Cert-In Makes Annual Cybersecurity Audit Mandatory for Firms

This is the first such directive for the private sector

- AASHISH ARYAN

In a first, the Indian Computer Emergency Response Team (Cert-In) has made it mandatory for private and public-sector organizations owning or operating digital systems, processes, or infrastructure, to undergo a comprehensive third-party cybersecurity audit at least once a year. This is the first such directive for the private sector.

The guidelines by Cert-In allow sectoral regulators to mandate audits more frequently if needed, Cert-In said.

In a set of guidelines issued for all public-sector and private companies, Cert-In has stated cybersecurity audits should adopt a risk-based and domain-specific approach, aligning with the business context, threat landscape, and operational priorities of the company being audited.

Business Standard has reviewed a copy of the new guidelines.

The new guidelines, aimed at tightening cyber hygiene across sectors, come amid a surge in digital threats and a rising number of breaches targeting critical infrastructure.