VAPT for Banks, NBFCs, Brokers and Insurers in India

Many companies sit under two regulators, for example an NBFC that also distributes insurance. Each text applies to the activity it regulates.

We checked the SEBI circular itself (circular number SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113). On VAPT it says:

• Regulated entities plan their VAPT activity at the start of the financial year.
• Entities identified as protected systems or critical information infrastructure by NCIIPC complete at least two rounds a year, one in each half of the financial year (April to September and October to March). A round includes report submission, closing the findings and revalidation.
• The VAPT report is submitted after approval by the entity's IT Committee, within one month of completing the VAPT.
• Revalidation is completed within five months of completing the VAPT, and the revalidation report and any open observations go back to the IT Committee.
• The same framework lists different frequencies and reporting authorities for other entity categories. Read the table row that matches your category.

The framework also says that external audits of regulated entities, including the cyber audit, must use auditing organizations on the CERT-In panel. Whether the same applies to the VAPT of your category is set out in the VAPT section of the circular, and you should read that section for your category before you choose a vendor.

We read the Master Direction itself (RBI/2023-24/107, issued 7 November 2023 and in effect from 1 April 2024). It applies to scheduled commercial banks other than regional rural banks, small finance banks, payments banks, NBFCs, credit information companies and all-India financial institutions, so check whether your NBFC layer is covered. Its paragraph on conducting vulnerability assessment (VA) and Penetration Testing (PT) says, in summary:

• For critical information systems, and for systems in the demilitarized zone that face customers, VA is done at least once every six months and PT at least once every 12 months.
• VA and PT also happen across a system's life: before it goes live, after it goes live and after major changes.
• For other systems, you decide the need and frequency by risk.
• The work is done by appropriately trained and independent information security experts or auditors.
• After a change goes live, the test is done on the production environment. If it is done in a test environment instead, that environment must match production, and any difference is documented and approved by the Information Security Committee.
• Findings are fixed within a set time, and the entity keeps a documented approach for VA and PT that covers scope, coverage and how vulnerabilities are scored, such as with CVSS. It may also apply to systems hosted in the cloud.

The IRDAI Information and Cyber Security Guidelines (2023 edition) include an audit questionnaire that asks whether the entity runs regular external and internal penetration tests, and the frequency depends on the entity's category. IRDAI has revised its guidance over time, so check IRDAI's website for the version in force today, and treat summaries from vendors, ours included, as a starting point and not as the rule.

Several parts of these frameworks ask for outcomes that a penetration test helps to evidence: that vulnerabilities are identified and closed, that critical applications and APIs are tested, that mobile apps are tested before release, that changes are tested before they go live. A test report with scope, method, findings, fixes and a retest result is the usual record.

• The scope document and the plan made at the start of the year.
• The signed rules of engagement.
• The report, with a rating for each finding and how it was rated.
• The record of who approved the report and when, such as the IT Committee's minutes.
• The closure and revalidation evidence for every finding, with dates.
• The reasons for any finding you accept as a risk, with an approver's name.

BERRY9 is not CERT-In empanelled. Where the text that applies to you requires an empanelled auditing organization, you need one for that audit, and we say so plainly. Teams in this position often add testing between audits, before a release or after a major change, and that is work any qualified tester can do. See do you need a CERT-In empanelled auditor for how to decide.

• Which regulator and which entity category applies to each system in scope?
• Does the text name who may carry out the test and who must receive the report?
• What is the required frequency, and what counts as a completed round?
• Who approves the report inside your company, and how long does that take?
• Which systems belong to critical or core activities, and which are run by vendors?

Fintech companies can read our fintech Penetration Testing page for how tests are scoped for payment flows, and CERT-In incident reporting and log rules for the incident side. Rules checked on 5 November 2026.

To plan a test for your own systems, request a scoping call, or download the pre-test checklist and scoping questionnaire.

Links checked on 5 November 2026.

• SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, circular of 20 August 2024, the VAPT sections
• Reserve Bank of India, Master Directions, Master Direction on IT Governance, Risk, Controls and Assurance Practices, 7 November 2023
• CERT-In, the CERT-In panel of information security auditing organizations