Strengthening India's Cyber Defence: Cert-In's New Cyber Security Audit Guidelines Decoded

I. BACKGROUND

On July 25, 2025, the Indian Computer Emergency Response Team ("CERT-In") issued the Comprehensive Cyber Security Audit Policy Guidelines, ("Guidelines"). CERT-In is the national agency established under Section 70B of the Information Technology Act, 2000 ("IT Act") to perform functions in the area of cyber security including coordination of incident response activities and issuing guidelines and advisories relating to information security practices, procedures, prevention, response and reporting of cyber incident.

The Guidelines have been issued by CERT-IN in discharge of its statutory authority to enhance cyber security posture of India. This is in line with its powers under Section 70B of the IT Act to call for information and give directions to service providers, intermediaries, data centres and body corporates. The enabling provisions under the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing