CERT-In 2026 Audit Guidelines: What Every CXO Needs to Know

When engineers stress-test a bridge, they don’t ask the pedestrians to sign off on safety. They put the liability squarely on the designers, contractors, and city officials, i.e., if it fails, it’s their names on the line.

CERT-In 2025 audit guidelines and framework apply the same logic to digital infrastructure. No more passing the buck to auditors; CXOs must sign risks, PMs must certify vendors, and developers must prove security in every build. Here’s how the accountability map has been redrawn.

Regulation (Change)	Applies To	Section	Key Requirement
Binding Authority	CXOs	1.2–1.3	Guidelines are binding; responsibility rests with the auditee, not the auditor
Leadership Liability	CXOs	1.30	Top management must review & approve the audit scope, program, and remediation
Risk Sign-Offs	CXOs	3.2.3	Only the head of the organization may authorize risk treatment or exceptions
Continuous Assurance	CXOs	3.4	Annual audits minimum; major changes trigger pre-implementation audits
Improvement Focus	CXOs	6.1	Audits must include executive summaries and entry/exit conferences for leadership
Comprehensive Scope	PMs	3.1	Audits must cover IT, apps, APIs, cloud, OT/ICS, databases, IR; all environments in scope
Asset Inventory	PMs	3.1	Scope must derive from an updated, consolidated asset inventory
Vendor & Supply Chain	PMs	3.1	Third-party, vendor, and supply chain risk assessments are mandatory
Change Management	PMs	3.4	Major infra/app changes require an audit before implementation
Audit Contracts	PMs	3.4	Contracts must define scope, timelines, reporting, and revalidation
Follow-up Audits	PMs	3.5	Final reports only after vulnerabilities are patched and re-audited
Audit Artifacts	PMs	3.5	Hashes, versions, and timestamps must be tracked for traceability
Secure-by-Design	Developers	3.2.1	Secure dev practices must be in RFPs; insecure apps cannot be audited
Mandatory SAST	Developers	5.1	Static testing is required during procurement
DAST + SAST for Critical	Developers	5.1	Critical apps must undergo both dynamic and static testing
Vulnerability Mapping	Developers	5.1	All findings must be tagged with CWE, CVE, and CVSS EPSS CERT-In scoring
Fast Remediation	Developers	3.5	Developers must patch issues immediately once flagged
Code Freeze/Control	Developers	3.5	No code changes post-audit cert without re-audit; strict version control required
Secure Deployment	Developers	4.2	Harden defaults, disable weak protocols, use genuine software
Patch Cycles	Developers	4.2	Regular updates/patching for all software, apps, and firmware are mandatory

Why CERT-In Overhauled the Audit Framework in 2025

For years, cybersecurity audits in India have been criticized for being narrow in scope (focusing on web apps and basic VAPT), lightweight in standards (limited to the OWASP Top 10), and fragmented in accountability (signed off at the IT manager level, rather than the board level). This mismatch became untenable as India emerged as one of the most digitally dependent economies in the world.

That said, three forces collided to push CERT-In into a structural reset:

1. Exploding digital dependence: critical services like UPI, Aadhaar, and Smart Grids became “too big to fail,” while incidents in OT, telecom, and fintech highlighted the fragility of the ecosystem.
   
2. Emerging tech blind spots: AI models, IoT networks, and blockchain pilots were introduced to production without adequate security guardrails, exposing regulators to systemic risks and undermining public trust.
   
3. Global interoperability pressure: Indian audits weren’t recognized as credible abroad. To preserve India’s IT export advantage and regulatory standing, CERT-In had to lift audits to ISO, NIST, and OWASP ASVS-grade rigor.

The result is a framework of CERT-In 2025 audit guidelines that expands scope, raises audit frequency, audit readiness, enforces stricter sign-offs, and mandates supply chain traceability. More importantly, it reframes the role of audits: not as an annual checkbox, but as a continuous assurance mechanism aligned to both business risk and national security priorities.

With that context, let’s break down the key drivers behind this overhaul.

Rising Threat Vectors in the Indian Digital Infrastructure

The last five years have seen India’s digital backbone become both mission-critical and systemically fragile:

• National scale dependence: In August 2025, India’s Unified Payments Interface (UPI) processed over 20 billion transactions in a single month with average daily volumes exceeding 640 million, cementing its position as the world’s largest real-time payment system; a single failure in critical payment or identity infrastructure (UPI, Aadhaar, DigiLocker) can now ripple into widespread economic and political fallout, and old audit regimes scoped mostly for websites and IT networks simply couldn’t assure this scale of digital risk and operational resilience.
  
• Critical infrastructure hits: Energy and power grids in North and West India have faced confirmed intrusions tied to state-sponsored threat groups. OT/ICS environments were never entirely within compliance audit scope earlier; they are now explicitly mandated.
  
• Supply chain breaches: Indian IT majors were exposed to global attacks, such as SolarWinds and MOVEit. Vendors and third parties are deeply embedded in government and BFSI ecosystems, yet prior frameworks treated supply chain risk as optional.

These events compelled CERT-In empanelled auditor rules to implement annual minimum audits, re-audits following every major infrastructure change, and full-scope coverage (encompassing OT/ICS, APIs, Dev/UAT/Prod environments, and third parties). 

Push for AI/IoT/Blockchain Security and Audit Traceability

Three emerging domains acted as pressure valves:

1. AI adoption without oversight: By 2025, most leading Indian banks, insurers, and e-governance platforms have moved beyond pilots to deploy AI for functions such as KYC, fraud detection, credit scoring, and automated decision-making, but regulators including the Reserve Bank of India have explicitly warned that without human-in-the-loop oversight, explainability, traceability, and robust governance frameworks to address algorithmic bias and opaque “black box” models, these systems risk unintended failures, unfair outcomes, and systemic vulnerabilities, highlighting the urgent need for auditability, data lineage controls, and adversarial resilience in AI deployments.

Hence, AI audits now explicitly include ethical alignment, transparency, and AIBOM disclosure.

2. IoT/IIoT in smart cities and defense: Modernization programs have expanded rapidly with over 18 billion connected IoT devices worldwide in 2025 and automated attacks against these endpoints averaging 820,000 attempts per day, reflecting a vast and constantly probed attack surface and in India, government advisories warn that critical urban OT and utility controllers in smart cities are actively targeted by Trojans and botnets, prompting the urgent need for mandatory IoT/IIoT security audits rather than reliance on legacy IT-centric assessments.
   
3. Blockchain & fintech pilots: India’s CBDC pilots and blockchain-based land registries exposed vulnerabilities in smart contracts and consensus protocols. The 2024 WazirX attack, which cost $234.9 million, triggered public scrutiny. 

CERT-In responded with blockchain audits and mandatory AIBOM/QBOM/SBOM audit India, enforcing supply chain transparency for cryptographic and AI components.

Together, these weren’t hypothetical risks but policy embarrassments waiting to happen. The new traceability requirements (SBOM/QBOM/AIBOM) are CERT-In’s insurance against opaque digital dependencies undermining national infrastructure.

Strategic Alignment with Global Frameworks (ISO, NIST, OWASP ASVS)

CERT-In VAPT requirements overhaul also has a diplomatic and economic dimension:

• Global interoperability pressure: Indian IT/ITES providers handle critical workloads for EU and US firms. Following the GDPR and the US cybersecurity EO, audits based solely on the “OWASP Top 10 only” were dismissed as immature. 

Multinationals began pushing for audits aligned to ISO/IEC, NIST CSF, OSSTMM, and CSA CCM, forcing CERT-In’s hand.

• Regulatory harmonization: The EU’s NIS2 Directive (2023) and the US’s CIRCIA (2022) mandated continuous risk-based audits. India, seeking reciprocal trust frameworks for cross-border data flows, had to demonstrate comparable rigor. 

Hence, the rejection of checklist-driven approaches and the embrace of risk-based, continuous audit cycles.

• National security calculus: Geopolitical tensions (esp. with China-linked APT groups targeting Indian infra) made it untenable for India to lag in audit maturity. Strategic sectors (power, defense, BFSI) required board-level accountability, whereby the new changes necessitate CEO/Director sign-offs, not just IT team compliance.

In short, CERT-In didn’t just align to international standards for best practice—it did so because economic competitiveness, diplomatic credibility, and national security all depended on it.

What Does This Mean for CXOs?

The CERT-In 2025 audit guidelines elevate cyber risk from the IT basement to the boardroom. They don’t “recommend” but bind, marking a structural shift in India’s cyber governance, positioning them not as technical rituals managed by IT, but as statutory governance tools that bind leadership to accountability. 

Binding Authority and Leadership Liability

CERT-In has made audits a statutory obligation, binding on all empanelled auditors and auditee entities, whereby the responsibility for a secure posture rests squarely with the auditee, not the auditor.

Sections 1.2–1.3 state that the guidelines are “binding” and that “responsibility… rests with the auditee organization, not the auditor.”

Risk Acceptance and Formal Sign-Offs

Risk acceptance is now a boardroom decision. CERT-In 2025 audit guidelines specify that only the head of the organization may authorize treatment or exceptions for vulnerabilities, placing residual risk directly under leadership accountability.

In formal terms, Section 3.2.3 states, “Risk treatment… must be authorized & accepted by the head of the auditee organization.”

From Annual Checks to Continuous Assurance

Audits are no longer once-a-year formalities. While annual audits remain the baseline, major changes (such as system overhauls, migrations, or reconfigurations) must be audited before rollout. Even without change, audits are expected at intervals based on asset criticality.

Section 3.4 requires “cyber security audit at least once in a year” and audits for “major changes… before implementation.”

Audits as Strategic Improvement Tools

The new guidelines now reframe audits as engines of continual improvement, such that reports must include executive summaries that map technical findings to business risks. Additionally, entry and exit conferences with senior management are now mandatory.

Section 6.1 mandates an “executive summary… intended for the board” and conferences “attended by senior management.”

Note (Boardroom Directive): Position audits as statutory disclosures, formalize executive risk registers, embed re-audits in every change initiative, and demand business-grade summaries from auditors. Treat every audit as both a compliance checkpoint and a lever of strategic improvement. Anything less is non-compliance and now, non-defensible.

What Does This Mean for Project Managers?

The CERT-In 2025 guidelines put Project Managers at the center of execution. Where earlier audits could be treated as a box to tick at the end of delivery, PMs must now own audit scope, vendor risk, and lifecycle validation as part of their day-to-day responsibilities.

Expanded and Comprehensive Audit Scope

Audits are no longer confined to apps or servers but must now encompass the entire digital estate, including IT systems, web/mobile apps, APIs, OT/ICS, cloud services, databases, and incident response. Development, test, UAT, and production environments all fall within scope, making accurate asset inventories a non-negotiable requirement.

Section 3.1 requires audits to span “system, applications… OT/ICS, cloud, APIs, database, code review, application security, data security, [and] incident response” across all environments.

Vendor and Supply Chain Security

CERT-In 2025 closes one of the biggest blind spots in Indian audits: third-party and supply chain risk, i.e., PMs can no longer assume vendors or contractors are out of scope. Whether it’s a SaaS provider handling sensitive data, a cloud vendor hosting workloads, or an offshore dev partner writing code, their security posture is now part of your audit readiness. 

The guidelines even classify “Vendor Risk Management Audits” as a formal engagement type. As Section 3.1 puts it: “third-party risk assessment/vendor risk assessment/supply chain risk assessment should be part of the scope.”

Integration with Project & Change Management

Audits are now to be embedded directly into the change control process, meaning that any “major change” that could impact security, from infrastructure migrations to large-scale configuration shifts, now requires an audit before implementation. This means PMs have to treat audits as part of the project lifecycle, not a compliance afterthought.

The guidelines spell it out in Section 3.4: “Major change… must undergo a cyber security audit to evaluate potential vulnerabilities… before implementation.”

Audit Lifecycle Ownership

The new framework extends PM responsibility far beyond project delivery to remediate, revalidate, and document vulnerabilities with immutable proof. This translates to mandatory audit follow-ups, with artifacts such as hash values, timestamps, and version numbers being directly tied to the audited build.

Section 3.5 and 5.2 make this explicit: “Follow-up audits should be conducted… after the closure of vulnerabilities” and “audit-related artifacts such as hash values, versions, and timestamps should be captured and prominently featured.”

What Does This Mean for Developers?

Developers are now at the frontline of CERT-In’s audit guidelines in 2025. The regime makes secure coding, structured testing, and disciplined remediation non-negotiable, shifting responsibility from post-audit fixes to proving security throughout the entire software lifecycle.

Secure-by-Design Mandate

The new guidelines shift security left, necessitating that secure-by-design practices are baked into every RFP and tender, and insecurely developed apps can’t even enter the audit pipeline. If the code lacks security controls, auditors must refuse to assess it and report the case.

Section 3.2.1: “Applications developed without secure design and development practices should not be considered for assessment and audits… with a copy marked to CERT-In.”

Testing and Validation Requirements

Validation has been standardized, which means SAST is now mandatory during procurement, and for critical applications, both SAST and DAST must be performed. Beyond that, every vulnerability must be tagged with its CVSS EPSS CERT-In scoring and mapped to CWE/CVE identifiers, providing developers with precise, actionable context.

Section 5.1: “Auditors are required to implement CVSS… supplemented with EPSS… and mapped with CWE and CVE numbers.”

Vulnerability Remediation and Code Discipline

The new guidelines mandate rapid remediation, making developers and owners directly responsible for patching vulnerabilities flagged in audit reports without delay. After certification, code cannot be changed without triggering re-audit, creating a de facto code freeze, or requiring strict change control with traceability (hash values, versioning, timestamps).

Section 3.5: “Vulnerabilities highlighted in audit reports should be patched… Final audit report should be issued after closure of vulnerabilities & completion of follow-up audit.”

Secure Deployment Standards

The framework extends into secure application deployment, so assets must be properly configured, with unused ports blocked, defaults hardened, and weak protocols disabled. Only genuine, updated software and firmware may be used, and regular patch cycles are mandatory.

Section 4.2: “Secure configuration of assets… use of genuine software… regular updates of software, applications, and firmware… ensure the use of secure protocols over weak ones.”

What is the Unified Impact Across Roles?

Role	New Responsibility	What It Means in Practice
CXOs	Strategic accountability	Board-level oversight, formal risk acceptance, and audit findings tied to governance.
PMs	Operational integration	Audit scope across environments, vendor/supply chain security, and follow-up audits in project plans.
Developers	Technical implementation	Secure-by-design code, mandatory SAST/DAST, rapid patching, secure deployments.

The common thread: cybersecurity is no longer the auditor’s problem; it is a shared responsibility across leadership, management, and engineering.

What is the Risk of Non-Compliance in CERT-In Audit Guidelines?

Non-compliance with CERT-In’s empanelled auditors rules is a technical oversight that carries legal, commercial, and reputational consequences.

Escalation to CERT-In

Failure to meet audit obligations can be escalated directly to CERT-In under Section 70B of the IT Act. This means leadership exposure to punitive action, and in some cases, direct intervention in your audit process. Ignoring scope coverage, insecure apps, or failure to share metadata are all triggers for escalation.

Contract Risks in Regulated Sectors

Organizations that fail to follow secure-by-design mandates or produce audit gaps risk losing contracts in government and regulated industries. If your application can’t be audited, it can’t be deployed in critical sectors, shutting you out of the country’s largest IT and infra projects.

Sanctions Under the Deter & Punish Framework

CERT-In has introduced a graded framework of escalating consequences: watch-listing with public warnings, suspension, debarment, and, in severe cases, legal action. Repeat offenders risk permanent exclusion from the empanelled ecosystem, thus damaging credibility with clients and public stakeholders.

Loss of Global Credibility

The guidelines align closely with ISO/IEC, NIST, OWASP, and CSA standards. Falling behind risks portraying your firm as an outlier in a market where global clients expect harmonization with these frameworks.

How can Astra Security, a CERT-In Provider, help?

CERT-In’s 2025 guidelines make continuous assurance and traceable evidence mandatory. Astra already delivers this through 15,000+ tests updated every two weeks, a vetted mode with zero false positives, and adoption by 1000+ businesses worldwide. Leaders get board-ready dashboards that track risk, remediation, and compliance posture.

APIs and emerging risks are fully covered. Astra discovers every API in under 30 minutes, executes 15,000+ API security tests in under an hour, and validates fixes with targeted rescans. Findings are tagged with CVSS severity and estimated dollar impact. Compliance views align with SOC 2, ISO 27001, PCI-DSS, GDPR, and HIPAA.

Astra Security shortens audit cycles with validated, manually-reviewed reports in 1.5 days, two free retests, and publicly verifiable certification. Audit artifacts include hashes, timestamps, and exportable PDFs with reproduction steps, video PoCs, and fix guidance. Built-in workflows through Slack, Jira, GitHub, and Azure keep remediation auditable and accountable.

Key Advantages

• 15,000+ security tests with bi-weekly updates and zero false positives
• API discovery in <30 minutes and 15,000+ API tests in <1 hour
• Manually reviewed reports delivered in 1.5 days
• Two free rescans with publicly verifiable certification
• Audit-ready outputs with CVSS, financial impact, and global compliance mapping

Final Thoughts

For years, audits in India allowed responsibility to flow downhill: from leadership to IT, from IT to vendors, from vendors to nowhere. CERT-In’s 2025 framework reverses that current. Every role is now anchored with defined obligations, signatures, and traceable proof. Risk no longer dissipates; it settles exactly where it belongs.

Cybersecurity is no longer a burden to be offloaded, but a weight that each leader, manager, and developer must carry with intent. Passing the buck isn’t just harder; it will be rendered obsolete by the culture the new guidelines aim to build, where accountability is the currency of trust.

FAQs