CERT In which is a quasi judicial authority and the regulator under ITA 2000 is the nodal agency for Cyber Security in India. Under ITA 2000 it regulates organizations processing both personal data and non personal data under the provisions of ITA 2000. It is the authority to which information security data breaches under ITA 2000 are to be reported. After DPDPA 2023 was enacted, the Data Protection Board (DPB) under DPDPA 2023 became the regulator designated for Personal Data Breach. Currently therefore there is an overlapping of the functions of CERT-IN and DPB in respect of Personal data breach which needs to be reported both to the CERT In and DPB besides the data principals.
CERT In has issued several infoprmation security guidelines earlier and more recently on 25th May 2026, CERT In had released the “Blue Print for defending against AI assisted Vulnerabilities” using AI. This has been discussed earlier in Naavi.org. It provide a structured framework covering Governance and accountability mechanisms for AI assisted Vulnerability management and related issues. It was meant to improve organizational understanding of AI assisted cyber threats and recommended core defensive principles. It also suggested Cybersecurity Governance and Operational reaadiness requirments, Technical defensive Controls etc. This was basically a guidline on Cyber Security and how AI needs to be used to meet the emerging security threats.
On 4th November 2026, CERT In issued a fresh guideline called “Artificial Intelligence security auditing guidelines”. These guidelines establish a comprehensive, risk-based framework for auditing the security, governance and responsible operation of Artificial Intelligence systems throughout their life cycle.
This framework is taking is aligned with standards and frameworks such as the CER-In guideline of May 25th on AI assisted vulnerability management, Meity”s AI related guidline as well as ISO 42001, ISO 27001 etc.
This framework is not designed for DPDPA but can be used partially as a guideline for AI algorithmic audit which is a necessity under DPDPA 2023. The DPDPA related AI audit is required to look at the impact of the AI algorithm in the personal data processing scenario. Within this requirement, the security related audit may be performed using this framework.
The framework is built on a four tier risk classification system (Low, Moderate, High and Critical). Nine different audit domains have been identified. Dedicated audit provisions for large language models, Generative AI, RAG, Agentic AI, Multimodal AI, Multi-Agent AI
and Autonomous/Cyber-Physical AI, addressing prompt injection, hallucination etc are also identified as “requirements”. IT also covers the audit planning, scoping etc.
It adopts the Meity”s AI Governance guiding principles including
i. Security-by-Design
ii. Accountability and Human Oversight
iii. Transparency and Explainability
iv. Fairness and Bias Management
v. Data Security and Privacy
vi. Auditability and Traceability
vii. Resilience and Continuous Assurance
Following Risk assessment factors have been mentioned in the framework
F1: Impact Severeity
F2: Autonomy and Actionability
F3: Data Sensitivity
F4: Scale and Exposure
F5:Reversibility and Recoverability
F6: Operational/Sectoral Criticality
F7: Adversarial Exposure
F8: Complexity and Auditability
On each of the above factors the risks are suggested to beassessed as Low, Moderate, High and Critical so that the overall system can be fit into one of the four risk tiers.
Guiding principles for Responsible AI Governance include Security by Design, Accountability and Human oversight, Transparency and Explainability, Fairness and Bias Management, Data Security and Privacy, Auditability and Traceability, Resilience and Continuas Assurance. These are like 7 specifications similar to the DGPSI-AI implementation specifications.
The document provides useful Auditor checklists and also outlines the recommended audit methodology.
Findings are classified and the note lists the remediation requirements with examples.
Overall this is a very useful document that requires a more detailed study. A combination of AIGSI, DGPSI-AI and CERT In AI Audit guidance could be a useful document that can provide a comprehensive guidance on AI Governance and Audit for both DPDPA purpose and otherwise.
Naavi
