What changed, why it matters, and what security teams should do now
Cybersecurity testing in India is no longer just about finding bugs and producing a report. In 2026, the real conversation has shifted toward incident reporting, log retention, cyber resilience, personal data protection, and proof of remediation. That means VAPT now sits inside a much larger compliance picture.
At a glance
- CERT-In directions require rapid incident reporting and log retention.
- SEBI CSCRF pushes regulated entities toward stronger cyber resilience and broader testing.
- DPDP Act and Rules raise the bar for personal-data protection and governance.
1. CERT-In made incident response a hard requirement
One of the biggest shifts came from CERT-In's directions under Section 70B of the IT Act. The official guidance requires certain cyber incidents to be reported within 6 hours of noticing them and requires organisations to maintain logs of ICT systems securely for a rolling 180 days. CERT-In also expects these logs to be maintained within Indian jurisdiction.
For security testers, this changes the practical outcome of an assessment. It is no longer enough to say an issue exists. Teams now need evidence that the organisation can detect it, log it, report it, and respond to it quickly.
2. SEBI's CSCRF broadened the security baseline
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued in August 2024 and later extended for adoption in 2025, formalised a stronger compliance model for SEBI-regulated entities. SEBI also published FAQs on CSCRF and cloud adoption in June 2025.
In practice, that means security testing is expected to look beyond a single web application. Modern assessments increasingly cover web apps, APIs, cloud services, mobile apps, infrastructure, access control, and resilience controls. This is a stronger and wider scope than the older "annual VAPT report" mindset.
3. DPDP Act and Rules turned privacy into an engineering problem too
India's Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data in a manner that protects individual rights while allowing lawful processing. The Digital Personal Data Protection Rules, 2025 were later notified, and the government also established the Data Protection Board of India for enforcement.
For cybersecurity teams, privacy compliance is not just a legal checklist. It affects access control, data minimisation, retention, audit trails, breach response, and how test environments are built. Security testing now has to protect real personal data paths, not just application logic.
4. What this means for VAPT teams
The strongest change is this: testing is now judged by operational readiness as much as by technical findings. A good report should answer more than "what is vulnerable?" It should also answer "how fast can this be detected?", "how is it logged?", "who receives the alert?", and "what evidence will satisfy the auditor or regulator?".
- Scope includes authentication, authorisation, APIs, and business logic.
- Evidence should include screenshots, logs, headers, and reproducible steps.
- Retesting and remediation tracking matter more than a one-time assessment.
- Cloud and third-party exposures need explicit review.
5. What organisations should build into their process
- Incident playbooks: Define who reports, who approves, and who communicates.
- Log strategy: Keep security-relevant logs, protect them, and test retention.
- Regular retesting: Validate fixes instead of closing findings on paper only.
- Data mapping: Know where personal data flows, copies, and backups exist.
- Access reviews: Check who can see what, especially in admin and API paths.
6. Why this topic is useful for your blog and audience
This is a strong topic because it connects law, compliance, and real-world security work. Students, trainers, auditors, startup teams, and in-house developers all need to understand that cybersecurity testing in India is now tied to governance and response, not just exploitation.
If you are writing for a technical audience, you can also add a small case study on how an IDOR, broken authentication issue, or log-retention gap would be handled under these new expectations.
7. The road ahead
The direction is clear: more accountability, more evidence, more resilience, and more privacy-aware security engineering. Teams that adapt early will find compliance easier and will also build stronger systems for real attackers. That makes the topic useful, current, and highly practical for 2026.
Suggested closing line
India's cybersecurity rules are no longer a background compliance issue. They are now shaping how organisations test, monitor, and defend their systems every day.