Cert-In makes annual cybersecurity audit mandatory for companies

In a first, the Indian Computer Emergency Response Team (Cert-In) has made it mandatory for private and public-sector organisations that own or operate digital systems, processes, or infrastructure, to undergo a comprehensive third-party cybersecurity audit at least once a year.

 

This is the first such directive for the private sector.

 

The guidelines by Cert-In allow sectoral regulators to mandate audits more frequently if needed, Cert-In said.

 

In a set of guidelines issued for all public-sector and private companies, Cert-In has stated cybersecurity audits should adopt a risk-based and domain-specific approach, aligning with the business context, threat landscape, and operational priorities