SEBI's CSCRF says that for any production release a vulnerability assessment shall be done, and for major releases VAPT, for all regulated entities except small-size and self-certification ones. It also asks all entities for security requirements in the business requirement document, threat modelling, application security testing and reference to OWASP standards such as ASVS.
What the framework says
In the secure software development lifecycle controls (PR.IP):
- Regression testing before new or modified systems go live, covering business logic, security controls, performance under stress and recovery conditions.
- Vulnerability assessment for any production release.
- VAPT for all major releases, to check risk from recent additions and modifications.
- A business requirement document that states security requirements, session management, audit trail, logging, data integrity, security event tracking and exception handling.
- Threat modelling and application security testing during development.
- Reference to OWASP security guidance, with OWASP ASVS given as an example.
The summary section adds related items: separate production and non production environments for critical systems, API security with rate limiting, throttling and proper authentication, and periodic audits by a CERT-In empanelled auditor.
Applicability note
The regression testing and release VA and VAPT controls are marked for all regulated entities except small-size and self-certification ones. The threat modelling and OWASP controls are marked for all. The framework groups entities into five categories by size and role, so find your customer's category before you promise a cadence.
Mapping to a pipeline
- Requirements: add a security section to the requirements template covering the listed items.
- Design: a threat model for each major feature, kept with the design record.
- Build: static analysis and dependency scanning on every commit.
- Test: regression suites that include security control tests, such as access checks and logging.
- Release gate: a vulnerability assessment result attached to the release, with a block on unresolved high findings.
- Major release: schedule VAPT before go live and keep the report.
- Environments: keep production data out of test.
What evidence to keep
For each release: scan output, who approved it, exceptions with reasons, and the VAPT report where applicable. Auditors will look for the link between the release and its assessment.
A note on currency
This reads the 20 August 2024 circular. SEBI has issued later communications, so confirm timelines on the current site.
Try it yourself
In the demo, a pull request is checked by a gate before merge. Look at what the gate records for the audit trail.
Click through it at your own pace, or open it full screen.
Safeguard policies and gates can enforce release checks, and its SAST and dependency scanning feed them. They support your process but do not replace VAPT.
Quick check
Is VA needed for every hotfix?
The text says for any production release. Treat a hotfix as a release unless the customer's policy says otherwise.
Sources
Last reviewed: 19 October 2026.
