VAPT for NBFC: Frequency, RBI Rules and Fixing Findings
VAPT for NBFCs: How Often to Test, What RBI Expects and How to Fix Findings Fast
Last reviewed: November 2026
VAPT for NBFC means running regular vulnerability assessments and penetration tests on the systems that hold customer data and move money, as RBI's cybersecurity directions require. The rules changed on 31 July 2026, so many security calendars and policies are now out of date.
This guide is for CISOs and CTOs at NBFCs and digital lenders. It covers the new test frequencies, what a lending-stack scope should include, and a remediation process that closes findings quickly with evidence.
Key Takeaways
- RBI issued new NBFC cybersecurity directions on 31 July 2026, with immediate effect, repealing earlier IT framework instructions for NBFCs.
- Middle, Upper and Top Layer NBFCs must run VA at least every six months and PT at least every 12 months on critical and customer-facing systems.
- Testing must be independent, on production, and repeated before go-live, after go-live and after changes.
- Findings must be fixed in a time-bound manner, and cyber incidents must reach RBI within six hours.
What Does RBI Now Expect on VAPT?
RBI expects risk-based, independent and documented testing, with the strictest rules for larger NBFCs. The source is the Reserve Bank of India (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026.
These directions replaced the November 2023 IT governance direction for NBFCs. Saved actions under the old rules remain valid, but your policy references should now cite the 2026 text.
| NBFC Category | What the 2026 Directions Say | Practical Reading |
|---|---|---|
| Base Layer, assets below ₹500 crore | Robust information and cyber security controls; scale up IT progressively | No fixed VAPT cycle, but annual testing of internet-facing apps is prudent |
| Base Layer, ₹500 crore and above | Vulnerability management process; independent checks; IS audit at least once a year | Build a scan, triage and patch cycle with yearly assurance |
| Middle, Upper and Top Layers | VA every six months, PT every 12 months, independent testers, production testing | Full programme with documented scope, scoring and closure |
The penalty for weak testing rarely arrives as a VAPT observation alone. It shows up as a breach, a supervisory finding on IT risk, or an LSP incident the NBFC is liable for.
Who Owns VAPT Inside the NBFC?
For Middle Layer and above, ownership is deliberately split. The CISO runs the security function but must not report to the Head of IT or carry business targets.
The Information Security Committee works under the IT Strategy Committee, and its head must come from the risk management vertical. The CISO must also review cyber risks with the Board, its risk committee or the IT Strategy Committee at least quarterly, which is the natural forum for VAPT status.
How Often Should Each System Be Tested?
Test frequency depends on criticality and exposure, not on a single annual date. The six-month and twelve-month cycles are minimums for critical systems and those in the de-militarised zone with a customer interface.
| System | Typical Classification | Minimum Cadence for Middle Layer and Above |
|---|---|---|
| Borrower mobile app and web portal | DMZ, customer interface | VA six-monthly, PT yearly, plus after each major release |
| Loan origination system | Critical | VA six-monthly, PT yearly |
| Loan management system | Critical | VA six-monthly, PT yearly |
| Partner APIs for LSPs and co-lenders | DMZ, customer interface | VA six-monthly, PT yearly, plus on new partner go-live |
| Payment and collection links | DMZ, customer interface | VA six-monthly, PT yearly |
| Internal analytics and HR tools | Non-critical | Risk-based, set by policy |
Lifecycle testing matters as much as the calendar. RBI expects VAPT before implementation, after implementation and after changes, so a new LSP integration should not wait for the next half-yearly cycle.
What Should a Lending-Stack VAPT Scope Cover?
A useful scope follows the money and the data. Generic network scans miss the places where lending fraud and data leaks actually happen.
- APIs and authorisation logic. Test whether one borrower can see another borrower's loan, KFS or repayment schedule.
- Disbursal and repayment flows. Check that bank account details, amounts and payment links cannot be altered in transit.
- Mobile app permissions and storage. Confirm no sensitive data is cached on the device and no prohibited permissions are requested.
- Login, OTP and session handling. Test OTP reuse, brute-force limits and session expiry, because account takeover leads straight to fraudulent disbursals.
- Cloud configuration. The directions extend the documented VAPT approach to cloud-hosted systems.
- Vendor code. Vendors must confirm their applications are free of known vulnerabilities, malware and covert channels, after every material change.
For a deeper adversary-style exercise beyond routine VAPT, Digiqt's guide to threat-led penetration testing in financial services explains how scenario-based testing differs.
Does your VAPT scope cover every LSP API, payment link and app release your borrowers touch?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build lending platforms and APIs with security testing planned from the start.
How Do You Fix VAPT Findings Fast?
Speed comes from ownership and evidence, not from heroics after the report lands. A repeatable workflow keeps findings from ageing quietly.
- Score consistently. Use the vulnerability scoring method named in your documented VAPT approach, such as CVSS, and add business context.
- Assign one owner per finding. Map each finding to an application owner, not to "IT".
- Set board-approved timelines. RBI requires time-bound fixes but leaves the days to you.
- Retest before closing. A finding is closed only when the tester confirms the fix.
- Hunt for recurrence. The directions expect known CVE-listed vulnerabilities not to reappear.
- Report risk acceptance. Anything not fixed needs a documented exception approved at the right level.
What Evidence Should Each Cycle Leave Behind?
Supervisors and auditors judge a VAPT programme by its paper trail. Each cycle should produce a small, consistent evidence pack.
| Artefact | Why It Matters |
|---|---|
| Approved scope with asset list | Proves critical and DMZ systems were covered |
| Tester independence note | Shows the experts were trained and independent |
| Environment statement | Confirms production testing, or an ISC-approved deviation |
| Scored findings register | Links each finding to an owner and a deadline |
| Retest results | Evidence that closures are real, not self-declared |
| Exceptions log | Shows who accepted residual risk, and until when |
Keep the pack for vendor and cloud systems too. The directions apply the same documented approach to cloud-hosted information systems.
What Does a Remediation Tracker Look Like in Practice?
This is an illustrative scenario, and the timelines are assumptions a board might set. A Middle Layer NBFC's half-yearly VA returns 60 findings.
| Severity | Findings | Illustrative Timeline | Closed by Day 30 | Risk Weight |
|---|---|---|---|---|
| Critical | 4 | 7 days | 4 | 10 |
| High | 11 | 30 days | 9 | 5 |
| Medium | 25 | 60 days | 10 | 2 |
| Low | 20 | 90 days | 6 | 1 |
| Total | 60 | 29 |
By count, only 29 of 60 findings are closed, or 48%. Weighted by risk, the picture changes: total exposure is 165 points (40 + 55 + 50 + 20), and 111 points are retired (40 + 45 + 20 + 6), or 67%.
The two overdue high-severity items are the real board issue. Reporting risk-weighted closure alongside overdue items tells leadership more than a simple percentage.
Digiqt's cyber risk quantification AI agent shows how technical findings can be translated into business exposure for risk committees.
Which VAPT Mistakes Do NBFCs Make?
Most failures are process failures, not tool failures.
- Citing the repealed 2023 direction. Policies, RFPs and audit reports should reference the July 2026 directions.
- Testing a staging copy that differs from production. Test environments are allowed only in unavoidable cases and must match production.
- Skipping post-change tests. A new LSP API or app release counts as a change.
- Using the same team to build and test. RBI requires independent testers, and the CISO must not report to the Head of IT.
What Is Changing Next?
The July 2026 directions apply with immediate effect and set no transition period. NBFCs should map current practice against them now rather than wait for the next inspection cycle.
AI is also widening the attack surface. NBFCs deploying chatbots or AI agents across lending operations should add those interfaces, and the APIs behind them, to the VAPT scope.
Incident response is tied to testing. Middle Layer and above must report cyber incidents to RBI within six hours on the DAKSH platform, and CERT-In's 2022 directions carry a separate six-hour reporting duty.
CERT-In also issued Comprehensive Cyber Security Audit Policy Guidelines on 25 July 2025 for auditors and auditees. Digiqt's IT incident impact assessment AI agent shows how triage can support those short reporting windows.
Could you show RBI a closed, retested trail for every critical finding this year?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build secure onboarding, disbursal and repayment systems for lenders.
