Financial Services
VAPT for Banks, NBFCs and Fintechs in India
The RBI's Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 set an NBFC's testing calendar: vulnerability assessment at least once every six months and penetration testing at least once every 12 months, on critical systems and customer-facing systems in the DMZ, by appropriately trained and independent information security experts or auditors. SecureRoot Risk Advisory LLP does that testing by hand, proves every finding, sends critical issues within three hours, and retests inside the same engagement. The closure evidence reaches your file before the audit, not after it.
Regulators
What Your Regulator Asks of Testing
Read the clause, not a summary. Each row links the regulator's own text and quotes the obligation that sets your calendar. Confirm which chapter reaches your entity before planning dates.
- Who it covers
- NBFCs. Chapter V, which carries the testing clauses, reaches the Top, Upper and Middle layers only. Chapter III covers base-layer NBFCs below Rs 500 crore and Core Investment Companies; Chapter IV the base layer at Rs 500 crore and above. Confirm your layer first.
- What it expects of testing
- Para 121: VA at least once every six months and PT at least once in 12 months for critical information systems and those in the DMZ with a customer interface, plus VA/PT throughout the lifecycle — pre-implementation, post-implementation and after changes. Para 122: by “appropriately trained and independent information security experts / auditors”. Para 123: a risk-based approach decides whether and how often non-critical systems are tested.
RBI — commercial banks
- Who it covers
- Commercial banks; small finance banks have their own instrument of the same date.
- What it expects of testing
- The equivalent clause is para 151, and the cadence reads across. Payments banks, credit information companies and all-India financial institutions should confirm which 2026 instrument now applies to them.
- Who it covers
- SEBI-regulated entities, graded from market infrastructure institutions down to self-certification.
- What it expects of testing
- One VAPT a year from the first quarter, or one each half-year for NCIIPC-identified protected systems and, per the June 2025 FAQs, Qualified Stock Brokers. Report within one month, closure within three, revalidation within five. Our SEBI CSCRF guide tracks the clarifications.
Two more clauses go into the scope document before testing starts. Para 124 expects post-implementation VA/PT on the production environment. Para 125 expects identified vulnerabilities to be fixed in a time-bound manner, and names the CVE database as a reference.
Services
What We Test and Review
The Systems the Directions Ask About
Para 121 starts at critical information systems and the DMZ systems with a customer interface: internet and mobile banking, onboarding and lending journeys, partner and payment APIs, the network edge, the cloud accounts underneath.
- Web ApplicationManual testing of your web apps against the OWASP WSTG
- Mobile ApplicationAndroid and iOS app testing against the OWASP MASVS
- APIREST, GraphQL and SOAP testing against the OWASP API Top 10
- Network InfrastructureExternal and internal network testing with lateral movement
- CloudConfiguration and IAM testing across AWS, Azure and GCP
- Thick Client ApplicationDesktop app testing across binary, traffic and backend
Beyond the Test Cycle
The Directions look past the report: hardened configuration, a tested response, an Information Security Committee that approves deviations, and someone who owns security at board level.
- Active Directory and Domain Controller AuditSecurity review of your AD forest, domain controllers and privilege paths
- Firewall and Perimeter ReviewRule-base and configuration review of your firewalls, VPNs and edge devices
- Red Team AssessmentGoal-based adversary simulation across people, process and technology
- vCISOSenior security leadership on demand, without a full-time hire
When Testing Feeds a Wider Programme
Card data, customer data and third-party risk carry their own obligations. One scope can serve several, so a test is scoped as evidence for every control it touches.
Who Signs
When You Actually Need a CERT-In Empanelled Auditor
Empanelment binds in some places and is absent in others, and procurement tends to mix the two up. Here is where it applies, where it does not, and what we will not claim either way.
The RBI 2026 VA/PT cadence
- Does it name empanelment?
- No. The wording is “appropriately trained and independent information security experts / auditors”.
- What that means for you
- Independence and competence are the test, evidenced by the scope document, the method, the testers' credentials and the retest record. We do this work and sign our own report.
RBI incident reporting
NBFC Directions, para 141
- Does it name empanelment?
- CERT-In appears here, and only here, in the whole Direction.
- What that means for you
- A notification duty, not a qualification for testers. Incidents go to RBI within six hours of detection on the DAKSH platform, with CERT-In notified pro-actively. Housing Finance Companies report to NHB, not RBI. Filing stays your obligation.
A SEBI CSCRF cyber audit
CSCRF, and the clarifications after it
- Does it name empanelment?
- Yes. CSCRF cyber audits are to be carried out by CERT-In empanelled auditors; confirm the current wording for your category.
- What that means for you
- We do not sign those, and we say so before you buy. A CSCRF cycle is where we run the pre-audit testing and the empanelled auditor signs the audit.
A tender, an RFP or a customer contract naming empanelment
The document itself
- Does it name empanelment?
- Sometimes, and only the document itself can tell you.
- What that means for you
- We claim no general rule here, because there is not one to claim. Send us the clause on the scoping call and you get an answer in that call about whether we can sign it.
SecureRoot Risk Advisory LLP is not a CERT-In empanelled information security auditing organisation. Where an empanelled signature is genuinely required, the next step is short: we run the testing, the fixes and the retest, the empanelled auditor signs the formal report, and you hold both.
How It Runs
The Pre-Audit, Remediation and Retest Package
One engagement, three parts, one price fixed after scoping. It is built to land before your audit window, not during it.
01
Scope Against Your Inventory and Your Layer
You hear back within one business day. On the call we map your critical and customer-facing DMZ systems against the chapter that reaches you. Targets, windows, rules of engagement and the price go in writing before anyone starts, and windows respect change freezes and settlement cycles.
02
Pre-Audit Testing, by Hand
Manual exploit-driven testing, backed by tooling rather than replaced by it. Every finding carries a reproduction, a justified severity and a fix that names the component to change. Critical findings reach you within three hours of discovery, not at the end.
03
Remediation Support
The tester who found the flaw explains it to the developer who has to change the code, with CVE references where they exist. That gives you a closure path inside the time-bound expectation of para 125. Where a vendor operates the system, we need their written authorisation too, and getting it is usually the long pole.
04
Retest to Closure
Once fixes land we retest inside the same engagement: no second purchase order, no new scoping round. You hold a verified retest report of what closed and what still stands, for your board pack, your auditor and your regulator file.
Our Role
Where We Sit, and Where the Empanelled Auditor Does
For the obligation that drives most of these purchases, empanelment does not arise. Para 122 asks for independent, appropriately trained testers. That is the work we do, and we sign it.
Where an empanelled signature is required, what we change is how that audit goes: the same systems tested earlier and by hand, findings proved rather than inferred, fixes closed with your developers, each one retested. The formal cycle then confirms controls that already hold instead of opening a remediation list that runs past your deadline.
The same testing serves the rest of the year: after a major release, before a partner integration goes live, and as evidence for ISO 27001, PCI DSS and DPDP Act work. SecureRoot Risk Advisory LLP holds ISO/IEC 27001:2022 certification (certificate IN60432E), and engagements are led by named testers holding credentials including CISM and eWPTX.
Who It Is For
Who We Test For
Financial-services teams whose systems face a regulator, a partner bank or both.
Banks and Small Finance Banks
Internet and mobile banking, onboarding, and the internet-facing estate an RBI inspection reads the test reports for.
NBFCs
Lending platforms, loan management systems and collection apps, scoped to the chapter that reaches your layer.
Payment Aggregators and Gateways
Checkout flows, merchant dashboards and payment APIs, where card data brings PCI DSS into the same scope.
Stockbrokers, AMCs and Depository Participants
Trading apps, client portals and back-office integrations, tested ahead of your CSCRF cycle.
Fintechs Serving a Regulated Partner
Companies whose bank or NBFC partner passes its testing expectations down the contract.
Insurers and Insurtechs
Policy, claims and distribution platforms, and the partner APIs that connect them to aggregators.
Do the RBI 2026 Directions require a CERT-In empanelled auditor for VAPT?
No. Para 122 of the NBFC Directions of 31 July 2026 says VA and PT “shall be conducted by appropriately trained and independent information security experts / auditors”. It does not mention empanelment. Across the whole Direction, CERT-In appears once, at para 141, and that paragraph is about notifying incidents rather than about who may test. So for the six-monthly VA and annual PT in para 121, what an inspection team needs to see is independence and competence: who tested, what they hold, what method they followed, what was in scope, and what the retest found. SecureRoot Risk Advisory LLP does that work and signs its own report. Empanelment becomes relevant through a different document — a SEBI CSCRF audit, a tender clause, a customer contract — and when it does, that auditor signs and we test beside them. SecureRoot is not a CERT-In empanelled auditing organisation, and we say which case you are in on the first call.
How often must an NBFC run VA and PT, and which chapter applies to us?
Para 121 sets two clocks. Vulnerability assessment runs at least once every six months. Penetration testing runs at least once in 12 months. Both cover critical information systems and those in the DMZ with a customer interface, and both run from your last test rather than from your audit date. On top of the calendar, VA/PT is expected across the system lifecycle: pre-implementation, post-implementation and after changes. For non-critical systems, para 123 lets a risk-based approach decide whether and how often you test. Check your chapter before planning. Chapter V, which carries these clauses, reaches NBFCs in the Top, Upper and Middle layers. Chapter III covers base-layer NBFCs below Rs 500 crore and Core Investment Companies, and Chapter IV the base layer at Rs 500 crore and above.
Does post-implementation testing have to run on production?
Para 124 expects it to. Post-implementation VA/PT is to be performed on the production environment, which is a change from testing a convenient replica and calling it done. Where production genuinely cannot be used, the Direction allows a test environment whose version and configuration resemble production, with any deviation documented and approved by the Information Security Committee. That approval is an artefact you need to keep, not an informal decision. Practically, we scope around the data rather than the hostname: test credentials at each role, synthetic or masked records where possible, named accounts and test windows in the written scope, and out-of-bounds actions listed before we start. No denial of service, no destructive payloads, no bulk extraction of records. A proof of concept stops where the issue is demonstrated.
Who do we report a cyber incident to, and how fast?
Para 141 of the NBFC Directions requires cyber incidents to be reported to the RBI within six hours of detection, through the DAKSH platform, with CERT-In notified pro-actively. If you are a Housing Finance Company, the report goes to the National Housing Bank instead of the RBI, which is worth settling before you need it. CERT-In's own Directions of April 2022, under section 70B(6) of the IT Act, carry a separate six-hour duty binding body corporates generally. None of this is a testing cadence, but it shapes a test: detection and logging get exercised alongside the applications. The written scope fixes our source addresses and test windows, so afterwards you can line our activity up against your own alerts and see which actions raised nothing. Reporting an actual incident stays your obligation.
What is in the package, and what is not?
Three parts, one price, fixed after scoping. The pre-audit test: a written scope drawn from your critical systems inventory, manual exploit-driven testing, and a report where every finding carries a reproduction, a justified severity and a named fix. Remediation support: critical findings inside three hours of discovery, and the tester who found the flaw explaining it to the developer who has to change the code. Retest to closure: inside the same engagement, with a verified retest report for your board, your auditor and your regulator file. Not in it: a signature from a CERT-In empanelled auditor, a SOC 2 report, an ISO 27001 certificate, or the filing of your incident reports. We are not a CPA firm and not an accredited certification body. Where one of those is what you need, we say so on the call.
Related Reading
Articles on VAPT for Banks, NBFCs and Fintechs
- SEBI CSCRF Compliance Guide: Categories, Audits, VAPT and SOC
- RBI Cybersecurity Directions 2026: What Regulated Entities Must Do Now
- CERT-In Directions Compliance in India: 6-Hour Reporting, Logs and NTP
- CERT-In Incident Reporting: The Six-Hour Runbook
- How Often Should VAPT Be Done? Annual Baseline, Change Triggers and Regulator Cadence in India
- Penetration Testing Cost in India: 2026 Pricing Guide
- API Security Testing Services: OWASP API Top 10 Coverage and Retesting
- Types of Penetration Testing: A Complete Guide
Ready When You Are
Tell us what is due and who is asking. You will leave the call with a written scope, a timeline and a fixed price, and an honest answer if we are not the right firm for it.