Vulnerability Assessment and Penetration Testing (VAPT) is a critical component of cybersecurity compliance for portfolio managers. This article explains the VAPT requirements and frequency.
What is VAPT?
Definition
Vulnerability Assessment and Penetration Testing (VAPT) provides an in-depth evaluation of the security posture of the system through simulations of actual attacks on its systems and networks.
Purpose
VAPT aims to:
- Identify security vulnerabilities
- Assess the effectiveness of security controls
- Provide remediation recommendations
- Ensure compliance with regulatory requirements
VAPT Requirements for Portfolio Managers
Mandatory VAPT
Portfolio managers must conduct regular Vulnerability Assessment and Penetration Testing as part of their cybersecurity compliance.
Scope
VAPT should include:
- All critical IT assets
- Infrastructure components like servers, networking systems, security devices, load balancers
- Other IT systems pertaining to portfolio management activities
VAPT Cadence
The VAPT cadence for portfolio managers includes:
- At least once in a financial year for most portfolio managers
- For systems identified as "protected system" by NCIIPC, at least twice in a financial year
Engagement of VAPT Providers
Portfolio managers shall engage only Indian Computer Emergency Response Team (CERT-In) empanelled organizations for conducting VAPT.
Vulnerability Remediation
Immediate Remediation
Any gaps or vulnerabilities detected shall be remedied on an immediate basis.
Reporting
Compliance of closure of findings identified during VAPT shall be submitted within 3 months post submission of VAPT report.
Follow-up
The CSCRF also mandates clear timelines around VAPT reporting and follow-up.
Reporting Requirements
VAPT Report Submission
The final report on VAPT shall be submitted to SEBI after approval from the Technology Committee of the respective portfolio manager, within 1 month of completion of VAPT activity.
Quarterly Reports
Quarterly reports containing information on cyber-attacks, threats, cyber-incidents, and breaches shall be submitted to SEBI within 15 days from the quarter ended June, September, December and March.
Dedicated Email IDs
Reports shall be shared through dedicated email ids: vapt_reports@sebi.gov.in and cybersecurity_pms@sebi.gov.in.
Key Components
Vulnerability Scanning
Portfolio managers shall perform vulnerability scanning and conduct penetration testing prior to the commissioning of a new system which is a critical system or part of an existing critical system.
Hardening
Only hardened and vetted hardware/software should be deployed. During the hardening process, ensure default passwords are replaced and all unnecessary services are removed or disabled.
Patch Management
- Establish patch management procedures
- Identify, categorize and prioritize security patches
- Establish implementation timeframe for each category
- Perform rigorous testing before deployment
Consequences of Non-Compliance
Regulatory Action
Failure to conduct VAPT or remediate vulnerabilities can result in enforcement action by SEBI.
Security Risk
Unremediated vulnerabilities expose the portfolio manager to cyber attacks.
Expert Legal Guidance
Anuj Desai & Associates provides expert legal advisory services on VAPT compliance for portfolio managers. Our securities law experts help clients implement compliant VAPT processes, engage appropriate providers, and ensure regulatory compliance. Contact us for guidance on VAPT and other regulatory matters.