Skip to content
Anuj Desai & Associates logo
Funds

Vulnerability Assessment & Penetration Testing (VAPT) Cadence for Stock Brokers

SEBI requires stock brokers to conduct Vulnerability Assessment and Penetration Testing at least once in a financial year, engaging only CERT-In empaneled organisations. This article explains the VAPT cadence, the requirements, and the submission process.

23 Jul 20263 min read

Vulnerability Assessment & Penetration Testing (VAPT) Cadence for Stock Brokers

SEBI requires stock brokers to conduct Vulnerability Assessment and Penetration Testing at least once in a financial year, engaging only CERT-In empaneled organisations. VAPT helps detect security vulnerabilities in the IT environment and provides an in-depth evaluation of the security posture of the system through simulations of actual attacks. This article explains the VAPT cadence, the requirements, and the submission process.

The Regulatory Basis

The VAPT requirements for stock brokers are specified in SEBI Circular SEBI/HO/MIRSD/CIR/PB/2018/147 dated December 3, 2018 (as amended by SEBI Circular SEBI/HO/MIRSD/TPD/P/CIR/2022/80 dated June 7, 2022). The cybersecurity and cyber resilience framework mandates periodic VAPT to detect security vulnerabilities and evaluate the security posture of the system.

VAPT Cadence

Minimum Frequency

Stock Brokers shall conduct VAPT at least once in a financial year.

Additional VAPT Requirements

In addition to the annual VAPT, Stock Brokers shall perform:

  • Vulnerability scanning and conduct penetration testing prior to the commissioning of a new system which is a critical system or part of an existing critical system.

QSBs (Qualified Stock Brokers)

QSBs shall carry out continuous assessment of the threat landscape faced by them and on half-yearly basis, conduct vulnerability assessment to detect security vulnerabilities in their IT environments exposed to internet. QSBs shall also carry out penetration tests on half-yearly basis.

Auditor Qualification

All Stock Brokers are required to engage only CERT-In empaneled organizations for conducting VAPT. This ensures that the VAPT is conducted by qualified and competent professionals.

Scope of VAPT

VAPT shall inter-alia include:

  • Critical assets.
  • Infrastructure components like Servers.
  • Networking systems.
  • Security devices.
  • Load balancers.
  • Other IT systems pertaining to the activities done as Stock Brokers.

Submission of VAPT Report

The final report on VAPT shall be submitted to the Stock Exchanges after approval from Technology Committee of respective Stock Brokers, within 1 month of completion of VAPT activity.

Remediation of Vulnerabilities

  • Any gaps / vulnerabilities detected shall be remedied on immediate basis.
  • Compliance of closure of findings identified during VAPT shall be submitted to the Stock Exchanges within 3 months post the submission of final VAPT report.

Cyber Audit

In addition to VAPT, Stock Brokers are mandated to conduct comprehensive cyber audit at least once in a financial year. All Stock Brokers shall submit with Stock Exchange a declaration from the MD / CEO / Partners / Proprietors certifying compliance by the Stock Brokers with all SEBI Circulars and advisories related to Cyber security from time to time, along with the Cyber audit report.

Summary of VAPT Requirements

Requirement | Details Minimum Frequency | Once in a financial year QSB Frequency | Half-yearly Auditor | CERT-In empaneled organizations only Scope | Critical assets, servers, networking systems, security devices, - load balancers, other IT systems Submission Timeline | Within 1 month of completion Remediation Timeline| Within 3 months of submission of final VAPT report

How We Help

At Anuj Desai & Associates, we help stock brokers conduct VAPT, engage CERT-In empaneled organisations, and ensure compliance with SEBI's cybersecurity framework. If you need assistance with VAPT compliance, reach out to our regulatory compliance desk.

Vulnerability Assessment and Penetration TestingVAPTVAPT complianceVAPT for stock brokersSEBI VAPT guidelinesSEBI VAPT requirementsSEBI cyber security frameworkSEBI cyber resilience frameworkSEBI cybersecurity circularSEBI HO MIRSD CIR PB 2018 147SEBI HO MIRSD TPD P CIR 2022 80cyber audit SEBIcyber security auditcyber resilience auditcybersecurity compliance Indiastock broker cybersecuritystock broker cyber compliancestock broker IT securitystock broker technology compliancestock broker complianceSEBI stock broker complianceQualified Stock BrokerQSBQualified Stock Broker VAPTQSB cyber securityCERT-InCERT-In empanelled auditorCERT-In empanelled organizationCERT-In VAPTCERT-In cybersecurityCERT-In auditpenetration testingvulnerability assessmentnetwork penetration testingweb application penetration testinginfrastructure penetration testinginternal penetration testingexternal penetration testingvulnerability scanningcyber vulnerability assessmentsecurity testingsecurity assessmentcyber risk assessmentIT security assessmentcyber security controlscyber security monitoringinformation security auditinformation security complianceIT auditIT governancecyber governancecyber resiliencecyber resilience compliancecyber security policycyber security framework Indiacritical systems securitycritical asset protectioncritical infrastructure securitynetwork securityserver securityfirewall securityintrusion detection systemsintrusion prevention systemsload balancer securityendpoint securityapplication securitydatabase securitycloud securitycloud cybersecurityencryptiondata protectiondata securitycyber incident responsecyber threat managementcyber risk managementvulnerability remediationpatch managementremediation of vulnerabilitiescyber hygienesecurity hardeninginfrastructure securityinformation systems auditcyber compliance checklistVAPT checklistpenetration testing checklistcyber audit checklisttechnology auditsystem auditSEBI system auditIT controlssecurity controlscyber control frameworkannual cyber auditannual VAPThalf yearly VAPTVAPT frequencyVAPT timelineVAPT report submissionVAPT remediation timelinetechnology committee approvalcyber audit reportMD CEO compliance declarationcyber security declarationcompliance reportingstock exchange complianceregulatory compliance Indiasecurities market compliancefinancial services cybersecurityfinancial sector cyber securityfintech cyber securityRegTech compliancetechnology risk managementoperational resiliencecyber resilience strategycyber security best practicescyber security consultantVAPT consultantcyber audit consultantcyber security advisorycompliance consultant IndiaSEBI compliance consultantcyber security for financial institutionsIT compliance Indiainformation security managementrisk management frameworkcybersecurity governancecybersecurity regulations IndiaIndian securities regulationsSEBI Master Circular Stock Brokerstechnology complianceregulatory technologyfinancial market infrastructure securitycyber defencecyber resilience testingapplication vulnerability testinginfrastructure vulnerability testingethical hackingcyber attack simulationsecurity posture assessmentcyber maturity assessmentcyber resilience framework for brokersAnuj Desai & Associatescyber compliance for brokerssecurities law compliancefinancial sector complianceIT risk managementcyber compliance Indiasecurity audit IndiaCERT-In empanelled VAPT providerannual VAPT requirementSEBI cyber audit requirementsVAPT reporting requirementsvulnerability managementpenetration testing compliancecybersecurity obligations for stock brokers
Share

Related insights

Work with ADA

Ready to talk to an advisor?

Book a consultation and get a clear, considered view from a team that handles audit, tax, regulatory and cross-border work under one roof.

Get Your Free Tax Health Check — Book a 30-Min ConsultationTalk to an Expert