The Bombay Stock Exchange (BSE) on June 19, 2026, issued Reminder for Submission of VAPT report for FY 2025-26.
The circular reiterates the requirement for submission of the VAPT (Vulnerability Assessment and Penetration Testing) report for FY 2025–26 through the BEFS portal within the prescribed timelines to avoid penal or disciplinary action.
For entities classified as QSBs and those identified as ‘Protected Systems’ or Critical Information Infrastructure (CII), the VAPT for the half-year period (October 1, 2025 to March 31, 2026) must be conducted by a CERT-In empanelled auditor and submitted after IT Committee approval by June 30, 2026.
For other entities such as self-certification REs, small, mid-size, and qualified REs (not categorized as QSBs), VAPT is required annually for FY 2025–26. Members registered with NSE must submit their reports only to NSE under the common submission mechanism, while others must submit directly to the Exchange via the BEFS portal.
The Exchange has also provided user manuals for members and auditors to facilitate the submission process and ensure proper compliance with the VAPT audit requirements.
[Notice No. 20260619-36]
