category changes; unaudited periods must be included in the current cycle
Important Dates
Yearly Track (Self-certification, Small, Mid, Qualified REs not QSBs):
| Milestone | Due Date |
|---|---|
| Conduct VAPT through CERT-In Auditor | June 30, 2026 |
| Submit report after IT Committee approval | July 31, 2026 |
| Submit ATR/Revalidation report (if applicable) | November 30, 2026 |
Half-Yearly Track (QSBs and Protected Systems/CII — period Oct 1, 2025 – Mar 31, 2026):
| Milestone | Due Date |
|---|---|
| Conduct VAPT and submit report after IT Committee approval | June 30, 2026 |
| Submit ATR/Revalidation report (if applicable) | September 30, 2026 |
Impact Assessment
This circular has a medium operational impact on all BSE trading members. Compliance is mandatory under the SEBI CSCRF framework, and failure to meet deadlines may attract regulatory scrutiny or penalties. The requirement to route all VAPT activity through CERT-In empanelled auditors and obtain IT Committee sign-off adds internal governance overhead. The explicit prohibition on submitting detailed vulnerability reports reduces disclosure risk for firms. Larger firms categorized as QSBs or Protected Systems face tighter half-yearly cycles and must already be in the process of completing their H2 FY2025-26 VAPT ahead of the June 30, 2026 deadline.
Impact Justification
Mandatory compliance requirement affecting all BSE trading members with specific deadlines, but no immediate market or price impact. Non-compliance could lead to regulatory action.