India’s national cybersecurity agency issued guidelines for auditing the security of artificial intelligence systems, setting out a risk-based framework for AI that organizations in India develop, buy, deploy, or operate, as well as systems that process Indian data or serve Indian users. Under the framework, AI systems are sorted into four risk tiers – low, moderate, high, and critical, which determine depth, frequency, and independence of audits and level of human oversight required. The guidelines set out nine core audit domains covering the AI lifecycle, from governance and data quality to adversarial resilience, human oversight and third-party supply-chain assurance.
Prepared by a working group of the Indian Computer Emergency Response Team, or CERT-In, the AI Security Auditing Guidelines, version 1.0, is aimed at government bodies, public sector entities, critical infrastructure operators, regulated entities, private companies, AI developers and service providers, and auditors, including CERT-In empanelled auditing organizations. It also includes added requirements for generative, agentic and other advanced AI to address risks such as prompt injection, data and model poisoning, and excessive agency. Audit findings are classified as critical, high, moderate or low, and a five-level maturity model lets organizations gauge their AI governance capability.
The framework aligns with recognised standards and guidance, including CERT-In’s Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure, MeitY’s India AI Governance Guidelines, ISO/IEC 42001, ISO/IEC 23894, ISO/IEC 27001, NIST AI RMF, MITRE ATLAS, and OWASP guidance for machine learning and large language model applications. It also provides a structured mechanism to identify, assess, and map CERT-In requirements, sector-specific cybersecurity obligations, contractual security requirements, and other external mandates into the audit criteria and Statement of Applicability.
The AI Security Auditing Guidelines set out a comprehensive, actionable and internationally aligned auditing framework built on six pillars. The first pillar, Risk Tiering and Applicability, is a four-tier classification system (Low, Moderate, High and Critical) calibrated to sector, use case and impact severity. It determines audit intensity and compliance obligations.
The second pillar covers Nine Core Audit Domains. These set structured audit requirements across AI governance, data lifecycle, model risk management, ethics and fairness, explainability, cybersecurity resilience, continuous monitoring, human oversight and third-party accountability. The third pillar, Advanced AI Security Requirements, provides dedicated audit provisions for large language models, generative AI, retrieval-augmented generation (RAG), agentic AI, multimodal AI, multi-agent AI and autonomous or cyber-physical AI. These address prompt injection, hallucination, content integrity, training data provenance and output attribution.
The fourth pillar, Audit Planning and Scoping Methodology, defines a risk-based audit lifecycle that runs from engagement planning through fieldwork, evidence collection and reporting. It is aligned with ISO/IEC 42001 and ISACA and IIA methodologies. The fifth pillar, Audit Reporting and Remediation, covers structured finding classification, corrective action planning and escalation protocols. It also integrates ISO/IEC 42001 Clauses 9 and 10 for management review and continual improvement.
The sixth pillar, AI-Assisted Audit Procedures, governs the controlled use of AI tools in audit work. It defines requirements for authorisation, data protection, tool validation, evidence traceability, human review and auditor accountability.
The framework is anchored on seven foundational principles for secure, ethical and auditable AI systems, aligned with the guiding principles in MeitY’s India AI Governance Guidelines, including security-by-design, accountability and human oversight, transparency and explainability, fairness and bias management, data security and privacy, auditability and traceability, and resilience and continuous assurance.
These guidelines aim to establish consistent, risk-based and auditable mechanism for evaluating the security, governance and responsible operation of AI systems throughout their lifecycle.
The framework aims to ensure secure, ethical and auditable AI adoption by defining consistent audit requirements for AI systems, whether they are developed internally, procured from third parties, consumed through APIs or cloud services, or derived from open-source or foundation models. It enables risk-based assurance by setting the depth, frequency and technical intensity of an audit according to the system’s potential impact, autonomy, data sensitivity, scale, criticality, adversarial exposure and explainability. It provides procedures for assessing AI-specific security risks, including data and model poisoning, adversarial manipulation, model extraction, model inversion, prompt injection, unsafe tool use, supply-chain compromise, insecure AI APIs and unauthorised model modification.
The framework also verifies lifecycle controls by assessing the governance and security measures covering data preparation, model development, validation, deployment, operation, monitoring, retraining, change management and decommissioning. It improves audit consistency and reproducibility by setting common expectations for scoping, evidence collection, technical testing, sampling, working papers, finding classification, reporting and remediation verification. Finally, it supports interoperability by aligning with relevant AI management, cybersecurity, risk-management and technical-assurance standards and frameworks.
The framework is built around six technical and assurance objectives. Audit consistency establishes a common methodology and baseline for AI security audits across sectors, technologies and deployment models. Risk-based assurance applies audit depth and technical testing in proportion to the assessed risk and impact of the AI system. Technical resilience assesses the ability of AI systems to withstand adversarial attacks, misuse, failures, unauthorised modification and supply-chain compromise.
Lifecycle traceability ensures that data, models, configurations, prompts, system changes and operational decisions can be traced and independently verified throughout the AI lifecycle. Continuous assurance verifies that systems remain secure, reliable and within approved operating parameters after deployment, through monitoring, drift detection, periodic validation and change-triggered reassessment. Standards interoperability enables audit results and control implementations to be mapped to recognised AI governance, cybersecurity, risk-management and technical-assurance standards and frameworks.
The AI Security Auditing Guidelines provide a structured, risk-based methodology for planning and scoping AI security audits under this framework. The methodology is aligned with ISO/IEC 42001:2023 (Clause 9 – Performance Evaluation), ISO 19011 (Guidelines for Auditing Management Systems), ISACA IT Audit standards, and IIA Internal Audit guidance. It ensures that audit engagements are consistently planned, adequately resourced, appropriately scoped and executed with sufficient rigour to support reliable assurance conclusions.
The document also defines the nine core audit domains that constitute the substantive governance requirements of the AI Security Auditing Guidelines. Every AI system deployed within India or interacting with Indian data shall be assessed against these domains, with the depth and rigour of assessment calibrated to the risk tier assigned under Section 5. Each domain is presented with its objective, guiding principle alignment, ISO 42001/NIST mapping, key control requirements, an auditor checklist, and tier-specific applicability. Together, these nine domains provide comprehensive coverage of the AI governance landscape, from organisational accountability through data integrity, model management, ethics, security, monitoring, human oversight, and third-party risk.
When it comes to AI security requirements, the AI Security Auditing Guidelines establishes dedicated security and audit requirements for generative AI, RetrievalAugmented Generation (RAG), agentic AI, multimodal AI, multi-agent AI and autonomous/cyber-physical AI systems. In addition to traditional generative-model risks such as hallucination and prompt injection, these architectures introduce additional attack surfaces involving knowledge retrieval, vector databases, tool invocation, persistent memory, autonomous actions, cross-agent interactions and non-text input modalities.
The document defines the standards for classifying audit findings, structuring audit reports, developing corrective action plans, tracking remediation to closure, and integrating audit outcomes with the continual improvement mechanisms. The reporting framework ensures that audit results are actionable, traceable and drive measurable improvement in AI governance.
It also outlines a five-level organisational maturity model for AI governance capability. The model enables organisations to benchmark their current state, identify gaps and chart a structured progression path towards mature, resilient AI governance. It complements, but does not replace, the audit planning, control assessment, technical testing, decision review, reporting and remediation requirements. The maturity model is informed by established capability maturity frameworks (CMMI, COBIT), adapted for the specific requirements of AI governance, and aligned with the nine core audit domains of this framework and the requirements of ISO/IEC 42001:2023.
Just last month, industrial cybersecurity firm Nozomi Networks said the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026, notified by India’s Central Electricity Authority (CEA) in July, go well beyond a compliance exercise for chief information security officers (CISOs), IT security managers and operational technology (OT) managers, and that policies alone will not deliver compliance. The rules create the country’s first comprehensive, legally binding cybersecurity framework for the power sector, which the company called one of the most comprehensive compliance regimes ever applied to India’s electricity ecosystem.
