Structuring Accountability: CERT-In Introduces Cybersecurity Guidelines

Author: Corporate Practice Team

CERT-In issues Comprehensive Cyber Security Audit Policy Guidelines (July 25, 2025) mandating standardized annual third-party audits and extensive security testing.

The Indian Computer Emergency Response Team (“CERT-In”), on July 25, 2025, has released the Comprehensive Cyber Security Audit Policy Guidelines (“Guidelines”), introducing a standardized and mandatory audit framework aimed at strengthening cyber resilience across both public and private sector organizations. The Guidelines apply to all CERT-In empanelled auditing organizations as well as auditee entities, including government bodies, critical infrastructure providers, and businesses operating significant digital systems. The Guidelines mandate that all such entities undergo a third-party cybersecurity audit at least once annually, with provisions for additional audits in response to major system changes such as technology migration or configuration alterations. Audits must be risk-based, domain-specific, and align with the organization’s threat landscape and business context. Furthermore, organizations must conduct a comprehensive risk and vulnerability assessment, penetration testing, source code review, network and operational infrastructure audits, and cybersecurity testing for cloud and AI systems. Audit reports are required to be signed by CERT-In-approved personnel, and organizations must implement strict safeguards for data confidentiality, including encryption, access controls, and secure post-audit data disposal practices. The Guidelines also mandate the implementation of the “least privilege” principle, directing organizations to restrict employee access rights strictly to the minimum necessary for performing their duties, thereby reducing the risk of internal threats and unauthorized access. Failure to comply with the Guidelines may attract regulatory action ranging from formal warnings and suspension to de-empanelment or legal proceedings under the Information Technology Act, 2000.