Estimated reading time: 7 minutes · Last updated:
The CERT-In AI Security Auditing Guidelines, version 1.0, come from the Indian Computer Emergency Response Team. They sort artificial intelligence systems into four risk tiers and audit them across nine domains. A system rated low, moderate, high or critical gets an audit whose depth, frequency and independence match that rating. The rating also sets how much human oversight the system needs. The reach is broad. The framework covers AI that organisations in India build, buy, deploy or run. It also covers any system that handles Indian data or serves Indian users. Generative and agentic AI face added checks for excessive agency, prompt injection and the poisoning of data or models.
Key takeaways
- Four risk tiers: Version 1.0 of CERT-In's AI Security Auditing Guidelines rates AI systems low, moderate, high or critical. That rating sets audit depth, frequency, independence and the human oversight required.
- Reach beyond India's borders: The framework covers AI built, bought, deployed or run by organisations in India. It also covers any system that processes Indian data or serves Indian users.
- Agentic AI scrutiny: Large language models, RAG, agentic, multi-agent, multimodal and cyber-physical AI get dedicated audit provisions. These cover prompt injection, poisoning, excessive agency and attack surfaces such as vector databases and persistent memory.
- Built on existing standards: Audits run across nine domains and six pillars, map to ISO/IEC 42001, NIST AI RMF, MITRE ATLAS and OWASP guidance, and end with a five-level maturity model drawn from CMMI and COBIT.
Table of contents
- Key takeaways
- Who Must Follow CERT-In's Four Risk Tiers
- Nine Domains and Seven Principles Set the Baseline
- Why Agentic and RAG Systems Get Extra Audit Rules
- How Audits Are Planned, Graded and Closed
- How the Framework Maps to Global and Indian Rules
- What the framework gets right, and where it may strain
- What to be careful about
- Frequently asked questions
Who Must Follow CERT-In's Four Risk Tiers
A CERT-In working group drafted the framework. It is aimed at private companies, regulated entities, critical infrastructure operators, government bodies, public sector entities, AI developers and service providers. Auditors are covered too, including the firms CERT-In has empanelled.
Scope depends on data and users rather than on where a company is based. Any AI system used in India, or one that touches Indian data, must be measured against all nine domains. That holds whether the system was built in-house, bought from a vendor, accessed through an API or derived from an open-source or foundation model. Enforcement against providers based abroad is the obvious open question.
Three factors set a system's tier: its sector, its use case and how severe the harm would be if it failed. When deciding how hard to test, auditors also weigh the system's autonomy, its scale and its data sensitivity. They consider its criticality, its exposure to attack and its explainability as well. A critical-tier system faces deeper, more frequent and more independent review than a low-tier one.
Nine Domains and Seven Principles Set the Baseline
The nine core audit domains are the substance of the framework. They are AI governance, the data lifecycle, model risk management, explainability, and ethics and fairness. The other four are cybersecurity resilience, human oversight, continuous monitoring and third-party accountability. Coverage runs from accountability inside an organisation out to the suppliers it relies on.
Every domain follows the same format. Each sets out an objective, the principles it serves, a mapping to ISO 42001 and NIST, key controls, an auditor checklist and the tiers it applies to. That uniform layout makes results comparable across business units and sectors.
Seven principles sit beneath the domains, drawn from MeitY's India AI Governance Guidelines. Security-by-design appears alongside resilience and continuous assurance. Data security and privacy appear alongside auditability and traceability. The remaining three are fairness and bias management, transparency and explainability, and accountability with human oversight.
Why Agentic and RAG Systems Get Extra Audit Rules
Dedicated provisions cover large language models, generative AI, multimodal and multi-agent systems, agentic AI, retrieval-augmented generation and autonomous or cyber-physical AI. Retrieval-augmented generation, or RAG, is a design in which a model pulls material from an external knowledge store before it answers. Prompt injection is an attack that hides instructions in a model's input to override its intended behaviour.
The guidelines treat hallucination and prompt injection as known problems. They concentrate on the new exposures that newer architectures bring. Vector databases, knowledge retrieval and persistent memory each create one. So do tool invocation, autonomous actions, exchanges between agents and inputs that are not text. Auditors also test content integrity, where training data came from and whether outputs can be attributed.
The framework also gives auditors procedures for a wider set of attacks. These include model extraction, model inversion, poisoning of data and models, adversarial manipulation, unsafe tool use, insecure AI APIs, supply-chain compromise and unauthorised changes to a model. Lifecycle controls are checked at every stage. That runs from data preparation and model development through deployment, monitoring and retraining, and on to change management and decommissioning.
How Audits Are Planned, Graded and Closed
Each audit moves through a risk-based lifecycle of engagement planning, fieldwork, evidence collection and reporting. The method draws on Clause 9 of ISO/IEC 42001:2023, which covers performance evaluation. It also draws on ISO 19011 for auditing management systems, on ISACA IT Audit standards and on IIA Internal Audit guidance.
Each finding receives one of four grades: critical, high, moderate or low. These grades are separate from the four risk tiers applied to whole systems. Findings feed corrective action plans and escalation protocols, and each one is tracked until it is closed. Clauses 9 and 10 of ISO/IEC 42001 link the results to management review and continual improvement.
The sixth pillar sets rules for the auditors themselves. Auditors who use AI tools need authorisation, data protection, validated tools, traceable evidence and human review, and they stay accountable for the outcome. A five-level maturity model, adapted from CMMI and COBIT, then lets organisations benchmark their AI governance. CERT-In says the model supplements the audit requirements and does not replace them.
How the Framework Maps to Global and Indian Rules
The framework lines up with NIST AI RMF and MITRE ATLAS. It also aligns with three ISO/IEC standards, 27001, 23894 and 42001, and draws on what OWASP has published about securing large language model and machine learning systems. At home, it tracks MeitY's guidelines and an earlier CERT-In blueprint on defending digital infrastructure against AI-assisted exploitation of vulnerabilities.
A mapping mechanism lets organisations bring CERT-In requirements, sector obligations, contractual security terms and other mandates into their audit criteria and their Statement of Applicability.
Power companies face a parallel regime. In July, India's Central Electricity Authority (CEA) notified the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026. In October 2026, the industrial cybersecurity firm Nozomi Networks said those rules go far beyond a compliance task for chief information security officers, IT security managers and operational technology managers. Nozomi also said policies alone will not deliver compliance, and called the rules one of the most comprehensive compliance regimes applied to India's electricity sector.
| Pillar | What it covers | Key anchor |
|---|---|---|
| Risk Tiering and Applicability | Four tiers set by sector, use case, impact | Sets audit intensity |
| Nine Core Audit Domains | Governance to third-party accountability | ISO 42001 and NIST mapping |
| Advanced AI Security Requirements | LLMs, RAG, agentic, multimodal, cyber-physical AI | Prompt injection, hallucination, provenance |
| Audit Planning and Scoping Methodology | Planning, fieldwork, evidence, reporting | ISO/IEC 42001, ISACA, IIA |
| Audit Reporting and Remediation | Finding grades, corrective plans, escalation | ISO/IEC 42001 Clauses 9 and 10 |
| AI-Assisted Audit Procedures | Auditors' own use of AI tools | Human review, auditor accountability |
What the framework gets right, and where it may strain
The case for
- Tiering scales audit effort to risk, so low-tier tools avoid the scrutiny reserved for critical systems.
- Mapping to ISO/IEC 42001, NIST AI RMF and MITRE ATLAS lets organisations reuse existing control evidence.
- A common method for scoping, evidence and finding grades makes audits comparable across sectors.
The case against
- The stated scope reaches foreign providers serving Indian users, which may be hard to enforce.
- Power-sector operators deploying AI may have to satisfy both these guidelines and the CEA's 2026 regulations.
- Auditing tool invocation, persistent memory and cross-agent interactions demands technical testing skills that go beyond traditional compliance checklists.
What to be careful about
- Foreign AI providers whose systems serve Indian users or process Indian data fall within the framework's stated scope.
- Organisations running agentic or RAG systems must show controls over vector databases, tool invocation and persistent memory.
- Auditors who use AI tools without authorisation, tool validation and human review risk producing findings they cannot defend.
- Power-sector operators face overlapping obligations from the CEA's 2026 regulations and these guidelines.
The bottom line
Version 1.0 gives auditors in India a single method for testing AI systems. That method scales with risk and carries specific provisions for agents, RAG pipelines and cyber-physical AI. Its strongest feature is the link between tier and audit depth. Low-risk tools are spared heavy scrutiny, while critical systems are pushed toward independent review. Its widest consequence is scope. Any system serving Indian users or handling Indian data falls inside it, which draws in foreign AI providers. Still unclear is how compliance will be checked, and on what timetable. So is how the framework will sit alongside sector rules such as the CEA power regulations. Organisations already working to ISO/IEC 42001 will recognise much of the structure.
What to watch
- April 2027 is the CEA power-sector cybersecurity deadline that Nozomi Networks has highlighted, and power companies running AI will need to square both regimes before then.
- Watch for CERT-In empanelled auditing organisations to start offering audits against the nine domains; no date has been set.
- Watch for a revision beyond version 1.0 as agentic and multi-agent systems mature; no date has been set.
Frequently asked questions
Do CERT-In's AI audit guidelines apply to companies outside India?
The scope covers any AI system that processes Indian data or serves Indian users, not only systems run by organisations in India. Such systems are assessed against all nine audit domains, with the depth of the audit set by their risk tier.
What is the difference between risk tiers and finding grades in the CERT-In framework?
Risk tiers (low, moderate, high, critical) classify the AI system and decide how intensive its audit is. Finding grades use the same four labels to rank individual problems an audit uncovers. Those grades then drive corrective action plans and escalation.
How does the CERT-In AI audit framework relate to ISO/IEC 42001?
The planning method aligns with Clause 9 of ISO/IEC 42001:2023 on performance evaluation, and the reporting stage builds in Clauses 9 and 10. Each of the nine domains maps to ISO 42001 and NIST. The five-level maturity model is also aligned with the 2023 standard.
Related reading
