The Central Depository Services (India) Limited (CDSL), on October 30, 2026, prescribed timelines and requirements for submission of Cyber Security and Cyber Resilience Audit Reports by Depository Participants (DPs), in accordance with SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF) Circular dated 20 August 2024 and subsequent clarifications. The cyber audit must cover 100% of critical systems and 25% of non-critical systems selected on a sample basis, with the auditor documenting the rationale and sample size. Any unaudited period arising due to a change in the entity’s category at the beginning of a financial year must be included in the current audit cycle.
The communiqué prescribes half-yearly audit reporting for the period April 2026 to September 2026 for Qualified REs and Mid-size and Small-size REs providing Internet-Based Trading (IBT) or Algo Trading facilities as stockbrokers. The Preliminary Audit Report must be submitted by 31 December 2026, and the Action Taken Report (ATR), wherever applicable, by 31 March 2027. DPs/REs holding multiple SEBI registrations must independently determine their applicable category under the CSCRF, obtain approval from the Board of Directors/designated authority, as applicable, and have the auditor verify the categorisation during the cyber audit.
The cyber audit report must include management comments and provide compliance status for each Term of Reference (TOR) item as Compliant, Non-Compliant or Not Applicable, with justification for any item marked Not Applicable. DPs/REs must also follow CERT-In’s Comprehensive Cyber Security Audit Policy Guidelines and the auditor selection norms specified in the communiqué. Submission shall be considered complete only after the report, along with management comments, is submitted to CDSL. Failure to submit within the prescribed timelines will be treated as non-compliance and may attract penalties under CDSL Communiqué No. CDSL/AUDIT/DP/POLCY/2025/105 dated 12 February 2025.
[CDSL Communiqué No. CDSL/AUD/DP/POLCY/2026/765]
