Depository Participants must file the April–September 2026 cyber audit report by 31 December 2026
TaxByKK · Compliance News · taxbykk.com30 Oct 2026
In short
CDSL has fixed the timelines for Depository Participants to file their half-yearly cyber audit report under SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF). For the audit period April to September 2026, the preliminary audit report is due by 31 December 2026 and the action taken report, where needed, by 31 March 2027. Late filing is treated as non-compliance and attracts a penalty.
- Authority
- Central Depository Services (India) Ltd (CDSL)
- Communiqué
- CDSL/AUD/DP/POLCY/2026/765 dated 30 October 2026
- Type
- Circular
- Due date
- Preliminary audit report by 31 December 2026; action taken report by 31 March 2027
- Audit period
- April 2026 to September 2026 (half-yearly)
- Framework
- SEBI circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated 20 August 2024 (CSCRF), clause 4.4
Due date: Preliminary audit report by 31 December 2026; action taken report by 31 March 2027
What changed
| Item | Before | Now |
|---|---|---|
| Preliminary cyber audit report, April–September 2026 | — | File with CDSL by 31 December 2026 |
| Action taken report on the findings (if applicable) | — | File by 31 March 2027 |
| Scope of the audit | — | 100% of critical systems and 25% of non-critical systems on a sample basis, with the rationale and sample size stated in the report |
The report counts as submitted only after the DP adds management comments. The auditor must mark every item in the terms of reference as Compliant, Non-Compliant or Not Applicable, and justify any Not Applicable item. No audit cycle may be left unaudited because an entity changed category at the start of the year: the gap is added to the current cycle. CDSL will announce the upload procedure separately.
Who it applies to
- Depository Participants that are Qualified REs under SEBI's CSCRF
- Mid-size and small-size REs that act as stock brokers and offer internet-based trading (IBT) or algo trading
- DPs that also hold other SEBI registrations (custody, AIF, RA/IA, PMS, merchant banking): they categorise themselves under CSCRF for those too
- CERT-In empanelled auditors and the compliance teams of brokers and DPs
What to do
- Confirm your CSCRF category for FY 2026-27 and have it approved by the Board, designated director, proprietor or partners, as applicable.
- Appoint a CERT-In empanelled auditing organisation, and check that its team is large enough for the number of clients it already audits.
- Have the audit cover all critical systems and a 25% sample of non-critical systems, in the formats given in Annexure C of the communiqué.
- Add management comments and file the preliminary report with CDSL by 31 December 2026.
- File the action taken report on the audit findings by 31 March 2027, where applicable.
Reference
CDSL communiqué CDSL/AUD/DP/POLCY/2026/765, 30 October 2026, Submission of Cyber Security Audit Report; under SEBI circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated 20 August 2024 (CSCRF) and its later clarifications; penalty under CDSL communiqué CDSL/AUDIT/DP/POLCY/2025/105 dated 12 February 2025.
Read the official PDF: CDSL communiquéWritten by TaxByKK from the official notification. Check the official text before you act on it.
Frequently asked questions
What is the due date for the CDSL cyber audit report for April–September 2026?
The preliminary audit report is due by 31 December 2026. The action taken report, where applicable, is due by 31 March 2027.
Who has to file the CSCRF cyber audit report with CDSL?
Depository Participants that are Qualified REs, and mid-size or small-size REs that act as stock brokers and provide internet-based trading or algo trading.
What must the cyber audit cover?
All critical systems and 25% of non-critical systems on a sample basis, with the rationale and the sample size stated in the audit report.
Who can conduct the cyber audit?
Only a CERT-In empanelled auditing organisation, following CERT-In's Comprehensive Cyber Security Audit Policy Guidelines.
What happens if the report is filed late?
Late filing is treated as non-compliance and a penalty is levied under CDSL communiqué CDSL/AUDIT/DP/POLCY/2025/105 dated 12 February 2025.