01. India VAPT Regulatory Matrix
In India, technical security assurance is governed across national and sectoral levels. The table below compares the testing cadences and compliance triggers:
| Regulator | Governing Circular / Law | VAPT Frequency | Reporting Window |
|---|---|---|---|
| CERT-In | Directions u/s 70B & Audit Guidelines (July 2025) | Annual comprehensive cyber audit; continuous vulnerability management | Within 6 hours of incident detection |
| Reserve Bank of India (RBI) | Master Direction on IT Governance (Nov 2023) | VA every 6 months, PT every 12 months for critical/DMZ | Immediate escalation of critical flaws to senior IT committee |
| SEBI | Cybersecurity & Cyber Resilience Framework (CSCRF) | Half-yearly for Qualified Stock Brokers; yearly by entity category | Mandatory closure of all findings within 3 months |
| MeitY (DPBI) | DPDP Act 2023 & DPDP Rules 2025 | Annual audits for SDFs; pre-release technical validation | Without delay; detailed dossier within 72 hours |
02. CERT-In Directions & 6-Hour Reporting
Issued under section 70B(6) of the Information Technology Act, 2000, CERT-In's directions apply to all intermediaries, data centers, body corporates, and government agencies:
Strict 6-Hour Reporting Requirement
Entities must report cybersecurity incidents (including targeted scanning, compromised servers, web defacement, unauthorized access, and API data leaks) to CERT-In within 6 hours of noticing or being brought to knowledge of the incident.
180-Day Rolling Log Retention in India
System logs of all ICT systems, firewalls, API gateways, and web application servers must be securely retained within Indian jurisdiction for a rolling 180 days, synchronized with National Informatics Centre (NIC) NTP servers.
Under CERT-In's July 2025 Comprehensive Cyber Security Audit Policy Guidelines, auditors rating findings must report vulnerabilities using both CVSS and Exploit Prediction Scoring System (EPSS) metrics.
03. RBI Master Direction: 6-Month VA / 12-Month PT
The RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices establishes binding testing baselines for commercial banks, NBFCs (Top, Upper, and Middle layers), Payment Aggregators, and All-India Financial Institutions:
Prescribed Testing Frequencies
The direction mandates:
- Vulnerability Assessment (VA): Conducted at least once every six months for all critical systems and applications exposed to the Demilitarized Zone (DMZ).
- Penetration Testing (PT): Conducted at least once every 12 months for all critical and internet-facing systems.
- Lifecycle Security: Dynamic VA/PT must be conducted before and after initial production implementation and following every major application release.
- Functional Independence: Testing must be performed by appropriately qualified and functionally independent security experts.
04. SEBI CSCRF & 3-Month Remediation SLA
The Securities and Exchange Board of India (SEBI) issued its comprehensive Cybersecurity and Cyber Resilience Framework (CSCRF) on 20 August 2024, setting rigorous mandates for stock exchanges, clearing corporations, depositories, and market intermediaries:
3-Month Remediation SLA
All vulnerabilities discovered during VAPT—including vulnerabilities present in third-party vendor applications and partner APIs—must be remediated and closed within three months of report issuance.
Qualified Stock Brokers (QSB)
Qualified Stock Brokers must conduct comprehensive VAPT and cybersecurity audits on a half-yearly basis, submitting technical evidence directly to stock exchanges.
05. DPDP Act Convergence: Security Safeguards
With the Digital Personal Data Protection Act 2023 and DPDP Rules taking effect, Indian organizations face overlapping responsibilities:
Integrated Breach Response Architecture
If a web application vulnerability leads to customer data leakage, the incident triggers: (1) a 6-hour alert to CERT-In, (2) an immediate notice followed by a 72-hour detailed report to the DPBI under DPDP Rule 7, and (3) incident reporting to RBI or SEBI. Maintaining continuous automated penetration testing provides the proactive diligence needed to prevent breaches before they occur.
06. Building an Audit-Compliant VAPT Program
DMZ & Critical Asset Scoping
Catalog all internet-facing web portals, mobile banking APIs, and payment aggregator webhooks requiring six-monthly VA and annual PT.
Pre-Release Dynamic Pentesting
Embed autonomous penetration testing into CI/CD pipelines to validate that major releases introduce no zero-day flaws before go-live.
Exploit-Backed Delta Retesting
When engineering teams fix vulnerabilities, execute automated delta retests within 48 hours to confirm issue closure within SEBI's 3-month window.
07. How Infiltra Supports Indian VAPT Compliance
Continuous Pre-Release Testing
Test web applications and APIs on demand before production deployment, satisfying RBI and SEBI pre-implementation testing requirements.
Eliminate False Positives
Every vulnerability detected by Infiltra includes verified proof-of-concept execution evidence, ensuring engineering teams focus solely on real security flaws.
1-Click Delta Retesting
Easily track and retest remediations, generating verified proof of fix to meet SEBI's three-month vulnerability closure SLA.
Auditor-Ready Reporting
Export comprehensive CVSS-rated technical reports and executive summaries formatted for RBI inspectors and CERT-In empanelled auditors.
08. Frequently Asked Questions
Key answers on Indian VAPT regulatory mandates, CERT-In compliance, and RBI audit rules.
Mandate Overview
Is VAPT Mandatory in India?
Is VAPT Mandatory in India?
For regulated financial institutions, market intermediaries, and government suppliers, yes. The RBI mandates vulnerability assessments every 6 months and penetration tests every 12 months for critical/DMZ systems. SEBI mandates VAPT across market infrastructure entities, and CERT-In requires annual comprehensive cybersecurity audits.
Incident Reporting
How Quickly Must Cyber Incidents Be Reported in India?
How Quickly Must Cyber Incidents Be Reported in India?
Cybersecurity incidents must be formally reported to CERT-In within 6 hours of detection. Under the DPDP Rules, breaches involving personal data must also be reported to affected Data Principals and the Data Protection Board without delay, with a 72-hour formal dossier.
Auditor Qualifications
Who Can Perform VAPT for RBI-Regulated Entities?
Who Can Perform VAPT for RBI-Regulated Entities?
Under the RBI Master Direction, testing must be carried out by appropriately trained and functionally independent information security experts or auditors. If required by procurement contracts or statutory audit guidelines, testing must be conducted or validated by CERT-In empanelled auditors.
SEBI CSCRF
How Fast Must Vulnerabilities Be Fixed Under SEBI's CSCRF?
How Fast Must Vulnerabilities Be Fixed Under SEBI's CSCRF?
All vulnerabilities discovered during VAPT—including vulnerabilities in third-party vendor applications—must be remediated and validated within three months of the final VAPT report.