Vulnerability Assessment and Penetration Testing (VAPT) is a critical component of the Cybersecurity and Cyber Resilience Framework (CSCRF). Research Analysts (RAs) that are subject to CSCRF must conduct regular VAPT to identify and remediate vulnerabilities. This article provides a comprehensive technical analysis of VAPT cadence requirements.
Regulatory Basis
VAPT Requirements
SEBI requires all regulated entities to conduct Vulnerability Assessment and Penetration Testing (VAPT) which inter-alia includes all critical applications (trading, back-office, etc.). The VAPT must be conducted using both conventional and AI-based tools, in line with SEBI's CSCRF.
Remediation Timeline
Any gaps/vulnerabilities detected shall be remedied on an immediate basis. Further, compliance of closure of findings identified during VAPT shall be submitted within 3 months post submission of VAPT report.
VAPT Cadence
Frequency
| Requirement | Frequency |
|---|---|
| VAPT Conduct | Regular (typically annual) |
| VAPT Period | September to November (for FY 2024-25) |
Reporting
| Requirement | Timeline |
|---|---|
| VAPT Report Submission | As specified by SEBI/Exchange |
| Vulnerability Remediation | Immediate |
| Closure of Findings | Within 3 months post VAPT report |
VAPT Process
Step 1: Planning
- Identify scope of VAPT
- Select VAPT vendor
- Define testing parameters
Step 2: Conduct VAPT
- Vulnerability assessment
- Penetration testing
- Identify vulnerabilities
Step 3: Reporting
- Document findings
- Submit VAPT report
- Retain detailed VAPT records
Step 4: Remediation
- Remediate vulnerabilities immediately
- Track remediation progress
Step 5: Closure
- Submit closure of findings within 3 months
- Retain Proofs of Concept
Record Retention
DPs shall retain detailed VAPT records and Proofs of Concept for three years, though explicit vulnerability details are to be shared only upon SEBI/Depository request.
Applicability to RAs
| RA Type | VAPT Requirement |
|---|---|
| RA only (no other registration) | Not applicable (exempt from CSCRF) |
| RA + Stock Broker | Follow VAPT as Stock Broker |
| RA + Investment Adviser | Follow VAPT as Investment Adviser |
| RA + Portfolio Manager | Follow VAPT as Portfolio Manager |
Common Compliance Gaps
1. No VAPT
Some RAs do not conduct VAPT.
Solution: Conduct regular VAPT.
2. Delayed Remediation
Some RAs delay remediation of vulnerabilities.
Solution: Remediate vulnerabilities immediately.
3. Not Submitting Closure
Some RAs do not submit closure of findings.
Solution: Submit closure within 3 months.
4. Not Retaining Records
Some RAs do not retain VAPT records.
Solution: Retain records for three years.
Conclusion and How Anuj Desai & Associates Can Help
VAPT is a critical compliance requirement for RAs subject to CSCRF.
Anuj Desai & Associates offers specialized services to help RAs comply with VAPT requirements:
- VAPT planning and execution
- Vulnerability remediation
- Reporting and closure
- Record retention
- Compliance audit and advisory
Contact us today to ensure your VAPT practices comply with SEBI requirements. Our team will guide you through the process.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers are advised to consult qualified professionals for legal and compliance matters. Anuj Desai & Associates is a SEBI compliance consulting firm based in India.