SEBI VAPT Requirements for Stock Brokers: 6 Critical Rules | Osto<\/title>\n<meta name=\"description\" content=\"SEBI VAPT requirements for stock brokers explained: annual vs half-yearly cadence, CERT-In empanelled auditors, scope, remediation timelines, and reporting.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">The SEBI VAPT requirements for stock brokers decide how often you test, who can sign the report, and how fast you must fix what it finds. This guide breaks down the cadence, scope, and remediation rules, and how to meet them without a large security team.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>SEBI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The SEBI VAPT requirements for stock brokers are set by CSCRF. Most brokers run VAPT annually, but Qualified Stock Brokers and any broker offering internet or algo trading must test half-yearly, plus after every major system release. The test must be a real penetration test with manual exploitation by a CERT-In empanelled auditor, cover all critical systems and a sample of non-critical ones, and every finding must be remediated within three months, with high and critical issues re-tested within thirty days.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">Why VAPT matters for brokers<\/a><\/li>\n <li><a href=\"#cadence\">How often you must test<\/a><\/li>\n <li><a href=\"#requirements\">The core requirements<\/a><\/li>\n <li><a href=\"#scan\">Why a scan is not enough<\/a><\/li>\n <li><a href=\"#remediation\">Fixing and re-testing<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">Why the SEBI VAPT requirements for stock brokers matter<\/h2>\n <p>A stock broker runs client money, trading systems, and sensitive market data, which makes it a high-value target and a focus of regulatory scrutiny. Under the Cybersecurity and Cyber Resilience Framework, the <a href=\"https:\/\/www.sebi.gov.in\/\" target=\"_blank\" rel=\"noopener\">Securities and Exchange Board of India<\/a> makes vulnerability assessment and penetration testing a core, testable control. The SEBI VAPT requirements for stock brokers are not a formality: they are one of the first things a CERT-In empanelled auditor checks, and getting the cadence, scope, or remediation wrong is a common reason brokers fall short at audit.<\/p>\n\n <h2 class=\"sec\" id=\"cadence\">How often you must test<\/h2>\n <p>The first requirement is frequency, and it depends on your profile, not just your CSCRF category.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The cadence<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">How often you have to test<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The rules start with frequency, and it is not the same for every broker. Most test annually, but a large group must test twice a year, and everyone tests again after a major system change.<\/div>\n <svg viewBox=\"0 0 800 240\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"How often a stock broker must run VAPT under SEBI CSCRF\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">How often a broker must run VAPT<\/text>\n <rect x=\"16\" y=\"60\" width=\"372\" height=\"160\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"46\" y=\"94\" fill=\"#1c267a\" font-size=\"14.5\" font-weight=\"800\">Annual<\/text>\n <line x1=\"46\" y1=\"106\" x2=\"358\" y2=\"106\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"46\" y=\"132\" fill=\"#4a5170\" font-size=\"12.5\">Most brokers, on their CSCRF<\/text>\n <text x=\"46\" y=\"152\" fill=\"#4a5170\" font-size=\"12.5\">category cadence, plus after<\/text>\n <text x=\"46\" y=\"172\" fill=\"#4a5170\" font-size=\"12.5\">every major system release.<\/text>\n <text x=\"46\" y=\"200\" fill=\"#2b3596\" font-size=\"11.5\" font-weight=\"700\">Quarterly scans of internet-facing systems.<\/text>\n <rect x=\"412\" y=\"60\" width=\"372\" height=\"160\" rx=\"16\" fill=\"#1c267a\"\/>\n <text x=\"442\" y=\"94\" fill=\"#fff\" font-size=\"14.5\" font-weight=\"800\">Half-yearly<\/text>\n <line x1=\"442\" y1=\"106\" x2=\"754\" y2=\"106\" stroke=\"#39439a\" stroke-width=\"1\"\/>\n <text x=\"442\" y=\"132\" fill=\"#c3c9ee\" font-size=\"12.5\">Qualified Stock Brokers, and<\/text>\n <text x=\"442\" y=\"152\" fill=\"#c3c9ee\" font-size=\"12.5\">any broker offering internet<\/text>\n <text x=\"442\" y=\"172\" fill=\"#c3c9ee\" font-size=\"12.5\">or algo trading.<\/text>\n <text x=\"442\" y=\"200\" fill=\"#8fa0e8\" font-size=\"11.5\" font-weight=\"700\">Twice a year, whichever category applies.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Most brokers run VAPT annually on their category cadence. But a large group must test half-yearly: Qualified Stock Brokers, and any broker offering Internet-Based Trading or algorithmic trading, fall into the twice-a-year bracket regardless of their broader category. On top of that, every broker must run a fresh VAPT after any major system release, and conduct quarterly vulnerability scans of internet-facing systems. If you offer online or algo trading, assume half-yearly is your baseline.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Online or algo trading means half-yearly<\/div>A common misread is defaulting to annual testing. If your broking firm offers internet-based or algorithmic trading, the rules put you on a half-yearly cycle, the same cadence as a Qualified Stock Broker. Build your calendar around twice a year.<\/div>\n\n <h2 class=\"sec\" id=\"requirements\">The core SEBI VAPT requirements for stock brokers<\/h2>\n <p>Beyond frequency, the rules fix who tests, what is covered, and how. These are the pillars an auditor will hold you to.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The requirements<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What a compliant VAPT looks like<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Cadence is only the start. The rules also fix who can test, what must be covered, how testing is done, and how fast findings are closed.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core SEBI VAPT requirements for stock brokers\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core SEBI VAPT requirements<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">CERT-In empanelled<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Only an empanelled auditor can<\/text><text x=\"136\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">sign it<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4\" y=\"5\" width=\"16\" height=\"16\" rx=\"2\"\/><path d=\"M4 9h16M8 3v4M16 3v4\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Set cadence<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Annual or half-yearly, plus<\/text><text x=\"394\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">after changes<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><circle cx=\"12\" cy=\"12\" r=\"4.5\"\/><circle cx=\"12\" cy=\"12\" r=\"1.3\" fill=\"currentColor\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Defined scope<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">All critical systems, sample of<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">non-critical<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M15 6a4 4 0 0 0-5.5 4.5l-6 6L6 19l6-6A4 4 0 0 0 15 6z\"\/><path d=\"M14.5 6.5l2 2\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Manual exploitation<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">A real pentest, not just a scan<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Timed remediation<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Close findings within three<\/text><text x=\"394\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">months<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><path d=\"M8 13h8M8 16h5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Formatted reporting<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Submit in the CSCRF Annexure<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">format<\/text><\/svg>\n \n<\/div>\n\n <p>The test must be performed by a CERT-In empanelled information-security auditing organisation, this is non-negotiable, and the auditor is expected to have real BFSI audit experience. The scope must cover one hundred percent of your critical systems and at least a twenty-five percent sample of non-critical ones, and for dual-registered firms it covers the SEBI-regulated systems where they are properly segregated. The testing itself must involve manual exploitation, a genuine penetration test, and the findings must be reported in the CSCRF-specified format within the prescribed timelines. A grounding in the <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">types of VAPT<\/a> helps you scope this correctly.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Empanelment is not optional<\/div>You cannot self-certify a broker VAPT, and you cannot use just any security vendor. The rules state that the work must be done by a CERT-In empanelled auditor. A report from a non-empanelled firm will not stand up at audit.<\/div>\n\n <h2 class=\"sec\" id=\"scan\">Why a scan is not enough<\/h2>\n <p>The single most common failure here is treating an automated vulnerability scan as a penetration test. CSCRF explicitly expects manual exploitation, and interpreting annual VAPT as an automated scan is a mistake auditors flag.<\/p>\n <p>A scanner checks your systems against a database of known issues. It is useful and should run, but it will not chain weaknesses into a real breach or understand your trading and settlement logic. A penetration test is a skilled professional attacking the way a real adversary would. Our guide on <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">VAPT versus vulnerability scanning<\/a> explains why a scan alone will never satisfy a SEBI cyber audit for a broker.<\/p>\n\n <h2 class=\"sec\" id=\"remediation\">Fixing and re-testing<\/h2>\n <p>Here is the part brokers underestimate: under these rules, running the test is only half the job. SEBI is equally strict about closing what it finds.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Remediation<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">The test is only half the job<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">SEBI is as strict about fixing findings as about finding them. The rules include hard remediation timelines and evidence of closure, not just a report.<\/div>\n <svg viewBox=\"0 0 800 236\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The SEBI VAPT remediation timelines for stock brokers\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Findings must be closed, not just listed<\/text>\n <rect x=\"30\" y=\"66\" width=\"228\" height=\"150\" rx=\"16\" fill=\"#f9f4f4\" stroke=\"#e6cfcf\" stroke-width=\"1.6\"\/>\n <text x=\"54\" y=\"100\" fill=\"#9a4a54\" font-size=\"14\" font-weight=\"800\">Critical<\/text>\n <line x1=\"54\" y1=\"112\" x2=\"234\" y2=\"112\" stroke=\"#ecd9d9\" stroke-width=\"1\"\/>\n <text x=\"54\" y=\"140\" fill=\"#7a5560\" font-size=\"12.5\">Patch gaps fixed<\/text>\n <text x=\"54\" y=\"160\" fill=\"#7a5560\" font-size=\"12.5\">immediately; high and<\/text>\n <text x=\"54\" y=\"180\" fill=\"#7a5560\" font-size=\"12.5\">critical re-tested within<\/text>\n <text x=\"54\" y=\"200\" fill=\"#7a2e38\" font-size=\"12.5\" font-weight=\"700\">30 days.<\/text>\n <rect x=\"286\" y=\"66\" width=\"228\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"310\" y=\"100\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">All findings<\/text>\n <line x1=\"310\" y1=\"112\" x2=\"490\" y2=\"112\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"310\" y=\"140\" fill=\"#4a5170\" font-size=\"12.5\">Every vulnerability<\/text>\n <text x=\"310\" y=\"160\" fill=\"#4a5170\" font-size=\"12.5\">remediated within<\/text>\n <text x=\"310\" y=\"180\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"700\">three months of the<\/text>\n <text x=\"310\" y=\"200\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"700\">report date.<\/text>\n <rect x=\"542\" y=\"66\" width=\"228\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"566\" y=\"100\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Evidence<\/text>\n <line x1=\"566\" y1=\"112\" x2=\"746\" y2=\"112\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"566\" y=\"140\" fill=\"#4a5170\" font-size=\"12.5\">Keep a re-test letter<\/text>\n <text x=\"566\" y=\"160\" fill=\"#4a5170\" font-size=\"12.5\">on file and submit the<\/text>\n <text x=\"566\" y=\"180\" fill=\"#4a5170\" font-size=\"12.5\">report in the required<\/text>\n <text x=\"566\" y=\"200\" fill=\"#0a6558\" font-size=\"12.5\" font-weight=\"700\">CSCRF format.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Every vulnerability identified in a VAPT must be remediated within three months of the report submission date. Critical patch gaps carry the tightest deadline and must be fixed immediately, and high and critical findings must be re-tested within thirty days, with a re-test letter kept on file. Auditors have flagged brokers for the same critical vulnerability appearing in consecutive reports, precisely because remediation was never followed through. Findings tracked to closure, with evidence, are the real substance of the requirement.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to broker VAPT compliance<\/h2>\n <p>Meeting all of this, testing on the right cadence, with the right scope, manual exploitation of findings, remediation within tight timelines, and audit-ready evidence, is a heavy lift for a broking firm without a large security team. Coordinating separate testers, trackers, and reporting is slow and error-prone. The efficient path is one platform that runs the testing and organises the evidence together.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups and lean trading teams. It runs VAPT across your trading and back-office systems and APIs, categorises findings by severity, generates remediation and re-test reports, and keeps organised, audit-ready evidence, mapped across the SEBI CSCRF expectations, DPDP, and 200+ frameworks on one platform. Meeting these requirements on the right cadence, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Meet the SEBI VAPT requirements for stock brokers, and stay audit-ready.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean trading teams. Run VAPT on the right cadence, remediate, re-test, and keep the evidence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>How often must a stock broker run VAPT under SEBI?<\/summary><p>Most brokers run VAPT annually, but Qualified Stock Brokers and any broker offering internet-based or algorithmic trading must test half-yearly. Every broker must also run a fresh VAPT after a major system release and conduct quarterly scans of internet-facing systems.<\/p><\/details>\n <details><summary>Who can perform a broker’s VAPT?<\/summary><p>Only a CERT-In empanelled information-security auditing organisation, with real BFSI audit experience. A report from a non-empanelled firm will not be accepted at a SEBI cyber audit. This is a non-negotiable part of the SEBI VAPT requirements for stock brokers.<\/p><\/details>\n <details><summary>Is an automated scan enough to meet the requirement?<\/summary><p>No. CSCRF expects manual exploitation, a real penetration test. Interpreting annual VAPT as an automated scan is a common mistake that auditors flag, because a scan misses the business-logic and chained vulnerabilities a broker faces.<\/p><\/details>\n <details><summary>What must a broker’s VAPT scope cover?<\/summary><p>All critical systems and at least a twenty-five percent sample of non-critical systems. For firms registered under multiple regulators, the scope covers the SEBI-regulated systems where they are properly segregated.<\/p><\/details>\n <details><summary>How quickly must findings be fixed?<\/summary><p>Every finding must be remediated within three months of the report submission date. Critical patch gaps must be fixed immediately, and high and critical findings re-tested within thirty days, with a re-test letter on file.<\/p><\/details>\n <details><summary>Can one VAPT cover both SEBI and RBI if we are dual-regulated?<\/summary><p>Often yes. SEBI’s equivalence principle lets an RBI six-monthly vulnerability assessment meet or exceed the CSCRF VAPT minimum, provided the scope covers the SEBI-regulated systems and a CERT-In empanelled auditor performed the work.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>SEBI VAPT Requirements for Stock Brokers: 6 Critical Rules | Osto The SEBI VAPT requirements for stock brokers decide how\u2026<\/p>\n","protected":false},"author":8,"featured_media":1269,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[657,658],"class_list":["post-1268","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-sebi-vapt-requirements-for-stock-brokers","tag-sebi-vapt-stock-brokers"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1268"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1268\/revisions"}],"predecessor-version":[{"id":1270,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1268\/revisions\/1270"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1269"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1268,"date":"2026-09-14T13:26:56","date_gmt":"2026-09-14T13:26:56","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1268"},"modified":"2026-09-14T13:26:56","modified_gmt":"2026-09-14T13:26:56","slug":"sebi-vapt-requirements-stock-brokers","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/sebi-vapt-requirements-stock-brokers\/","title":{"rendered":"SEBI VAPT Requirements for Stock Brokers: A Complete Guide"},"content":{"rendered":"\n\n\n\n\n\nSEBI VAPT Requirements for Stock Brokers: 6 Critical Rules | Osto<\/title>\n<meta name=\"description\" content=\"SEBI VAPT requirements for stock brokers explained: annual vs half-yearly cadence, CERT-In empanelled auditors, scope, remediation timelines, and reporting.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">The SEBI VAPT requirements for stock brokers decide how often you test, who can sign the report, and how fast you must fix what it finds. This guide breaks down the cadence, scope, and remediation rules, and how to meet them without a large security team.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>SEBI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The SEBI VAPT requirements for stock brokers are set by CSCRF. Most brokers run VAPT annually, but Qualified Stock Brokers and any broker offering internet or algo trading must test half-yearly, plus after every major system release. The test must be a real penetration test with manual exploitation by a CERT-In empanelled auditor, cover all critical systems and a sample of non-critical ones, and every finding must be remediated within three months, with high and critical issues re-tested within thirty days.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">Why VAPT matters for brokers<\/a><\/li>\n <li><a href=\"#cadence\">How often you must test<\/a><\/li>\n <li><a href=\"#requirements\">The core requirements<\/a><\/li>\n <li><a href=\"#scan\">Why a scan is not enough<\/a><\/li>\n <li><a href=\"#remediation\">Fixing and re-testing<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">Why the SEBI VAPT requirements for stock brokers matter<\/h2>\n <p>A stock broker runs client money, trading systems, and sensitive market data, which makes it a high-value target and a focus of regulatory scrutiny. Under the Cybersecurity and Cyber Resilience Framework, the <a href=\"https:\/\/www.sebi.gov.in\/\" target=\"_blank\" rel=\"noopener\">Securities and Exchange Board of India<\/a> makes vulnerability assessment and penetration testing a core, testable control. The SEBI VAPT requirements for stock brokers are not a formality: they are one of the first things a CERT-In empanelled auditor checks, and getting the cadence, scope, or remediation wrong is a common reason brokers fall short at audit.<\/p>\n\n <h2 class=\"sec\" id=\"cadence\">How often you must test<\/h2>\n <p>The first requirement is frequency, and it depends on your profile, not just your CSCRF category.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The cadence<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">How often you have to test<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The rules start with frequency, and it is not the same for every broker. Most test annually, but a large group must test twice a year, and everyone tests again after a major system change.<\/div>\n <svg viewBox=\"0 0 800 240\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"How often a stock broker must run VAPT under SEBI CSCRF\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">How often a broker must run VAPT<\/text>\n <rect x=\"16\" y=\"60\" width=\"372\" height=\"160\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"46\" y=\"94\" fill=\"#1c267a\" font-size=\"14.5\" font-weight=\"800\">Annual<\/text>\n <line x1=\"46\" y1=\"106\" x2=\"358\" y2=\"106\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"46\" y=\"132\" fill=\"#4a5170\" font-size=\"12.5\">Most brokers, on their CSCRF<\/text>\n <text x=\"46\" y=\"152\" fill=\"#4a5170\" font-size=\"12.5\">category cadence, plus after<\/text>\n <text x=\"46\" y=\"172\" fill=\"#4a5170\" font-size=\"12.5\">every major system release.<\/text>\n <text x=\"46\" y=\"200\" fill=\"#2b3596\" font-size=\"11.5\" font-weight=\"700\">Quarterly scans of internet-facing systems.<\/text>\n <rect x=\"412\" y=\"60\" width=\"372\" height=\"160\" rx=\"16\" fill=\"#1c267a\"\/>\n <text x=\"442\" y=\"94\" fill=\"#fff\" font-size=\"14.5\" font-weight=\"800\">Half-yearly<\/text>\n <line x1=\"442\" y1=\"106\" x2=\"754\" y2=\"106\" stroke=\"#39439a\" stroke-width=\"1\"\/>\n <text x=\"442\" y=\"132\" fill=\"#c3c9ee\" font-size=\"12.5\">Qualified Stock Brokers, and<\/text>\n <text x=\"442\" y=\"152\" fill=\"#c3c9ee\" font-size=\"12.5\">any broker offering internet<\/text>\n <text x=\"442\" y=\"172\" fill=\"#c3c9ee\" font-size=\"12.5\">or algo trading.<\/text>\n <text x=\"442\" y=\"200\" fill=\"#8fa0e8\" font-size=\"11.5\" font-weight=\"700\">Twice a year, whichever category applies.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Most brokers run VAPT annually on their category cadence. But a large group must test half-yearly: Qualified Stock Brokers, and any broker offering Internet-Based Trading or algorithmic trading, fall into the twice-a-year bracket regardless of their broader category. On top of that, every broker must run a fresh VAPT after any major system release, and conduct quarterly vulnerability scans of internet-facing systems. If you offer online or algo trading, assume half-yearly is your baseline.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Online or algo trading means half-yearly<\/div>A common misread is defaulting to annual testing. If your broking firm offers internet-based or algorithmic trading, the rules put you on a half-yearly cycle, the same cadence as a Qualified Stock Broker. Build your calendar around twice a year.<\/div>\n\n <h2 class=\"sec\" id=\"requirements\">The core SEBI VAPT requirements for stock brokers<\/h2>\n <p>Beyond frequency, the rules fix who tests, what is covered, and how. These are the pillars an auditor will hold you to.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The requirements<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What a compliant VAPT looks like<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Cadence is only the start. The rules also fix who can test, what must be covered, how testing is done, and how fast findings are closed.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core SEBI VAPT requirements for stock brokers\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core SEBI VAPT requirements<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">CERT-In empanelled<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Only an empanelled auditor can<\/text><text x=\"136\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">sign it<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4\" y=\"5\" width=\"16\" height=\"16\" rx=\"2\"\/><path d=\"M4 9h16M8 3v4M16 3v4\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Set cadence<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Annual or half-yearly, plus<\/text><text x=\"394\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">after changes<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><circle cx=\"12\" cy=\"12\" r=\"4.5\"\/><circle cx=\"12\" cy=\"12\" r=\"1.3\" fill=\"currentColor\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Defined scope<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">All critical systems, sample of<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">non-critical<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M15 6a4 4 0 0 0-5.5 4.5l-6 6L6 19l6-6A4 4 0 0 0 15 6z\"\/><path d=\"M14.5 6.5l2 2\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Manual exploitation<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">A real pentest, not just a scan<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Timed remediation<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Close findings within three<\/text><text x=\"394\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">months<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><path d=\"M8 13h8M8 16h5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Formatted reporting<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Submit in the CSCRF Annexure<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">format<\/text><\/svg>\n \n<\/div>\n\n <p>The test must be performed by a CERT-In empanelled information-security auditing organisation, this is non-negotiable, and the auditor is expected to have real BFSI audit experience. The scope must cover one hundred percent of your critical systems and at least a twenty-five percent sample of non-critical ones, and for dual-registered firms it covers the SEBI-regulated systems where they are properly segregated. The testing itself must involve manual exploitation, a genuine penetration test, and the findings must be reported in the CSCRF-specified format within the prescribed timelines. A grounding in the <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">types of VAPT<\/a> helps you scope this correctly.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Empanelment is not optional<\/div>You cannot self-certify a broker VAPT, and you cannot use just any security vendor. The rules state that the work must be done by a CERT-In empanelled auditor. A report from a non-empanelled firm will not stand up at audit.<\/div>\n\n <h2 class=\"sec\" id=\"scan\">Why a scan is not enough<\/h2>\n <p>The single most common failure here is treating an automated vulnerability scan as a penetration test. CSCRF explicitly expects manual exploitation, and interpreting annual VAPT as an automated scan is a mistake auditors flag.<\/p>\n <p>A scanner checks your systems against a database of known issues. It is useful and should run, but it will not chain weaknesses into a real breach or understand your trading and settlement logic. A penetration test is a skilled professional attacking the way a real adversary would. Our guide on <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">VAPT versus vulnerability scanning<\/a> explains why a scan alone will never satisfy a SEBI cyber audit for a broker.<\/p>\n\n <h2 class=\"sec\" id=\"remediation\">Fixing and re-testing<\/h2>\n <p>Here is the part brokers underestimate: under these rules, running the test is only half the job. SEBI is equally strict about closing what it finds.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Remediation<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">The test is only half the job<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">SEBI is as strict about fixing findings as about finding them. The rules include hard remediation timelines and evidence of closure, not just a report.<\/div>\n <svg viewBox=\"0 0 800 236\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The SEBI VAPT remediation timelines for stock brokers\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Findings must be closed, not just listed<\/text>\n <rect x=\"30\" y=\"66\" width=\"228\" height=\"150\" rx=\"16\" fill=\"#f9f4f4\" stroke=\"#e6cfcf\" stroke-width=\"1.6\"\/>\n <text x=\"54\" y=\"100\" fill=\"#9a4a54\" font-size=\"14\" font-weight=\"800\">Critical<\/text>\n <line x1=\"54\" y1=\"112\" x2=\"234\" y2=\"112\" stroke=\"#ecd9d9\" stroke-width=\"1\"\/>\n <text x=\"54\" y=\"140\" fill=\"#7a5560\" font-size=\"12.5\">Patch gaps fixed<\/text>\n <text x=\"54\" y=\"160\" fill=\"#7a5560\" font-size=\"12.5\">immediately; high and<\/text>\n <text x=\"54\" y=\"180\" fill=\"#7a5560\" font-size=\"12.5\">critical re-tested within<\/text>\n <text x=\"54\" y=\"200\" fill=\"#7a2e38\" font-size=\"12.5\" font-weight=\"700\">30 days.<\/text>\n <rect x=\"286\" y=\"66\" width=\"228\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"310\" y=\"100\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">All findings<\/text>\n <line x1=\"310\" y1=\"112\" x2=\"490\" y2=\"112\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"310\" y=\"140\" fill=\"#4a5170\" font-size=\"12.5\">Every vulnerability<\/text>\n <text x=\"310\" y=\"160\" fill=\"#4a5170\" font-size=\"12.5\">remediated within<\/text>\n <text x=\"310\" y=\"180\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"700\">three months of the<\/text>\n <text x=\"310\" y=\"200\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"700\">report date.<\/text>\n <rect x=\"542\" y=\"66\" width=\"228\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"566\" y=\"100\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Evidence<\/text>\n <line x1=\"566\" y1=\"112\" x2=\"746\" y2=\"112\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"566\" y=\"140\" fill=\"#4a5170\" font-size=\"12.5\">Keep a re-test letter<\/text>\n <text x=\"566\" y=\"160\" fill=\"#4a5170\" font-size=\"12.5\">on file and submit the<\/text>\n <text x=\"566\" y=\"180\" fill=\"#4a5170\" font-size=\"12.5\">report in the required<\/text>\n <text x=\"566\" y=\"200\" fill=\"#0a6558\" font-size=\"12.5\" font-weight=\"700\">CSCRF format.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Every vulnerability identified in a VAPT must be remediated within three months of the report submission date. Critical patch gaps carry the tightest deadline and must be fixed immediately, and high and critical findings must be re-tested within thirty days, with a re-test letter kept on file. Auditors have flagged brokers for the same critical vulnerability appearing in consecutive reports, precisely because remediation was never followed through. Findings tracked to closure, with evidence, are the real substance of the requirement.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to broker VAPT compliance<\/h2>\n <p>Meeting all of this, testing on the right cadence, with the right scope, manual exploitation of findings, remediation within tight timelines, and audit-ready evidence, is a heavy lift for a broking firm without a large security team. Coordinating separate testers, trackers, and reporting is slow and error-prone. The efficient path is one platform that runs the testing and organises the evidence together.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups and lean trading teams. It runs VAPT across your trading and back-office systems and APIs, categorises findings by severity, generates remediation and re-test reports, and keeps organised, audit-ready evidence, mapped across the SEBI CSCRF expectations, DPDP, and 200+ frameworks on one platform. Meeting these requirements on the right cadence, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Meet the SEBI VAPT requirements for stock brokers, and stay audit-ready.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean trading teams. Run VAPT on the right cadence, remediate, re-test, and keep the evidence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>How often must a stock broker run VAPT under SEBI?<\/summary><p>Most brokers run VAPT annually, but Qualified Stock Brokers and any broker offering internet-based or algorithmic trading must test half-yearly. Every broker must also run a fresh VAPT after a major system release and conduct quarterly scans of internet-facing systems.<\/p><\/details>\n <details><summary>Who can perform a broker’s VAPT?<\/summary><p>Only a CERT-In empanelled information-security auditing organisation, with real BFSI audit experience. A report from a non-empanelled firm will not be accepted at a SEBI cyber audit. This is a non-negotiable part of the SEBI VAPT requirements for stock brokers.<\/p><\/details>\n <details><summary>Is an automated scan enough to meet the requirement?<\/summary><p>No. CSCRF expects manual exploitation, a real penetration test. Interpreting annual VAPT as an automated scan is a common mistake that auditors flag, because a scan misses the business-logic and chained vulnerabilities a broker faces.<\/p><\/details>\n <details><summary>What must a broker’s VAPT scope cover?<\/summary><p>All critical systems and at least a twenty-five percent sample of non-critical systems. For firms registered under multiple regulators, the scope covers the SEBI-regulated systems where they are properly segregated.<\/p><\/details>\n <details><summary>How quickly must findings be fixed?<\/summary><p>Every finding must be remediated within three months of the report submission date. Critical patch gaps must be fixed immediately, and high and critical findings re-tested within thirty days, with a re-test letter on file.<\/p><\/details>\n <details><summary>Can one VAPT cover both SEBI and RBI if we are dual-regulated?<\/summary><p>Often yes. SEBI’s equivalence principle lets an RBI six-monthly vulnerability assessment meet or exceed the CSCRF VAPT minimum, provided the scope covers the SEBI-regulated systems and a CERT-In empanelled auditor performed the work.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>SEBI VAPT Requirements for Stock Brokers: 6 Critical Rules | Osto The SEBI VAPT requirements for stock brokers decide how\u2026<\/p>\n","protected":false},"author":8,"featured_media":1269,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[657,658],"class_list":["post-1268","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-sebi-vapt-requirements-for-stock-brokers","tag-sebi-vapt-stock-brokers"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1268"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1268\/revisions"}],"predecessor-version":[{"id":1270,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1268\/revisions\/1270"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1269"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}