VAPT Requirements in India: RBI, SEBI, IRDAI and CERT-In (2026)

On 31 July 2026 RBI issued the Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, in force on issue. They repeal, for commercial banks, the 2016 Cyber Security Framework and the 2023 IT Governance Direction (para 230). The VA/PT rules:

• Para 149. Banks “shall conduct VA and PT exercises periodically for all the critical and internet facing systems”.
• Para 150. Testing across the lifecycle: before go-live, after go-live and after changes.
• Para 151. For critical systems and customer-facing systems in the DMZ, vulnerability assessment at least every six months and penetration testing at least every 12 months.
• Paras 153-154. Findings fixed in a time-bound manner, with a documented, CVSS-based approach that also covers cloud.
• Para 155. Testers must be independent.
• Para 161. Closure status of VA/PT findings goes to the IT Strategy Committee and the IS Committee at least quarterly.
• Para 162. Banks “may” run red-team exercises.
• Para 182. Cyber incidents reported within six hours of detection on RBI's DAKSH platform, and to CERT-In.

The Directions do not require a CERT-In empanelled auditor for bank VAPT; when one is used, para 159 points to CERT-In's audit guidelines. NBFCs, credit information companies and all-India financial institutions had the same six-month and 12-month rule under the 2023 Direction (para 26): check with your compliance team whether a newer entity-specific direction now applies to your category.

SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), circular of 20 August 2024, sorts regulated entities into five categories, from market infrastructure institutions to self-certification entities, and replaced the older sector circulars. Compliance was extended to 31 August 2025 for most entities.

• Who tests. “Unless otherwise specified, all audits mentioned in CSCRF have to be conducted by CERT-In empanelled IS auditing organization.” Even self-certification entities must have VAPT done by one.
• How often (Table 18). Entities designated protected systems or critical information infrastructure: at least twice a year, one complete VAPT cycle in each half of the financial year. All others: at least once a year, starting in the first quarter.
• Deadlines (Table 19). Report within one month of completing the VAPT, after IT Committee approval; findings closed within three months of the report; revalidation within five months of the VAPT. Findings still open after three months need IT Committee approval and must close before the next exercise.
• New systems. VAPT before commissioning.
• What goes to SEBI. Summaries only: the August 2025 clarifications say entities shall not submit the explicit vulnerabilities unless asked.

The IRDAI Information and Cyber Security Guidelines, 2026 (circular of 6 April 2026) replaced the 2023 guidelines for insurers, foreign reinsurance branches, intermediaries and the Insurance Information Bureau, with compliance from the current financial year. Policy 2.16 says:

• VAPT of critical internal applications and infrastructure at least once a year, by a CERT-In empanelled auditor.
• Vulnerability assessment of all internet-facing assets at least every six months, and external grey or white box penetration testing every six months, by a CERT-In empanelled auditor.
• High-risk gaps remediated immediately and never beyond 30 days, followed by mandatory re-validation; all gaps closed within two months.

Policy 2.6 adds periodic red-team exercises. The VA/PT frequencies are written as “should”, most other items as “shall”.

CERT-In Directions of 28 April 2022 (under section 70B(6) of the IT Act) apply to service providers, intermediaries, data centres, body corporates and government organisations:

• Cyber incidents in the listed categories, which include targeted scanning of critical systems, reported to CERT-In within 6 hours of noticing them.
• Logs of all ICT systems kept securely for a rolling 180 days, within Indian jurisdiction.
• Clocks synchronised to the national NTP servers, and a named point of contact.

The Directions set no VAPT duty. That comes from CERT-In's Comprehensive Cyber Security Audit Policy Guidelines (version 1.0, 25 July 2025), binding on empanelled auditors and auditees: an audit “should be conducted at least once in a year”, sector regulators may raise the frequency, a major change “must” be audited before implementation, follow-up audits verify closure, and the auditor reports audit information to CERT-In within five days.

The Digital Personal Data Protection Act, 2023 requires every data fiduciary to take “reasonable security safeguards to prevent personal data breach” (section 8(5)), with penalties of up to INR 250 crore. Significant data fiduciaries must appoint an independent data auditor and run periodic audits (section 10).

The DPDP Rules, 2025 (13 November 2025) list minimum safeguards in Rule 6: encryption or masking, access control, logging and monitoring of access, backups, one-year log retention and processor contracts. Breaches go to the Data Protection Board within 72 hours (Rule 7), and significant data fiduciaries run a DPIA and an audit every 12 months (Rule 13). These duties come into force 18 months after publication, around May 2027.

Neither the Act nor the Rules name penetration testing; testing is the usual evidence that the safeguards work.

Three Indian rules keep security data in the country:

• Payment data. RBI's April 2018 circular requires “the entire data relating to payment systems” to be stored only in India, with compliance certified by a CERT-In empanelled auditor.
• Logs. The CERT-In Directions require ICT logs to be kept within Indian jurisdiction for 180 days, and IRDAI repeats the rule for insurers.
• Regulatory data. SEBI's CSCRF requires regulatory data to stay in India, but that clause has been in abeyance since December 2024.

A penetration test produces credentials, network maps and step-by-step evidence of how to break in. A SaaS testing platform or an AI model hosted abroad that processes them deserves the same review as any outsourced system holding payment data or logs. An appliance inside your own data centre, on its own models, keeps them in India by design.

1. 1Identify which regulator applies: RBI (and which direction for your entity type), SEBI category, IRDAI, or CERT-In only.
2. 2Set the calendar: six-monthly VA and yearly PT for RBI-regulated critical systems; one or two VAPT cycles a year for SEBI; six-monthly external testing for IRDAI.
3. 3Book a CERT-In empanelled auditor where SEBI, IRDAI or the payment-data audit requires one, and check independence for RBI.
4. 4Track closure deadlines: SEBI three months and revalidation within five; IRDAI 30 days for high-risk gaps; quarterly closure reports for RBI.
5. 5Test before go-live and after every major change.
6. 6Check where every security tool processes and stores test data, logs and evidence.
7. 7Prepare for DPDP: show that safeguards are tested before the duties apply in 2027.

The requirements by regulation hub compares these rules with other countries.

Zero Hunt is an autonomous AI red team on an on-premise appliance: it runs black-box and gray-box penetration tests of networks and infrastructure from inside your data centre, on its own models, so findings and credentials do not leave India. Operators choose one of five autonomy levels that decide which actions wait for approval, and every finding is backed by Ed25519-signed, hash-chained evidence. Use it to test continuously between the mandated audits, to retest fixes inside SEBI's and IRDAI's closure windows, and to test changes before go-live.

Two honest limits. Zero Hunt is not a CERT-In empanelled auditor: where SEBI, IRDAI or RBI's payment-data rule requires an empanelled audit, that audit still has to happen, and your auditor can use Zero Hunt's evidence. And of the Indian rules, Zero Hunt maps findings to the RBI cybersecurity framework, built on RBI's earlier requirements; it does not ship SEBI CSCRF, IRDAI or CERT-In report templates, so your team or partner maps the evidence to those rules.

How often must an Indian bank run VAPT? Under RBI's 2026 Directions for commercial banks, vulnerability assessment at least every six months and penetration testing at least every 12 months for critical systems and customer-facing systems in the DMZ, plus testing before and after changes.

Must VAPT be done by a CERT-In empanelled auditor? For SEBI-regulated entities and IRDAI-regulated insurers, yes. RBI's 2026 Directions require independent testers but do not require empanelment; the payment-data storage audit should be done by a CERT-In empanelled auditor.

How fast must VAPT findings be closed? SEBI: within three months of the report, with revalidation within five months of the VAPT. IRDAI: high-risk gaps within 30 days, all gaps within two months. RBI: in a time-bound manner, with closure reported quarterly.

Is the RBI 2023 IT Master Direction still in force? Not for commercial banks: the 2026 Directions repealed it on 31 July 2026. Other entity types it covered should check which direction now applies to them.

Can we use a pentest platform hosted outside India? Check with compliance. Payment data must be stored only in India and logs kept within Indian jurisdiction; a tool that processes them abroad should be reviewed against those rules.