Cert-In calls for AI security audits, six-hour incident reporting by firms

Cert-In has issued guidelines for enterprise AI security audits, calling for risk-based classification, six-hour incident reporting, continuous monitoring and 180-day retention of logs.

The Indian Computer Emergency Response Team (Cert-In) has released comprehensive guidelines for enterprise artificial intelligence (AI) security audits, stating that all AI-related security incidents across government and private entities must be reported to Cert-In within six hours.

 

In its guidelines issued on Wednesday, Cert-In said that all AI systems, regardless of the sector they serve, must be classified as low, moderate, high or critical risk based on several factors.

 

These factors include the severity of the AI-related security incident, the autonomy of the AI model or agent's decision-making, the sensitivity, scale and exposure of the data impacted in the incident, and the possibility of reversing or recovering the data.

 

 

“The guidelines recognise that AI governance cannot be addressed solely through ethical principles or conventional cybersecurity controls. Effective assurance requires organisational accountability, technical testing, data and model governance, continuous monitoring, human oversight, incident response and third-party assurance,” Cert-In said.

 

The risk tier for companies has been assigned on the basis of the depth, frequency and independence of the audit conducted, the extent of documentation needed, and other factors such as the level of human oversight and the applicable monitoring, reporting and assurance requirements, the cybersecurity agency said.

 

Enterprises should conduct audits across nine domains, regardless of their risk category, including governance and accountability, data lifecycle, data quality and data privacy, AI model risk management, bias and fairness, and AI system explainability, the government’s cybersecurity agency said.

 

In addition, all enterprises conducting AI security audits must maintain logs for 180 days, with time synchronisation across all AI components to maintain forensic readiness, Cert-In said.

 

Companies must also ensure that the data used to train AI models, configurations, prompts and system changes can be “traced and independently verified throughout the AI lifecycle,” it said.

 

All companies using AI systems in any form or manner must also ensure that their systems remain “secure, reliable and within approved operating parameters”, especially after deployment on users’ systems.

 

Further, the audit must also transparently lay out the intended use of the AI system, its boundaries, architecture and risk classification, as well as the security requirements, for vendors.