VAPT Compliance in India: The Definitive Guide to RBI, SEBI, CERT-In, and DPDP Act Security Audits

# VAPT Compliance in India: The Definitive Guide to RBI, SEBI, CERT-In, and DPDP Act Security Audits

India’s rapid digital transformation has positioned it as one of the world's most dynamic digital economies, driven by the Unified Payments Interface (UPI), massive fintech innovation, expansive cloud-native banking, and hyper-connected public digital infrastructure. However, this hyper-connected ecosystem has also made Indian enterprises premier targets for sophisticated cyber threat actors, ransomware syndicates, and state-sponsored espionage groups.

In response, Indian regulatory authorities—including the Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI), the Insurance Regulatory and Development Authority of India (IRDAI), the Indian Computer Emergency Response Team (CERT-In), and the Ministry of Electronics and Information Technology (MeitY)—have enacted some of the most rigorous and prescriptive cybersecurity mandates in the world. Central to every Indian compliance framework is the requirement for regular, independent Vulnerability Assessment and Penetration Testing (VAPT).

Moreover, the enactment and enforcement of the Digital Personal Data Protection (DPDP) Act, 2023, with penalties reaching up to ₹250 crore ($30M USD) for failure to implement reasonable security safeguards to prevent personal data breaches, elevates VAPT from a periodic compliance check to a board-level fiduciary imperative.

This comprehensive technical and regulatory guide, produced by the Compliance and Security Consulting Practice at Parasym Syndicate, provides Indian enterprises, CISOs, compliance officers, and fintech architects with an authoritative operational roadmap for navigating RBI, SEBI, CERT-In, and DPDP Act VAPT requirements.

---

1. The Indian Regulatory Cybersecurity Landscape: A Unified Overview

Unlike jurisdictions where cybersecurity regulation is fragmented or largely guidance-based, India enforces strict, binding legal directions with aggressive reporting timelines and mandatory independent technical verification.

``` THE INDIAN CYBERSECURITY REGULATORY MATRIX +-------------------------------------------------------------------+ | NATIONAL CYBER DEFENSE & MANDATORY INCIDENT REPORTING | | - CERT-In Directions (April 2022) | | - Mandatory 6-hour incident reporting window | | - 180-day forensic log retention requirement | +-------------------------------------------------------------------+ | | v v +---------------------------+ +-------------------------------+ | BANKING & FINTECH (BFSI) | | CAPITAL MARKETS & BROKERS | | - RBI Master Directions | | - SEBI Cyber Security & Cyber | | - Cyber Security Framework| | Resilience Framework (CSCRF)| | - Semi-annual / Annual | | - Bi-annual comprehensive VAPT| | mandatory VAPT & audits | | - System Audit & SOC Audits | +---------------------------+ +-------------------------------+ | | +-----------------+-----------------+ | v +-------------------------------------------------------------------+ | STATUTORY DATA PRIVACY MANDATE (ALL ENTERPRISES) | | - Digital Personal Data Protection (DPDP) Act, 2023 | | - Mandatory "Reasonable Security Safeguards" | | - Fines up to ₹250 Crore for failing to prevent personal data loss | +-------------------------------------------------------------------+ ```

Key Regulatory Bodies and Applicability - **CERT-In (Indian Computer Emergency Response Team)**: Applicable to all corporate bodies, service providers, intermediaries, data centers, and cloud providers operating within Indian jurisdiction. - **RBI (Reserve Bank of India)**: Enforces binding cybersecurity master directions on Scheduled Commercial Banks, Non-Banking Financial Companies (NBFCs), Payment System Operators (PSOs), Prepaid Payment Instrument (PPI) issuers, and Urban Cooperative Banks. - **SEBI (Securities and Exchange Board of India)**: Regulates Stock Exchanges, Depositories, Clearing Corporations, Asset Management Companies (Mutual Funds), Stock Brokers, and Registered Intermediaries under the comprehensive Cyber Security and Cyber Resilience Framework (CSCRF). - **IRDAI (Insurance Regulatory and Development Authority of India)**: Mandates annual cyber security audits and biannual VAPT for insurance companies and web aggregators. - **Data Protection Board of India (DPBI)**: Governs enterprise enforcement under the DPDP Act 2023 across all Data Fiduciaries handling personal data of Indian citizens.

---

2. Reserve Bank of India (RBI) VAPT Requirements for Banks, NBFCs, and PSOs

The RBI has established several baseline cybersecurity frameworks that dictate explicit technical testing standards:

``` RBI VAPT COMPLIANCE CYCLE +-------------------------------------------------------------------+ | BASELINE SCOPING | | - Core Banking Solution (CBS) - Mobile Banking Apps (iOS/And)| | - Internet Banking Web Portals - Payment Gateways & APIs | | - ATM Switch & Card Infrastructure - Swift & Financial Messaging | +-------------------------------------------------------------------+ | v +-------------------------------------------------------------------+ | INDEPENDENT TECHNICAL EXECUTION (CERT-In Empaneled / Specialized) | | - Black-Box, Grey-Box & White-Box Testing | | - Source Code Review (SAST) for Internet-Facing Banking Apps | | - Active Directory & Internal Network Penetration Testing | +-------------------------------------------------------------------+ | v +-------------------------------------------------------------------+ | REMEDIATION & MANDATORY RE-TESTING | | - Zero Critical or High vulnerabilities permissible | | - Closure of Medium vulnerabilities within mandated SLAs (30 days)| | - Final Clean Closure Certificate signed by Lead Auditor | +-------------------------------------------------------------------+ | v +-------------------------------------------------------------------+ | BOARD AUDIT COMMITTEE (ITSC) & RBI SUBMISSION | | - Executive Summary submitted to IT Steering Committee (ITSC) | | - Cyber Security Audit Report filed with RBI Inspection Team | +-------------------------------------------------------------------+ ```

1. RBI Cyber Security Framework for Banks (2016 & Master Directions 2023) - **Mandatory Cadence**: Annual comprehensive VAPT of all critical information systems, with quarterly vulnerability scanning of internet-facing infrastructure. - **Scope**: Must encompass Core Banking Solutions (CBS), network switches, firewalls, payment gateways, mobile banking applications, APIs, Active Directory, and third-party SaaS integrations. - **Vendor Independence**: Testing must be conducted by independent third-party cybersecurity firms; internal blue teams alone cannot issue the required compliance sign-off. - **Source Code Auditing**: All web applications and mobile banking apps exposed to the public Internet must undergo mandatory static and dynamic code review before production deployment.

2. RBI Master Direction – Information Technology Governance, Risk, Controls and Assurance Practices (2023) - Elevates cyber risk governance to the **IT Strategy Committee of the Board (ITSC)**. - Enforces strict Third-Party Risk Management (TPRM): FinTech partners, cloud service providers, and outsourced software development vendors must submit independent VAPT reports prior to connecting to core banking APIs. - Mandates periodic **Red Teaming and Cyber Crisis Management Drills** simulating real-world nation-state threat campaigns.

---

3. SEBI Cyber Security and Cyber Resilience Framework (CSCRF)

In August 2024, SEBI consolidated and revolutionized its cybersecurity guidelines by issuing the Cyber Security and Cyber Resilience Framework (CSCRF) for all SEBI Regulated Entities (REs), superseding individual circulars and introducing a unified, threat-informed compliance structure.

Tiered Categorization under SEBI CSCRF SEBI categorizes regulated entities into distinct tiers based on market impact and asset size: 1. **Tier 1 (Market Infrastructure Institutions - MIIs)**: Stock Exchanges (NSE, BSE), Depositories (NSDL, CDSL), and Clearing Corporations. 2. **Tier 2 (Qualified REs)**: Large stock brokers, Asset Management Companies (AMCs) managing substantial AUM, Depository Participants. 3. **Tier 3 (Mid-size REs)**: Mid-tier stock brokers, Merchant Bankers, Registrars and Transfer Agents (RTAs). 4. **Tier 4 (Small REs)**: Small boutique brokerages and investment advisors.

Mandatory VAPT Rules Under SEBI CSCRF - **Bi-Annual Cadence for MIIs and Qualified REs**: VAPT must be performed at least **twice in a financial year** with a minimum interval of two months between audits. - **Mandatory CERT-In Empaneled Auditors**: The VAPT must be conducted exclusively by independent auditing firms empaneled by CERT-In. - **Vulnerability Remediation Timelines**: - **Critical vulnerabilities**: Must be remediated within **24 to 48 hours**. - **High vulnerabilities**: Must be remediated within **7 days**. - **Medium vulnerabilities**: Must be remediated within **30 days**. - **System Audit Integration**: The final VAPT report, along with the management's Action Taken Report (ATR) and Clean Re-Test Certificate, must be submitted to the Board and filed with SEBI alongside the annual System Audit report.

---

4. CERT-In Cyber Directions: The 6-Hour Reporting Mandate & Operational Controls

The directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the Information Technology Act, 2000, fundamentally altered the incident response timeline for Indian organizations.

``` CERT-In MANDATORY INCIDENT LIFECYCLE Incident Identified (Ransomware / Breach / Data Exfiltration / DDoS) | v +-----------------------------------------------------------------+ | 0 - 6 HOURS: MANDATORY NOTIFICATION TO CERT-In | | - Notice sent to incident@cert-in.org.in | | - Format: Incident reporting form with initial technical details| +-----------------------------------------------------------------+ | v +-----------------------------------------------------------------+ | FORENSIC LOG RETENTION & SYNCHRONIZATION REQUIREMENT | | - Maintain all ICT system logs securely within Indian | | jurisdiction for a rolling window of 180 DAYS | | - Synchronize all system clocks with NTP servers of National | | Physical Laboratory (NPL) or CERT-In NTP | +-----------------------------------------------------------------+ | v +-----------------------------------------------------------------+ | POST-INCIDENT REMEDIATION & ROOT CAUSE VAPT | | - Perform root-cause forensic penetration testing | | - Submit comprehensive post-incident analysis report | +-----------------------------------------------------------------+ ```

The 20 Mandatory Reportable Incident Types Organizations must report cybersecurity incidents within **6 hours** of detection, including: 1. Unauthorized access to IT systems/data. 2. Defacement of website or intrusion into a website. 3. Malicious code attacks (ransomware, spyware, trojans). 4. Attack on critical infrastructure (SCADA/ICS). 5. Identity theft, spoofing, and phishing attacks. 6. Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. 7. Attacks on Database, Mail, and DNS services. 8. Unauthorized access to sensitive customer financial or personal data.

The Role of VAPT in CERT-In Compliance Periodic VAPT provides organizations with the empirical evidence required to prove that reasonable security diligence was maintained prior to an incident. In the event of a regulatory inquiry following a breach, CERT-In and judicial authorities scrutinize past VAPT reports to evaluate whether the vulnerability exploited by the attacker was previously identified, neglected, or addressed in compliance with standard care.

---

5. The Digital Personal Data Protection (DPDP) Act, 2023: VAPT as Legal Defense

The passage of the DPDP Act 2023 represents a paradigm shift for corporate liability in India. Under Section 8(5) of the Act:

*"A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach."*

``` DPDP ACT 2023 COMPLIANCE & LIABILITY Absence of Independent VAPT & Unpatched CVEs | v Personal Data Breach Occurs | v Investigation by Data Protection Board of India (DPBI) | v Finding: Failure to take "Reasonable Security Safeguards" | v +-----------------------------------------+ | STATUTORY PENALTY: UP TO ₹250 CRORE | | ($30 MILLION USD) PER INCIDENT | +-----------------------------------------+ ```

How VAPT Establishes "Reasonable Security Safeguards" Under the DPDP Act, the definition of "reasonable security safeguards" is directly informed by industry best practices and international standards (ISO 27001, OWASP, NIST): 1. **API and Database Penetration Testing**: Personal data repositories and microservices exchanging PII must undergo rigorous VAPT to prevent BOLA/IDOR vulnerabilities that enable mass scraping. 2. **Third-Party Data Processor Audits**: Data Fiduciaries remain legally liable if their third-party cloud SaaS or IT vendor suffers a breach. Requiring independent VAPT certifications from all Data Processors is essential to insulate against vicarious liability. 3. **Defense Against Negligence Claims**: A documented, clean VAPT report issued by a reputable offensive security firm serves as critical admissible evidence before the Data Protection Board of India (DPBI) demonstrating that the organization did not act with gross negligence.

---

6. The Parasym Syndicate VAPT Methodology for Indian Enterprises

Parasym Syndicate delivers high-assurance, audit-ready VAPT services designed to exceed RBI, SEBI, and CERT-In requirements:

``` PARASYM SYNDICATE REGULATORY VAPT FRAMEWORK Phase 1: Scoping & Compliance Alignment - Mapping regulatory jurisdiction (RBI / SEBI CSCRF / CERT-In / DPDP) - Asset inventory validation (IPs, URLs, APIs, Mobile Apps, Cloud VPCs) - Formal Rules of Engagement (RoE) definition | v Phase 2: Comprehensive Offensive Execution - Automated vulnerability assessment & continuous asset discovery - In-depth manual penetration testing (OWASP Top 10, SANS Top 25) - Business logic flaw exploitation & privilege escalation testing - Source code analysis (SAST) for exposed financial applications | v Phase 3: Risk Scoring & Remediation Advisory - CVSS v3.1 / v4.0 scoring tailored to business context - Clear, reproducible proof-of-concept (PoC) exploit chains - Remediation guidance for engineering and DevOps teams | v Phase 4: Mandatory Re-Testing & Compliance Certification - Verification of patches across all Critical, High, and Medium findings - Issuance of formal Clean VAPT Certificate - Delivery of regulatory compliance documentation for RBI/SEBI auditors ```

Key Deliverables Provided - **Executive Summary for Board ITSC**: Formatted specifically for non-technical board members and audit committees, detailing risk posture and financial exposure. - **Detailed Technical Assessment Report**: Containing exact HTTP request/response sequences, curl commands, and remediation code snippets for engineering teams. - **Action Taken Report (ATR) Template**: Pre-formatted according to SEBI and RBI compliance submission guidelines. - **Clean VAPT Closure Certificate**: Signed by senior security consultants, certifying that all identified vulnerabilities have been remediated.

---

7. Comparative Analysis: Indian Regulatory VAPT Mandates

| Dimension | RBI Master Directions | SEBI CSCRF | CERT-In Directions | DPDP Act 2023 | | :--- | :--- | :--- | :--- | :--- | | Applicability | Banks, NBFCs, PSOs, FinTechs | MIIs, Stock Brokers, AMCs | All corporate entities in India | All Data Fiduciaries handling PII | | Testing Cadence | Annual (Comprehensive), Quarterly (Scans) | Bi-annual (MIIs / Qualified REs) | Periodic / Post-Incident | Continuous / Regular | | Auditor Requirement | Independent external cybersecurity firm | CERT-In Empaneled / Specialized firm | Qualified security auditor | Independent competent security auditor | | Incident Reporting | Immediate (within 2-6 hours to RBI) | Immediate (to SEBI & Stock Exchanges) | Mandatory within 6 hours | Prompt notification to DPBI & users | | Maximum Statutory Fines | Regulatory penalties, license restrictions | Trading suspension, monetary fines | Imprisonment up to 1 yr / statutory fines | Up to ₹250 Crore per incident |

---

8. Strategic Action Plan for Indian CISOs and IT Directors

To guarantee uninterrupted regulatory compliance and insulate your leadership from liability:

1. Conduct a Formal Asset Scoping Exercise: Ensure no shadow cloud subscriptions, staging environments, or subsidiary APIs are omitted from your VAPT scope.
2. Harmonize Audits Across Regulatory Frameworks: Engage an offensive security partner capable of executing unified assessments that satisfy RBI, SEBI, and CERT-In requirements concurrently.
3. Enforce Rapid Remediation Workflows: Align development sprints with regulatory remediation windows: Criticals in 24–48 hours, Highs in 7 days, Mediums in 30 days.
4. Partner with Elite Offensive Security Specialists: Choose auditors who perform deep manual business logic penetration testing, not merely automated vulnerability scanner re-branding.

---

Frequently Asked Questions (FAQ)

What is VAPT compliance in India? VAPT (Vulnerability Assessment and Penetration Testing) compliance in India refers to the mandatory requirement imposed by regulators like RBI, SEBI, IRDAI, and CERT-In for enterprises to undergo independent security assessments to identify, exploit, and remediate technical vulnerabilities across their IT infrastructure, web applications, mobile apps, and cloud networks.

What is the reporting timeline under the CERT-In April 2022 directions? Under CERT-In directions, all corporate entities and service providers must report cybersecurity incidents (such as ransomware, data breaches, website defacements, and unauthorized access) to CERT-In within **6 hours** of becoming aware of the incident.

What are the penalties under the DPDP Act 2023 for a data breach? Under the Digital Personal Data Protection (DPDP) Act 2023, the Data Protection Board of India (DPBI) can impose monetary penalties of up to **₹250 crore ($30 million USD)** on organizations that fail to implement "reasonable security safeguards" to prevent personal data breaches.

Does RBI allow internal teams to perform compliance VAPT? No. The RBI explicitly mandates that VAPT for regulatory compliance must be conducted by independent, external, and qualified third-party cybersecurity firms to ensure objective, uncompromised reporting.

---

*Ensure full compliance with RBI, SEBI, CERT-In, and DPDP Act mandates. Explore Parasym Syndicate's Regulatory VAPT & Compliance Practice or schedule an enterprise VAPT Assessment today.*

Related Briefings