India’s critical cybersecurity compliance deadlines for November and December 2026 include November 30 for applicable SEBI VAPT Action Taken Reports (ATR) and December 31 for half-yearly cybersecurity audit reports required from specified NSE/BSE trading members. RBI-regulated entities must also maintain ongoing vulnerability assessment and penetration testing (VAPT) compliance, while QSBs and Critical Information Infrastructure operators must follow their applicable cybersecurity testing cycles.
The final quarter of 2026 is a high-pressure period for CISOs, CTOs, and compliance officers. Missed deadlines or inadequate audit evidence can trigger regulatory scrutiny, monetary penalties, exchange-level restrictions, or other enforcement actions, depending on the applicable rules.
The immediate priority: Verify your regulatory category, complete outstanding testing, obtain the required auditor validation, and submit reports before the applicable deadline.
November–December 2026 Cybersecurity Compliance Calendar
The following deadlines arise from SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF) and relevant stock exchange circulars.
| Deadline | Compliance requirement | Applicable entities | Required action |
| November 30, 2026 | SEBI VAPT ATR / Revalidation Report | Self-certification, Small-size, Mid-size, and Qualified REs excluding QSBs, under the relevant FY 2025–26 cycle | Submit remediation closure evidence validated by a CERT-In empanelled auditor |
| December 31, 2026 | Half-Yearly Cyber Security and Cyber Resilience Audit Report | Qualified REs and Mid-size/Small-size trading members providing internet-based or algorithmic trading facilities | Complete the audit and submit the IT Committee-approved report through the applicable exchange mechanism |
| December 31, 2026 | QSB / CII VAPT Cycle 2 planning milestone | Designated Qualified Stock Brokers and relevant protected-system/CII entities | Confirm the applicable half-yearly VAPT reporting date and ensure the required testing is completed |
Important distinction: November 30 and the half-yearly cyber audit deadline of December 31 are supported by published exchange circulars. December 31 should not be treated as a universally established QSB/CII preliminary VAPT report deadline without the applicable entity-specific circular.
1. November 30, 2026: SEBI VAPT ATR and Revalidation Deadline
For applicable regulated entities, November 30 marks the deadline for submitting the Action Taken Report or Revalidation Report for the FY 2025–26 annual VAPT cycle.
The original cycle required testing by June 30, 2026, followed by VAPT report submission by July 31, 2026. The November submission demonstrates closure of identified vulnerabilities.
What compliance teams must verify:
- Remediation closure: Previously identified vulnerabilities have been addressed.
- Independent revalidation: The prescribed CERT-In empanelled auditor has verified the closure status.
- IT Committee approval: Required approvals have been obtained before submission.
- Supporting evidence: Detailed findings, remediation records, and applicable proof of concepts are retained.
- Exchange filing: The prescribed ATR or revalidation documents are submitted through the appropriate mechanism.
A completed initial VAPT report does not automatically establish that remediation obligations have been fulfilled.
2. December 31, 2026: Half-Yearly Cybersecurity Audit Submission
NSE Circular NSE/INSP/76768, dated October 7, 2026, establishes the December 31 deadline for the applicable half-yearly cyber audit covering the period ending September 30, 2026.
The prescribed NSE submission facility was scheduled to become available from October 16, 2026.
The corresponding ATR/Revalidation Report is due March 31, 2027, not December 31, 2026.
Under SEBI CSCRF, the relevant cyber audit scope includes:
- 100% of critical systems: Coverage of all critical information systems.
- 25% of non-critical systems: Sample-based examination with documented rationale.
- Compliance assessment: Evaluation against applicable CSCRF requirements.
- Auditor validation: Assessment by an eligible CERT-In empanelled auditor.
- Governance approval: Required IT Committee authorization before exchange submission.
A rushed year-end audit can uncover weaknesses that require additional remediation and evidence collection.
3. December 31, 2026: QSB and Critical Infrastructure Readiness
Qualified Stock Brokers (QSBs) and entities identified as protected systems or Critical Information Infrastructure (CII) have additional cybersecurity responsibilities.
These entities may be subject to half-yearly VAPT requirements and enhanced security oversight because of their systemic importance.
However, their VAPT schedules must be distinguished from the December 31 cyber audit reporting deadline applicable to other categories.
Compliance teams should confirm the latest NSE, BSE, depository, or other applicable reporting instructions before finalizing a filing calendar.
The key risk: Applying the wrong regulatory category or reporting cycle can result in missed obligations even when security testing has been performed.
RBI Cybersecurity Requirements: Compliance Does Not Wait Until December 31
Unlike exchange-specific reporting deadlines, RBI cybersecurity requirements operate throughout the year.
For applicable RBI-regulated entities, security testing is required at defined intervals and during important changes to information systems.
RBI VAPT Frequency Requirements
The RBI’s IT governance and related technology directions establish the following requirements for specified critical or customer-facing systems.
| Security activity | Required frequency | Compliance objective |
| Vulnerability Assessment (VA) | At least every 6 months | Identify security weaknesses |
| Penetration Testing (PT) | At least every 12 months | Validate exploitable vulnerabilities |
| Pre-implementation testing | Before deployment, as applicable | Identify risks before production |
| Post-implementation testing | After deployment | Validate the production environment |
| Major change assessment | After significant changes | Detect newly introduced vulnerabilities |
These frequencies apply to specified critical information systems and relevant DMZ/customer-facing environments. Non-critical systems may follow a risk-based testing schedule.
RBI also requires independent, appropriately trained security experts or auditors to conduct assessments.
Why New Applications and APIs Create Immediate Compliance Risk
Launching a digital payment application, introducing a new API, or significantly modifying critical infrastructure can trigger additional testing obligations.
For regulated financial institutions, completing an annual penetration test does not automatically eliminate the need to assess new or materially changed systems.
For CISOs, the practical question is: Has every relevant production deployment undergone the security testing required by the applicable RBI direction?
A missed assessment can create both a security exposure and an audit evidence gap.
IRDAI Cybersecurity Compliance: Remediation Timelines Matter
Insurance companies, brokers, intermediaries, and other IRDAI-regulated entities must maintain cybersecurity governance and vulnerability management processes.
The IRDAI Information and Cyber Security Guidelines, 2023, specified that high-risk VAPT findings should be closed within one month, followed by validation testing, with a two-month outer limit for audit-gap closure.
Regulatory update: IRDAI issued revised Information and Cyber Security Guidelines in April 2026. Organizations should validate their current remediation obligations against the 2026 guidelines rather than relying solely on the previous 30-day rule.
For insurance-sector security teams, this means prioritizing:
- High-risk vulnerabilities: Immediate assessment, ownership, and time-bound remediation.
- Customer-facing applications: Regular security testing and validation.
- Third-party integrations: Assessment of APIs and connected platforms.
- Remediation evidence: Documented proof that reported weaknesses have been addressed.
Closing a security finding internally is not the same as independently confirming that the vulnerability is no longer exploitable.
DPDP Act Compliance: Why Data Fiduciaries Must Prepare Now
The Digital Personal Data Protection (DPDP) Act, 2023, and DPDP Rules, 2025, introduce significant obligations for organizations processing digital personal data.
The framework applies to qualifying Data Fiduciaries, including businesses that determine the purpose and means of personal data processing.
What Changes in November 2026?
- November 2026: Consent Manager-related registration provisions become operational under the phased commencement schedule.
- May 2027: Major operational requirements, including reasonable security safeguards under Rule 6, are scheduled to take effect.
- Ongoing preparation: Organizations should evaluate data protection controls, third-party exposure, and breach readiness before those obligations commence.
Rule 6 identifies measures including encryption or masking, access controls, monitoring, logging, backups, and appropriate organizational safeguards.
Does the DPDP Act Make Penetration Testing Mandatory?
The DPDP framework requires applicable Data Fiduciaries to implement reasonable security safeguards once the relevant provisions commence. It does not prescribe a universal annual penetration testing frequency for every company.
However, penetration testing is a valuable method for demonstrating whether security controls effectively protect personal data.
Testing applications, APIs, authentication mechanisms, and cloud environments helps identify weaknesses before attackers exploit them.
For compliance officers, the priority is building defensible evidence that reasonable safeguards have been implemented and validated.
The CERT-In Accreditation Trap: Could Your VAPT Report Be Non-Compliant?
One of the most expensive compliance mistakes is commissioning an assessment without verifying the auditor requirements.
Under applicable SEBI CSCRF and exchange circulars, prescribed VAPT and cyber audit activities must be performed through a CERT-In empanelled information security auditing organization.
A technically detailed VAPT report may still fail compliance requirements if the organization conducting or validating it does not meet the applicable accreditation conditions.
Before selecting an auditor, verify:
- CERT-In empanelment: Confirm the auditing organization’s current status on the official CERT-In list.
- Legal entity: Ensure the report issuer matches the eligible empanelled organization.
- Required assessment scope: Confirm the testing methodology meets the applicable regulatory framework.
- Report format: Ensure findings and declarations follow exchange-prescribed requirements.
- Revalidation: Confirm that remediation verification and ATR support are included where required.
This distinction is critical: CERT-In empanelment requirements apply to specified audits and assessments, not universally to every cybersecurity service in India.
Why Automated Vulnerability Scans Alone Are Insufficient
Automated scanners identify potential security weaknesses. They cannot consistently establish the full business impact of those weaknesses or validate complex attack chains.
Manual penetration testing adds the necessary technical investigation.
| Automated scanning | Manual penetration testing |
| Detects known weaknesses | Validates exploitability |
| Identifies common misconfigurations | Examines complex attack paths |
| Produces vulnerability alerts | Explains business and security impact |
| Supports continuous monitoring | Tests authorization and business logic |
| Provides initial findings | Supports verified remediation evidence |
For a regulated organization, the objective is not simply to generate a report.
The objective is to demonstrate that identified security risks have been assessed, addressed, and independently validated.
Where the applicable rules require an ATR or Revalidation Report, that evidence is a formal component of the compliance process.
Free Resource: SEBI & RBI Cybersecurity Compliance Checklist
[Download Free] The SEBI & RBI Cyber Security Checklist.
Check your VAPT schedule, auditor eligibility, remediation status, reporting requirements, and supporting audit evidence before the year-end deadlines.
How Qualysec Helps Enterprises Prepare for Cybersecurity Compliance
Qualysec helps businesses identify, validate, and remediate security vulnerabilities through comprehensive penetration testing and security assessments.
Our approach combines automated vulnerability discovery with expert-led manual penetration testing to help enterprises strengthen their security posture and prepare defensible audit evidence.
Our VAPT and Compliance Support Includes
- Web Application and API Penetration Testing: Identify vulnerabilities in applications, authentication, APIs, and business workflows.
- Network and Infrastructure Testing: Assess internal and external infrastructure for exploitable weaknesses.
- Cloud Security Assessments: Evaluate cloud configurations, exposure, and access controls.
- Remediation Support and Retesting: Validate fixes and document the status of identified findings.
- Audit Readiness Support: Organize technical findings and remediation evidence against applicable regulatory requirements.
For submissions specifically requiring CERT-In empanelment, the assessment and sign-off must be carried out by an eligible empanelled auditing organization. Auditor eligibility should be confirmed as part of the engagement scope.
Qualysec’s focus is straightforward: Help security teams uncover meaningful vulnerabilities, resolve critical risks, and approach compliance reviews with stronger evidence.
What CISOs and Compliance Officers Should Do Before December 31
Organizations approaching the final reporting window should prioritize five actions.
- Confirm applicability. Identify the correct SEBI category, RBI direction, IRDAI guideline, or other regulatory obligation.
- Review outstanding findings. Examine previous VAPT reports and determine which vulnerabilities remain unresolved.
- Validate auditor eligibility. Confirm applicable CERT-In empanelment and reporting responsibilities.
- Complete remediation and retesting. Address weaknesses and obtain the required closure evidence.
- Finalize approvals and submissions. Verify governance sign-offs, submission formats, portal access, and deadlines.
Do not leave remediation validation until the final week of December.
An assessment can reveal additional weaknesses, and fixing them may require changes to production systems, regression testing, and another validation cycle.
Frequently Asked Questions
What is the SEBI VAPT ATR deadline in November 2026?
The deadline is November 30, 2026, for applicable regulated entities under the relevant FY 2025–26 annual VAPT reporting cycle.
What is the NSE/BSE cybersecurity audit deadline in December 2026?
December 31, 2026, is the prescribed cyber audit report deadline for specified trading members covering the half-year ending September 30, 2026. The corresponding ATR deadline is March 31, 2027.
Is a CERT-In empanelled auditor mandatory for SEBI VAPT?
Yes, where the applicable SEBI CSCRF and exchange requirements prescribe an assessment by a CERT-In empanelled information security auditing organization.
How often is VAPT required under RBI guidelines?
For specified critical or customer-facing information systems, the applicable RBI directions generally require vulnerability assessment at least every six months and penetration testing at least annually. Additional testing may be required during the system lifecycle.
Can automated scans replace penetration testing for regulatory compliance?
Not where the applicable requirement calls for penetration testing or a broader independent security assessment. Automated scanning supports vulnerability discovery but cannot reliably replace manual validation of exploitability and security impact.
Final Call: Complete Your 2026 Compliance Readiness Before the Deadline
November 30 and December 31, 2026, are approaching. Outstanding vulnerabilities, incomplete remediation evidence, and delayed audit approvals can put regulatory submissions at risk.
For CISOs and compliance leaders, the strongest approach is to verify obligations now, complete required testing, and reserve sufficient time for remediation and revalidation.
Year-end audit demand can also reduce scheduling flexibility. Avoid relying on last-minute availability from qualified security testing providers or required CERT-In empanelled auditors.
Book Your 15-Minute Compliance Scoping Call
Discuss your regulatory requirements, application and infrastructure scope, VAPT readiness, and year-end testing priorities with Qualysec.
Secure your testing plan before the late-December rush. Contact the Qualysec Team Today.
