The National Stock Exchange (NSE), on November 27, 2025, notified regarding the revision in Terms of Reference (TOR) for submission of system audit report & submission of Vulnerability Assessment and Penetration Testing (VAPT) report for Vendors providing Co-Location as a Service (CaaS) facility.
The following has been stated namely: -
• In accordance with Exchange circular number NSEIFSC/TRADE/2106 dated April 25, 2025, CaaS vendors are required to submit Half yearly System Audit Report along with a Vulnerability Assessment and Penetration Testing (VAPT) report to the Exchange as per timelines specified in the aforesaid circulars.
• CaaS vendors are requested to note that the Terms of Reference (TOR) have been revised and the same is provided as an annexure to this circular (refer Annexure A).
• CaaS vendor needs to submit System Audit report and VAPT Report before onboarding the first member. Member onboarding on CaaS platform without submission of initial System Audit Report and VAPT Report shall not be permitted.
[Circular no. NSEIFSC/TRADE/2392]
