VAPT Audit Checklist 2026: Complete Guide for Indian Organisations

Vulnerability Assessment and Penetration Testing (VAPT) has moved from a best practice to a regulatory requirement for Indian organisations across banking, fintech, healthcare, and critical infrastructure sectors. With CERT-In's 2022 directions, RBI's updated cybersecurity framework, and SEBI's CSCRF mandates now firmly in effect, 2026 is the year Indian CISOs and IT managers must get their VAPT processes right — not just for compliance, but for genuine security resilience.

This comprehensive VAPT audit checklist covers everything Indian organisations need to know: how to define scope, what to test, what regulators expect, how to read a VAPT report, and how to evaluate and select a qualified VAPT provider. Whether you are preparing for your first VAPT engagement or strengthening an existing program, this guide gives you the practical framework to do it correctly.

VAPT combines two distinct but complementary activities. Vulnerability Assessment (VA) is a systematic process of identifying, classifying, and prioritizing security weaknesses across your IT environment using automated tools and manual review. Penetration Testing (PT) goes a step further — ethical hackers actively exploit discovered vulnerabilities to demonstrate real-world attack impact and the extent to which a breach could occur.

For Indian organisations, VAPT is no longer optional. The Indian cybersecurity regulatory landscape has hardened significantly. CERT-In now mandates that certain categories of organisations — including government bodies, critical sector entities, and companies falling under specific RBI and SEBI guidelines — engage only CERT-In empanelled organisations for VAPT work. Non-compliance can attract regulatory scrutiny, audit findings, and reputational risk.

Beyond compliance, the business case is clear. India recorded a sharp rise in cyberattacks targeting BFSI, healthcare, and manufacturing sectors through 2024 and 2025. Ransomware groups have specifically targeted mid-market Indian companies that lack mature vulnerability management programmes. A well-executed VAPT engagement identifies exploitable gaps before adversaries do.

The Indian Computer Emergency Response Team (CERT-In) maintains a list of empanelled information security auditing organisations. Under the IT Act and subsequent directions, government organisations and critical information infrastructure operators are required to engage only CERT-In empanelled firms for security audits including VAPT. Many private sector regulators have adopted the same requirement by reference.

When evaluating a VAPT provider, confirming their current CERT-In empanelment status is a non-negotiable first step. Empanelment is renewed periodically and requires firms to demonstrate technical capability, qualified personnel, and adherence to audit standards. Always verify the empanelment directly on the CERT-In website rather than relying solely on a vendor's claims.

The Reserve Bank of India's cybersecurity framework for banks, NBFCs, and payment system operators requires periodic VAPT as part of an organisation's security assurance program. RBI-regulated entities must conduct VAPT on internet-facing applications, mobile banking platforms, and core banking infrastructure at defined intervals — typically annually at minimum, with more frequent testing mandated for high-risk systems or following significant changes.

RBI's guidelines specifically call out the need for application security testing, network security assessment, and infrastructure vulnerability assessment. The findings must be reported to the Board or Risk Committee, and remediation must be tracked and evidenced. RBI supervisory teams have increasingly questioned organisations during inspections on the currency and quality of their VAPT reports.

SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), updated and reinforced through 2024 circulars, mandates that regulated entities — including stock brokers, depositories, asset management companies, and market infrastructure institutions — conduct comprehensive VAPT as part of their annual cyber audit. SEBI-regulated entities at higher classification tiers face more stringent requirements including half-yearly VAPT and mandatory reporting of critical findings.

Beyond RBI and SEBI, Indian organisations should be aware of VAPT requirements from IRDAI for insurance companies, NHA guidelines for healthcare entities handling ABDM and health data, TRAI directions for telecom operators, and MEITY guidelines for government digital services. Organisations in the payments space must also align with PCI DSS requirements which mandate annual penetration testing and quarterly vulnerability scans.

Defining scope accurately is the most critical step in any VAPT engagement. An under-scoped VAPT gives false assurance, while an over-scoped engagement wastes budget and delays results. The scope definition phase should be a structured exercise involving your CISO, IT infrastructure teams, application owners, and the VAPT provider.

A signed scope of work document and rules of engagement agreement must be in place before testing begins. This protects both the organisation and the VAPT provider, and ensures that testing activities are legally authorised. Without this documentation, penetration testing activities may be legally ambiguous under the IT Act.

Web application security testing forms the core of most VAPT engagements for Indian organisations, given the proliferation of customer portals, e-commerce platforms, banking applications, and SaaS products. The OWASP Top 10 provides a baseline, but a thorough web application VAPT goes significantly deeper.

For Indian fintech and banking applications, testers should specifically examine UPI integration security, payment gateway callback tampering, and OTP bypass vulnerabilities, which have been actively exploited in the Indian market. NACH mandate flows and loan disbursement APIs deserve dedicated testing attention.

Network penetration testing evaluates the security of your infrastructure from both external and internal vantage points. External network testing simulates an internet-based attacker; internal testing simulates a compromised insider or a threat actor who has gained initial access.

Indian organisations with data centres in Mumbai, Bengaluru, Hyderabad, or Chennai that use hybrid cloud architectures should ensure that the connectivity between on-premises and cloud environments is explicitly included in scope. Misconfigured AWS Direct Connect or Azure ExpressRoute peering has been a source of significant exposure in recent assessments.

API security deserves dedicated attention in 2026. As Indian organisations have accelerated digital transformation, APIs have become the primary attack surface. The OWASP API Security Top 10 provides the testing framework, but real-world API assessments must go beyond checklist compliance.

For organisations in the Indian fintech and BFSI space, API security testing must specifically cover account aggregation APIs (AA framework), ONDC integrations, and UPI APIs. These have unique business logic flows that require testers familiar with the Indian regulatory and payment ecosystem.

With the majority of Indian enterprises now running workloads on AWS Mumbai, Azure India, or GCP Mumbai regions, cloud security misconfigurations represent one of the most common and impactful findings in modern VAPT engagements. Cloud VAPT requires provider-specific expertise and must cover Infrastructure as a Service, Platform as a Service, and SaaS configurations.

The quality of the VAPT report is often the most visible indicator of the quality of the engagement. A professional VAPT report from a CERT-In empanelled provider should give you both executive-level clarity and technical-level depth. Understanding what a good report contains helps you evaluate providers and hold them accountable.

The executive summary should give board members and senior leadership a clear picture of the security posture without requiring technical expertise. It must include the overall risk rating, the number and severity distribution of findings, the most critical findings in plain language, comparison with previous assessment if applicable, and top recommended actions prioritized by risk.

Each finding in the technical section must include a unique finding ID, the affected asset and specific location (URL, IP, endpoint), a clear description of the vulnerability, evidence of exploitation (screenshots, request/response pairs, proof-of-concept output), CVSS score and severity rating, business impact statement explaining what an attacker could achieve, and specific remediation guidance appropriate for your technology stack.

Reports submitted to RBI, SEBI, or other Indian regulators must follow any format requirements specified in the applicable circular or framework. Some regulators require specific fields, summary tables, or sign-off formats. Confirm with your VAPT provider that they are familiar with the reporting format requirements for your specific regulatory obligation.

A VAPT engagement is not complete when the report is delivered. Remediation verification — commonly called retesting — is a critical phase that confirms your fixes are effective. Many Indian organisations overlook this step, creating compliance risk and false security assurance.

For RBI-regulated entities, the cybersecurity framework explicitly requires that VAPT findings be tracked to closure and that the status be reported to the Board's IT/Risk Committee. Maintaining an audit trail of remediation activity is essential for regulatory examinations. SEBI similarly requires evidence of finding remediation in annual cyber audit submissions.

Choosing the right VAPT provider is as important as the testing itself. The Indian market has seen a significant increase in vendors offering security testing services, with quality varying enormously. A structured evaluation process protects your organisation from low-quality assessments that create compliance checkbox ticks without genuine security value.

Ask shortlisted providers for references from clients in your sector and size range. A VAPT provider experienced with large Mumbai-based banks will have different strengths than one specializing in Bengaluru-based SaaS companies. Sector-specific experience matters because it shapes understanding of your business logic, regulatory obligations, and risk profile.

Determining how often to conduct VAPT is a function of regulatory requirements, risk appetite, and the pace of change in your environment. There is no single answer, but the following framework helps Indian organisations make structured decisions.

Indian organisations undergoing digital transformation projects — migrating to cloud, launching new mobile banking features, or integrating with ONDC, AA framework, or new payment rails — should treat each major milestone as a trigger for targeted VAPT. Waiting for the annual cycle after a significant architectural change introduces unnecessary risk.

VAPT should not be a one-time compliance exercise managed entirely by an external vendor. Indian organisations with mature security programmes embed VAPT into a broader governance framework that ensures findings drive real improvement.

For Indian companies listed on NSE or BSE, cybersecurity disclosures in annual reports and incident reporting under SEBI regulations create additional incentive to maintain a well-documented VAPT program. A mature program with consistent records demonstrates due diligence to regulators, auditors, and investors.

CyberSigma is a CERT-In empanelled cybersecurity firm with deep expertise in serving Indian organisations across BFSI, fintech, healthcare, manufacturing, and government sectors. Our VAPT engagements are led by certified professionals — OSCP, CREST, and CEH — who bring hands-on offensive security expertise combined with thorough understanding of the Indian regulatory landscape.

We understand that Indian CISOs and IT managers face unique pressures: RBI and SEBI examination timelines, CERT-In reporting obligations, and the need to demonstrate genuine security improvement alongside compliance checkbox completion. CyberSigma's approach combines rigorous manual testing methodology with regulatory-ready reporting that satisfies auditors and boards alike.

Our clients range from large private sector banks headquartered in Mumbai to high-growth fintech startups in Bengaluru and Hyderabad, manufacturing companies in Pune and Chennai, and government agencies across India. We bring the same rigorous methodology and accountability to every engagement, regardless of size.

A vulnerability assessment identifies and classifies security weaknesses using automated tools and manual review — it tells you what vulnerabilities exist. A penetration test goes further by actively exploiting identified vulnerabilities to demonstrate real-world attack impact — it tells you what damage an attacker could actually do. Most compliance frameworks and regulators in India require both, which is why they are typically delivered together as VAPT.

CERT-In empanelment is mandatory for government organisations and critical information infrastructure operators under India's IT Act and CERT-In directions. For RBI-regulated entities, SEBI-regulated entities, and other private sector organisations, empanelment is strongly recommended and is required by some sector-specific frameworks. Even where not strictly mandated, engaging a CERT-In empanelled firm is considered a baseline quality standard and significantly reduces regulatory risk.

Duration depends heavily on scope. A focused web application VAPT for a single application of moderate complexity typically takes 5 to 10 business days of active testing. A comprehensive infrastructure and application VAPT covering multiple systems, internal and external networks, and cloud environments can take 3 to 6 weeks. Add additional time for reporting, remediation, and retesting. Be wary of providers promising turnaround in 1-2 days for complex engagements — this is not enough time for genuine manual testing.

For grey-box testing — which delivers the best balance of depth and efficiency — provide the VAPT team with architecture diagrams, application documentation, API documentation, user account credentials at multiple privilege levels, network diagrams showing IP ranges and segments in scope, and details of any previous assessments. The more context the team has, the more efficiently they can focus testing on high-risk areas rather than spending time on reconnaissance that you could provide directly.

A responsible VAPT provider will notify you immediately upon discovering a critical exploitable vulnerability rather than waiting for the final report. You should have a defined escalation path in place before testing begins — typically the CISO or IT security lead as primary contact. Upon notification, assess whether the vulnerability requires emergency patching or compensating controls before testing continues. Some organisations choose to pause testing of the affected system while emergency remediation is applied. This real-time communication protocol should be explicitly agreed upon in the rules of engagement.

Yes, but with important caveats. AWS, Azure, and Google Cloud have specific policies governing penetration testing of their infrastructure. Generally, testing your own resources (applications, VMs, databases, storage) is permitted, but testing the cloud provider's underlying infrastructure is not. You do not need advance permission from AWS or Azure for standard penetration testing of your own cloud resources, but you must stay within their acceptable use policies. Your VAPT provider should be familiar with these policies. For dedicated connections like AWS Direct Connect or Azure ExpressRoute, specific rules apply.

VAPT pricing in India varies widely based on scope, complexity, and provider expertise. A focused web application VAPT for a single application might range from INR 80,000 to INR 3,00,000. A comprehensive enterprise VAPT covering network, applications, APIs, and cloud infrastructure can range from INR 5,00,000 to INR 25,00,000 or more. Be cautious of very low-cost providers — genuine expert manual testing requires significant skilled labor hours. When evaluating cost, consider the total engagement including retesting, not just the initial testing phase.