CERT-In issued its Comprehensive Cyber Security Audit Policy Guidelines on 25 July 2025. They apply to empanelled auditors and to public and private organisations that own the systems being audited.
Main points
- Audits at least once a year, and after major changes that affect sensitive data.
- Scope should cover applications, networks, cloud, OT and APIs, rated with CVSS and EPSS.
- Penetration and denial-of-service tests need written consent.
- AI system audits and software bill-of-materials audits are listed among scope types.
- Audit data must be stored in India unless the auditee agrees in writing.
- Auditor fees must not depend on the result.
What to ask
Is the auditor empanelled? Is the scope written down? Where will the data be kept?
Sample story, checked against the source on 17 October 2026. Confirm details with the source before you rely on them.