CERT-In audit cadence for government entities, and the 2025 audit policy
For government entities, CERT-In’s 2023 guidelines are specific: an internal information security audit at least once in 6 months, and a third-party security audit at least once a year. A separate 2025 audit policy sets out how a CERT-In security audit should be scoped, conducted and reported, in the public and private sectors, and expects covered auditees to ensure a comprehensive ICT audit at least once a year.
The short answer · Government entities
Internal audit: at least once in 6 months.
“Internal information security audit to be performed at least once in 6 months.”
— CISG-2023-01, Guidelines on Information Security Practices for Government Entities, 29 June 2023, §15.3.2. The same requirement appears in §3.4, among the measures senior management should put in place. Read CERT-In’s copy (PDF).
That is one of several audit obligations in the guideline, and they run side by side. A half-yearly internal audit does not stand in for the yearly third-party audit, and neither one replaces the audit each application and website needs before it goes live.
Internal information security audit
“to be performed at least once in 6 months”
CISG-2023-01 §15.3.2 (also §3.4)
Third-party security audit
“must be conducted periodically at least once a year”
CISG-2023-01 §15.3.3 (also §3.4)
Every application and website, audited by a CERT-In empanelled auditing organisation
“prior to hosting, at-least once annually and also after any major changes”
CISG-2023-01 Annexure 1, Part 1 §5.2
Security audit around a major change
“should be performed prior to and after implementation or installation or major enhancements”
CISG-2023-01 §15.3.4
Follow-up audit
“should be conducted to ensure compliance and closure of vulnerabilities”
CISG-2023-01 §15.3.5
Source: CISG-2023-01, Guidelines on Information Security Practices for Government Entities, CERT-In, 29 June 2023: §3.4, §15.3 and Annexure 1, Part 1 §5.2. CERT-In’s copy (PDF).
The application and website audit is where CERT-In empanelment is written in. Annexure 1 of the guideline, the rules for central government CISOs and employees that departments must comply with, requires a CERT-In empanelled auditing organisation for every application and website (Part 1 §5.2). CERT-In publishes its list of empanelled auditors, with their skills, audit experience, manpower and tools, on its website (§3.4).
Who counts as a government entity
Central ministries, and everything under them.
The guideline covers every central government ministry, department, secretariat and office, their attached and subordinate offices, and all government institutions, public sector enterprises and other government agencies they administer. If you run security at a public sector enterprise under a central ministry, the 6-month internal audit is expected of you.
CERT-In issued it under section 70B(4)(e) of the Information Technology Act, 2000, and states that it is expected to be carried out by all government entities.
— CISG-2023-01, §1 Introduction and Purpose and §2 Applicability and Scope. CERT-In’s copy (PDF).
What the internal audit covers
A comprehensive scope, reported to senior management.
A comprehensive scope
The scope of audit should be comprehensive, covering the organisation’s entire information and communication technology (ICT) infrastructure. (§3.4, §15.3.1)
A team that owns the audit calendar
A dedicated audit management function compiles requirements, plans and oversees each audit, acts on the results, runs follow-up audits and reports to management. (§15.1)
Scope agreed before the audit starts
Stakeholders and heads of department agree the scope, a risk-based classification of assets, the benchmarks, the remediation plan, the report format and evidence required, and the follow-up audits. (§15.2.1)
Results go to senior management
Findings are analysed, false positives removed and the rest sent to the departments that must fix them. The results of every security audit are shared with senior management. (§15.4)
Source: CISG-2023-01, §3.4 and §15 Security auditing guidelines. CERT-In’s copy (PDF).
The 2025 audit policy guidelines
A rulebook for the audit itself, not just the auditor.
Empanelment says who is allowed to audit you. CISG-2025-02 says how that audit has to be conducted: the principles it must follow, the standards it must map to, the evidence and working notes it must produce, how the opinion must be formed and reported, and what happens when any of that is not met.
It runs to 69 pages across 20 sections, and it is issued under the same statutory authority as CERT-In itself: section 70B of the Information Technology Act, 2000, and rule 9 of the CERT-In Rules, 2013.
Who it binds
Public and private sector alike.
“These guidelines are intended for organizations in both the public and private sectors that are required to or are seeking to evaluate their cyber security posture, identify vulnerabilities, assess risks, and ensure compliance with applicable regulatory standards and industry best practices.”
— CISG-2025-02, Comprehensive Cyber Security Audit Policy Guidelines, Version 1.0, 25 July 2025, §4(ii) Applicability. CERT-In’s copy (PDF).
The 2025 expectation for auditees
Expected: a comprehensive audit of all ICT systems, at least once a year.
“Auditee organizations, which are expected to ensure a comprehensive audit covering all aspects of their Information and Communication Technology (ICT) systems at least once a year, may also opt for additional assessments and audits during the year.”
— CISG-2025-02, Comprehensive Cyber Security Audit Policy Guidelines, Version 1.0, 25 July 2025, §6 Scope of Engagements Covered. CERT-In’s copy (PDF).
This is an expectation for covered auditees in the public and private sectors. It is separate from the 6-month internal audit CISG-2023-01 sets for government entities, a different document with a different audience.
The load-bearing words are comprehensive and all aspects. An annual web application pentest is not an annual ICT audit. Map the audit scope to applications, identity, cloud, endpoints and any OT in scope; record exclusions and reasons.
Scope of engagements covered
All 26 engagement types named in §6.
The guideline lists these as "including, but not limited to". These are CERT-In’s engagement categories. Agree which apply and verify the selected auditor’s competence for each.
Source: CISG-2025-02, §6 Scope of Engagements Covered, items (i) to (xxvi). CERT-In’s copy (PDF).
§12 · Selection of auditor
How CERT-In says you should choose an auditor.
Six checks the guideline sets around choosing and engaging an auditor. Each one is a fair question to put to every firm bidding for your audit, including us.
Check the CERT-In snapshot before you shortlist
"The snapshot information of skills and competence of CERT-In empaneled auditing organizations published on CERT-In’s website should be utilized by the organizations or sectoral regulators to identify and select the auditing organizations by mapping their requirements with the competence of auditing organizations." CISG-2025-02 §12.1(i)
The snapshot shows manpower and skillsets, audit experience by category, audits carried out in the last 12 months by sector, and the tools used. It is the one public, regulator-maintained record of what an auditor has actually done, not what a proposal claims.
Interview the actual people, not the firm
"The Auditee organizations should interview and select the resources aligned by auditing organizations for competency and experience with respect to the scope of Audit." CISG-2025-02 §12.2(i)
The guideline puts the obligation on you to assess the individuals who will do the work. You meet the consultants who will run your engagement before it starts, not a pre-sales team you never see again.
No freelancers, no interns, no notice-period staff
"Auditing organizations should not field freelancers, interns, freshers, moonlighters, third party consultant or employees who are serving their notice period and the auditee organizations should verify compliance." CISG-2025-02 §12.2(iii)
Verifying it is explicitly your responsibility as the auditee. Our engagements are delivered by full-time employed senior consultants, and every auditor is declared to CERT-In.
Verify identity and credentials at your end
"Auditee organizations must verify the identity, official identity cards/ government issued documents and designations of the auditing team to ensure that the individuals conducting the audit are legitimate and authorized." CISG-2025-02 §12.2(iii)
Credentials must line up with CERT-In’s published qualification requirements for empanelment. We provide identity and designation evidence for every named auditor as part of engagement onboarding.
Only CERT-In-declared manpower may be deployed
"Auditing Organization must only deploy manpower declared to CERT-In in Snapshot Information Form published on CERT-In’s website" CISG-2025-02 §12.3(iii)
Background verification is the sole responsibility of the auditing organisation, before employment and if necessary after. Auditors moving between empanelled firms require an NOC or relieving letter from the previous organisation, and the snapshot must be updated with CERT-In.
Fees should not depend on the result
"Payments to the auditing organization should not be contingent upon the outcome of the audit—whether favorable or unfavorable—nor should they be tied to the submission or approval of any closure reports." CISG-2025-02 §7(i)
From §7, Independence. A commercial structure that pays on a clean report is a structure that buys a clean report. If a bid ties fees to closure sign-off, it breaches the guideline.
Source: CISG-2025-02, Comprehensive Cyber Security Audit Policy Guidelines, Version 1.0, 25 July 2025, §7(i) and §12. CERT-In’s copy (PDF).
§19 · Consequences of non-compliance
The enforcement ladder has four rungs
CERT-In describes this as a framework of "enabling actions as well as deter & punish mechanism". Graded actions apply to adverse reports, guideline violations, breaches of empanelment terms, and poor audit quality.
Watch list, with warning and written commitment
Inadequate closure of non-compliances; no clear relation between noting and issues raised; inadequate sampling, coverage or improper conclusions; minor-impact breaches of CERT-In terms; a first adverse report missing up to two vulnerabilities.
Suspension
Adverse auditee feedback on technical competency; repeated failures in audit planning or coverage; issues appearing soon after the audit; major-impact breaches of CERT-In terms or multiple adverse reports of missed vulnerabilities.
Debarment under GFR and de-empanelment by CERT-In
Auditing malpractices, substandard services, or failure to cover the scope of work.
Penal and legal action
Breach of trust, digital break-in, or damage or attempted damage to auditee interests and infrastructure, under the applicable penal and legal acts.
Read the other way round, this gives auditees a route for raising audit-quality concerns. Section 11 asks the auditee to give CERT-In feedback on the audit when it is completed, and "issues appearing soon after conduct of audit" and "adverse feedback from Auditee regarding technical competency" are among the indicative parameters the matrix lists against suspension. What action follows is for CERT-In to decide.
Source: CISG-2025-02, Comprehensive Cyber Security Audit Policy Guidelines, Version 1.0, 25 July 2025, §11(iii) to (iv) and §19, with its Deter & Punishment matrix. CERT-In’s copy (PDF).
Common questions
CERT-In audit guidelines, answered.
As per CERT-In guidelines for government entities, how often must internal audits be conducted?
At least once in 6 months. CERT-In’s Guidelines on Information Security Practices for Government Entities (CISG-2023-01, 29 June 2023) say the internal information security audit is “to be performed at least once in 6 months” (§15.3.2), and §3.4 repeats it. Separately, third-party security audits “must be conducted periodically at least once a year” (§15.3.3), and Annexure 1, Part 1 §5.2 asks that every application and website be audited by a CERT-In empanelled auditing organisation before it is hosted, at least once a year and after any major change. The 6-month cadence is set for government entities; it is not the annual expectation in CERT-In’s 2025 audit policy.
What is CISG-2025-02?
It is CERT-In’s Comprehensive Cyber Security Audit Policy Guidelines, version 1.0, issued 25 July 2025. It is a 69-page document that sets out how cyber security audits in India should be scoped, planned, performed, evidenced and reported, covering both the auditing organisation and the organisation being audited. It is issued under section 70B of the Information Technology Act, 2000 and rule 9 of the CERT-In Rules, 2013.
Does it apply to private companies, or only government?
Both. Section 4 states the guideline applies to CERT-In empanelled auditing organisations and to auditee organisations "in both the public and private sectors that are required to or are seeking to evaluate their cyber security posture". It is not restricted to government bodies or to CII.
What does the 2025 audit policy expect, and is it the government cadence?
Section 6 of CISG-2025-02 states that auditee organisations "are expected to ensure a comprehensive audit covering all aspects of their Information and Communication Technology (ICT) systems at least once a year," and may opt for additional assessments and audits during the year. The annual expectation is for comprehensive ICT coverage, not a single application or a single network range. It is a different document from the government cadence: CISG-2023-01 sets the 6-month internal audit for government entities, and CISG-2025-02 sets the yearly expectation for covered auditees in the public and private sectors.
Is this the same thing as CERT-In empanelment?
No. Empanelment is the status that authorises an organisation to conduct these audits. CISG-2025-02 governs how the audit itself must be run once an empanelled auditor is appointed: planning, evidence, working notes, reporting and independence. It also sets out what happens when those standards are not met. An auditor can be empanelled and still be in breach of the guideline.
What happens to an auditor that does not follow the guideline?
Section 19 sets out a graded enforcement ladder: move to a watch list with warning and written commitment; suspension; debarment under GFR and de-empanelment by CERT-In; and penal and legal action. Triggers include missed vulnerabilities, inadequate sampling or coverage, weak closure of non-compliances, and adverse auditee feedback on technical competency.
Can we pay our auditor on successful closure of findings?
Not under the guideline. Section 7 is explicit that payments "should not be contingent upon the outcome of the audit — whether favorable or unfavorable — nor should they be tied to the submission or approval of any closure reports", because linking payment to outcome compromises independence. Check the commercials in any competitive bid: outcome-linked payment terms are a direct breach of the guideline.
Which types of assessment fall under the guideline?
Section 6 names 26 engagement types, explicitly "including, but not limited to". They range from vulnerability assessment, penetration testing and source code review through to red team assessment, cloud security testing, ICS/OT and IoT testing, AI system audits, vendor risk management audits, blockchain security audits, and SBOM/QBOM/AIBOM auditing.
How does this interact with SEBI CSCRF or RBI requirements?
It sits underneath them. Sectoral regulators mandate that regulated entities be audited; CISG-2025-02 governs the conduct and quality of the audit that satisfies those mandates, and CERT-In empanelment is generally the qualification the sectoral regulator relies on. In practice a SEBI or RBI submission is only as defensible as the audit behind it, and the guideline is the standard that audit is measured against.
Does your audit programme meet the guidelines?
We map your current programme against the audit cadence CISG-2023-01 sets for government entities, and against CISG-2025-02's §6 coverage, §12 selection obligations and §7 independence requirements, and tell you where the gaps are, including the ones that are ours to fix, not yours.