The Multi Commodity Exchange Clearing Corporation Limited (MCX) on July 237, 2026, clarifies revised VAPT Submission Timelines under SEBI Cybersecurity and Cyber Resilience Framework.
The following has been stated:
• MCX has issued a clarification regarding the timelines for submission of Vulnerability Assessment and Penetration Testing (VAPT) reports under SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs). The clarification is based on SEBI circulars issued from August 20, 2024 onwards, including subsequent clarification circulars and FAQs, as well as earlier MCX technology circulars.
• For Self-certification REs, Small-size REs, Mid-size REs, and Qualified REs that are not categorized as Qualified Stock Brokers (QSBs), VAPT is required once annually for the financial year April 01, 2025 to March 31, 2026. Such entities shall conduct VAPT through a CERT-In empanelled auditor by June 30, 2026. The VAPT report, after approval by the respective IT Committee, shall be submitted by July 31, 2026. Where applicable, the Action Taken Report (ATR) or revalidation report confirming closure of observations through the same CERT-In auditor, after IT Committee approval, shall be submitted by November 30, 2026. REs are required to initiate the VAPT activity only after completion of the financial year.
• For trading members categorized as QSBs and REs identified as Protected Systems and/or Critical Information Infrastructure (CII) by NCIIPC, there is no change in the existing timelines. For the half-yearly period October 01, 2025 to March 31, 2026, VAPT shall be conducted through a CERT-In auditor and the approved report submitted by June 30, 2026. The ATR or revalidation report, where applicable, shall be submitted by September 30, 2026.
• Trading members registered with NSE as well as other exchanges such as BSE, MSE, MCX, or NCDEX and using algorithmic software across any exchange are required to submit VAPT details only to NSE, which will share the submission with the other concerned exchanges.
[Notification no. - MCX/TECH/433/2026]
