{"id":40876,"date":"2025-09-03T17:11:02","date_gmt":"2025-09-03T11:41:02","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=40876"},"modified":"2026-01-22T13:20:34","modified_gmt":"2026-01-22T07:50:34","slug":"cert-in-audit-guidelines","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/compliance\/cert-in-audit-guidelines\/","title":{"rendered":"CERT-In 2026 Audit Guidelines: What Every CXO Needs to Know"},"content":{"rendered":"
\n\n

<\/span>Key Takeaways<\/span><\/h2>\n\n\n\n
    \n
  • Accountability is no longer passed down but enforced at every level.<\/li>\n\n\n\n
  • CXOs:<\/strong> Must approve audit scope, sign off on residual risks, and own liability.<\/li>\n\n\n\n
  • PMs:<\/strong> Accountable for full-scope audits, vendor\/supply chain checks, and follow-up validation.<\/li>\n\n\n\n
  • Developers:<\/strong> Secure-by-design, SAST\/DAST mandatory, fast remediation, strict version control.<\/li>\n\n\n\n
  • Audits:<\/strong> Annual minimum, plus mandatory pre-implementation audits for major changes.<\/li>\n<\/ul>\n\n<\/div>\n\n\n

    When engineers stress-test a bridge, they don\u2019t ask the pedestrians to sign off on safety. They put the liability squarely on the designers, contractors, and city officials, i.e., if it fails, it\u2019s their names on the line.<\/p>\n\n\n\n

    CERT-In 2025 audit guidelines and framework apply the same logic to digital infrastructure. No more passing the buck to auditors; CXOs must sign risks, PMs must certify vendors, and developers must prove security in every build. Here\u2019s how the accountability map has been redrawn.<\/p>\n\n\n\n\n\n\n\t\n\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t
    Regulation (Change)<\/th>Applies To<\/th>Section<\/th>Key Requirement<\/th>\n<\/tr>\n<\/thead>\n
    Binding Authority<\/td>CXOs<\/td>1.2\u20131.3<\/td>Guidelines are binding; responsibility rests with the auditee, not the auditor<\/td>\n<\/tr>\n
    Leadership Liability<\/td>CXOs<\/td>1.30<\/td>Top management must review & approve the audit scope, program, and remediation<\/td>\n<\/tr>\n
    Risk Sign-Offs<\/td>CXOs<\/td>3.2.3<\/td>Only the head of the organization may authorize risk treatment or exceptions<\/td>\n<\/tr>\n
    Continuous Assurance<\/td>CXOs<\/td>3.4<\/td>Annual audits minimum; major changes trigger pre-implementation audits<\/td>\n<\/tr>\n
    Improvement Focus<\/td>CXOs<\/td>6.1<\/td>Audits must include executive summaries and entry\/exit conferences for leadership<\/td>\n<\/tr>\n
    Comprehensive Scope<\/td>PMs<\/td>3.1<\/td>Audits must cover IT, apps, APIs, cloud, OT\/ICS, databases, IR; all environments in scope<\/td>\n<\/tr>\n
    Asset Inventory<\/td>PMs<\/td>3.1<\/td>Scope must derive from an updated, consolidated asset inventory<\/td>\n<\/tr>\n
    Vendor & Supply Chain<\/td>PMs<\/td>3.1<\/td>Third-party, vendor, and supply chain risk assessments are mandatory<\/td>\n<\/tr>\n
    Change Management<\/td>PMs<\/td>3.4<\/td>Major infra\/app changes require an audit before implementation<\/td>\n<\/tr>\n
    Audit Contracts<\/td>PMs<\/td>3.4<\/td>Contracts must define scope, timelines, reporting, and revalidation<\/td>\n<\/tr>\n
    Follow-up Audits<\/td>PMs<\/td>3.5<\/td>Final reports only after vulnerabilities are patched and re-audited<\/td>\n<\/tr>\n
    Audit Artifacts<\/td>PMs<\/td>3.5<\/td>Hashes, versions, and timestamps must be tracked for traceability<\/td>\n<\/tr>\n
    Secure-by-Design<\/td>Developers<\/td>3.2.1<\/td>Secure dev practices must be in RFPs; insecure apps cannot be audited<\/td>\n<\/tr>\n
    Mandatory SAST<\/td>Developers<\/td>5.1<\/td>Static testing is required during procurement<\/td>\n<\/tr>\n
    DAST + SAST for Critical<\/td>Developers<\/td>5.1<\/td>Critical apps must undergo both dynamic and static testing<\/td>\n<\/tr>\n
    Vulnerability Mapping<\/td>Developers<\/td>5.1<\/td>All findings must be tagged with CWE, CVE, and CVSS EPSS CERT-In scoring<\/td>\n<\/tr>\n
    Fast Remediation<\/td>Developers<\/td>3.5<\/td>Developers must patch issues immediately once flagged<\/td>\n<\/tr>\n
    Code Freeze\/Control<\/td>Developers<\/td>3.5<\/td>No code changes post-audit cert without re-audit; strict version control required<\/td>\n<\/tr>\n
    Secure Deployment<\/td>Developers<\/td>4.2<\/td>Harden defaults, disable weak protocols, use genuine software<\/td>\n<\/tr>\n
    Patch Cycles<\/td>Developers<\/td>4.2<\/td>Regular updates\/patching for all software, apps, and firmware are mandatory<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n\n