On Aug. 3, 2026, IND NSD extended submission deadline for the VAPT half-yearly audit report and annual audit ATR to Oct. 31, 2026 and Nov. 30, 2026 respectively.
The timelines for submission of the ATR shall stand modified in accordance with the provisions of the CSCRF.
Document dated Aug. 3, 2026, received from IND NSD Aug. 11, summarized on Aug. 12.
IND BSE issued clarifications to cybersecurity and cyber resilience framework (CSCRF) for IND SEBI regulated entities (REs), in order to facilitate the CSCRF implementation.
Follows IND SEBI Jul. 2023 consulted on cyber resilience framework, see #178322.
Clarifications
For determining the number of registered clients as provided in IND SEBI's circular dated Apr. 30, 2025, clients reported as active and inactive based on unique PAN shall be counted, excluding clients reported as closed by stockbrokers/trading members.
Where trading members/REs are engaged in clientele and proprietary trading and the clientele trading turnover is less than 10% of their proprietary trading turnover on Apr. 1-Mar. 31, they shall be categorized as proprietary stockbrokers/trading members.
Sep. 2025 IND NSD Report Submission
On Sep. 15, 2025, IND NSD issued circular to implement SEBI’s CSCRF requirements for submission of vulnerability assessment and penetration testing (VAPT) audit reports.
Requiring participants to plan audits at the start of each financial year and cover any unaudited periods in the current cycle.
For non-qualified stock brokers (QSBs), VAPT must be conducted by Jun. 30, the report submitted by Jul. 31, and the action taken report (ATR) must be submitted by Nov. 30.
For QSBs, first half-year VAPT deadlines remain Jun. 30 for report submission and Sep. 30 for ATR, and second half-year deadlines remain Dec. 31 for report submission and Mar. 31 for ATR.
Open vulnerabilities must be approved by the IT Committee within three months and closed before the next VAPT cycle.
The VAPT scope must cover all critical assets, including networks, servers, databases, applications, cloud deployments, and security devices.
New report formats are provided, and further submission guidelines will follow.
These timelines apply from FY ending Mar. 31, 2026.
For non-QSBs, the FY 2025–26 VAPT must be conducted between Apr. and Jun. 2026, with reports submitted per the above timelines.
Sep. 26, 2025 IND BSE VAPT Submission
On Sep. 26, 2025, IND BSE issued notice re VAPT timelines for FY 2025-26.
VAPT scope covers all critical IT assets, networks, and applications.
Trading members/REs must retain detailed VAPT reports and proofs of concept (POCs) for three years, in the format specified in annexure-A of the 2024 circular.
Auditor appointment must follow SEBI’s auditor selection norms; guidelines for online portal submission will be issued separately.
Document dated Sep. 26, 2025, received from IND BSE Sep. 30, summarized Oct. 3.
May 2026 IND NSD e-PASS VAPT Submission
On May 12, 2026, IND NSD informed participants that VAPT reports can now be submitted online via the e-PASS portal; instructions on using the portal are included.
Participants must fix all vulnerabilities identified in the initial VAPT report, conduct a revalidation assessment, and submit closure compliance within three months after submitting the initial VAPT report.
For QSBs with protected systems and/or CII by NCIIPC, the half-yearly VAPT audit report for Oct. 2025 to Mar. 2026 is due by Jun. 30, with any ATR due by Sep. 30.
For non-QSBs, the annual VAPT audit report for Apr. 2025 to Mar. 2026 is due by Jul. 31, with any ATR due by Oct. 31.
Failure to submit the cyber security audit report on time will constitute regulatory non-compliance and may lead to penalties or further action.
May 2026 VAPT Submission
On May 14, 2026, IND BSE outlined timeline of VAPT submission for trading members.
Specifies the timeline for annual submission covering the period from Apr. 1, 2025 to Mar. 31, 2026 for trading members.
Plus semi-annual submission covering the period from Oct. 1, 2025 to Mar. 31, 2026.
The scope of VAPT and testing methodologies for conduct of VAPT activity-annexure 1.
Updated formats of VAPT audit report/summary, declaration from REs and auditor, assessment details can be found in annexure 2.
Auditor selection norms provided in annexure 3; details of financial disincentive(s)/penalties/disciplinary action(s) provided in annexure 4.
The link for submission of VAPT audit reports/compliance related submissions shall be available with effective from May 25, 2026.
Document dated May 14, 2026, was received on May 19 due to a fixed feed.
Jun. 2026 User Manuals
On Jun. 19, 2026, IND BSE issued a user manual for members and auditors to ensure ease of use and better understanding of the VAPT audit module.
Reminded that submission of VAPT for half yearly period ending Mar. 31, 2026 and yearly submission for conduct of VAPT through CERT-In empanelled auditor are due Jun. 30, 2026.
Document dated Jun. 19, 2026, received from IND BSE Jun. 22, summarized Jun. 24.
Jul. 2026 VAPT Report Submission Reminder
On Jul. 27, 2026, IND BSE reminded re submission of VAPT report applicable to self-certification, small-size, mid-size, and qualified REs.
Reports shall be submitted after approval from their respective IT Committee, on Jul. 31, 2026.
Members who are also registered with IND NSE shall submit their VAPT audit report to IND NSE only; non-members shall continue to make submissions per existing process.
IND BSE stresses the report has to be submitted digitally on or before the due date to avoid any penal or disciplinary action.
Aug. 2026 IND NSD Extended Reporting Deadlines
On Aug. 3, 2026, IND NSD extended submission deadline for the VAPT half-yearly audit report and annual audit ATR to Oct. 31, 2026 and Nov. 30, 2026 respectively.
The timelines for submission of the ATR shall stand modified in accordance with the provisions of the CSCRF.
Document dated Aug. 3, 2026, received from IND NSD Aug. 11, summarized on Aug. 12.
Regulators
IND BSE; IND NSD
Entity Types
B/D; Corp; Exch; Inv Co
Reference
Cir NSDL/POLICY/2026/0111, 8/3/2026; Nt 20260727-13, 7/27/2026; Nt 20260619-36, 6/19/2026; Nt 20260514-27, 5/14/2026; Cir NSDL/POLICY/2026/0075, 5/12/2026; Nt 20250926-63, 9/26/2025; Cir NSDL/POLICY/2025/0121, 9/15/2025; Nt 20250902-2, 20250902-3, 20250902-4, 9/2/2025;
