Signal Watchtower Advisory SW-A001: CERT-In Has Raised the Standard for Technology Assurance

The Signal

A new baseline for technology accountability

On 10 June 2026, the Indian Computer Emergency Response Team (CERT-In) released its Guidelines regarding Artificial Intelligence (AI) Accelerated Vulnerability Protection and Response Requirements for Original Equipment Manufacturers (OEMs) and Technology Providers. Read alongside the May 2026 Blueprint on AI-assisted vulnerability exploitation, the direction is clear: if your technology operates in Indian environments, your accountability runs beyond delivery. It extends to vulnerability response, patch support, supplier transparency, incident notification, and evidence.

The guidance arrives at a structural inflection point in cyber risk. Recent threat intelligence reporting indicates that exploitation timelines for high-value vulnerabilities are compressing sharply, with some vulnerabilities being tested or exploited within hours of disclosure. The window available for assessment, prioritization, approval, patching, and validation is measurably shorter than it was two years ago.

A second transition is running in parallel. Post-quantum migration is not a last-minute patch. Cryptographic inventory, certificate visibility, key management, architecture review, and supplier coordination require years of preparation. Organizations that begin now will have options. Those that wait will have fewer. CERT-In’s guidance, read alongside its July 2025 Bill of Materials (BOM) guidelines and the Quantum Cyber Readiness Whitepaper, addresses both challenges in one connected framework.

Two questions CERT-In wants every technology provider to answer

These are the accountability tests the guidance sets out, for boards, Chief Information Security Officers (CISOs), technology providers, and enterprises that depend on them. They are operational questions, not compliance checkboxes.

Related guidance, one direction

From Listing to Response Readiness

Vulnerability management needs an operating model, not just a process

The periodic vulnerability cycle of scanning, scoring, ticketing, and closure was designed for a slower environment. It answered whether a vulnerability existed and what its Common Vulnerability Scoring System (CVSS) score was. That discipline remains useful, but it is no longer sufficient on its own.

The model CERT-In describes requires understanding where a vulnerability lives: whether it is internet-exposed or internal, remotely exploitable or local, actively weaponized or theoretical, and whether it affects a critical asset or a peripheral system. It requires knowing whether a compensating control is working, whether a fix has been validated, and whether there is evidence that management, customers, and auditors can rely on.

The guidance is specific about what it expects from technology providers: AI-assisted security testing, source code and software composition analysis, dependency risk review, threat modelling, penetration testing, continuous security monitoring, Secure Development Lifecycle (SDL) compliance, patch validation with rollback support, and independent audits, alongside bills of material across software, hardware, cryptography, AI, and quantum-relevant components.

Incident transparency is part of the trust equation

The guidance reinforces timely notification, incident response coordination, log preservation, and continued updates until remediation and recovery are complete. Customers need to know what happened, what was affected, what action is required, and when a validated fix will be available. Organizations that build this capability before an incident earn trust. Those that improvise during one lose it.

Continuous validation is moving into the mainstream

The emphasis on Vulnerability Assessment and Penetration Testing (VAPT), Breach and Attack Simulation (BAS), configuration reviews, and independent audits reflects a shift from static assurance to working controls. Used properly, BAS turns control validation into a governance capability, provided it is supported by approved scope, safe profiles, change windows, rollback plans, and clear evidence capture. CERT-In’s July 2025 Comprehensive Cybersecurity Audit Policy Guidelines extend this to mandate annual third-party audits for all public and private enterprises, with scope covering AI system security.

The Visibility Framework

From Software Bill of Materials to Quantum Bill of Materials: five domains of component accountability

CERT-In’s July 2025 Technical Guidelines (Version 2.0) extended visibility requirements well beyond software inventories. The latest guidance connects those five domains into a single accountability framework, component visibility, vulnerability response, secure development, incident transparency, and customer assurance are now one model, not separate workstreams.

Cryptography: the second clock

Security leaders have long treated cryptography as a specialist topic, distinct from vulnerability management. That separation is becoming harder to sustain. The questions now arriving from customers, auditors, and regulators include: where is cryptography used in this product, which algorithms handle encryption, signatures, key exchange, and certificates, are any deprecated or quantum-vulnerable, and can you demonstrate crypto-agility, the ability to replace weak or obsolete cryptography without disrupting the product?

The National Institute of Standards and Technology (NIST) has signalled a transition path away from widely used public-key cryptography that is vulnerable to future quantum computers. The direction is clear: organizations need cryptographic visibility, crypto-agility, and migration planning before customers and regulators ask for evidence. India’s national quantum-safe security roadmap recommends accelerated adoption timelines for defence, telecom, energy, and critical infrastructure, mandatory cryptographic inventories, and early integration of quantum-safe requirements into procurement.

Practical steps for two audiences

Guidance for enterprises and for technology providers

For Indian enterprises

Use this guidance to sharpen supplier accountability during procurement, onboarding, contract renewal, and vendor risk review. These questions belong in normal assurance activities, not only in post-incident reviews.

• Do you maintain a Software Bill of Materials, Hardware Bill of Materials, Cryptography Bill of Materials, AI Bill of Materials, or Quantum Bill of Materials for the products supplied to us?
• Where is cryptography used in your product, and do you have a post-quantum readiness roadmap?
• What are your defined remediation timelines for critical, high, and medium severity vulnerabilities?
• How do you notify customers when patching is delayed, and what interim controls do you provide?
• Can you provide validation evidence for remediated vulnerabilities?
• Do you conduct AI-assisted security testing and software composition analysis?
• Do you maintain a formal zero-day notification protocol?
• Do you have Secure Development Lifecycle evidence and documented secure release practices?

For high-risk or high-dependency suppliers, also request VAPT evidence, BAS results, independent security assessment records, and documented incident response and customer notification procedures.

For technology providers

This is an operating model issue, not a compliance checkbox. Tools, policies, and reports without audit-ready evidence will not withstand review.

References & Source Documents

Primary documents and further reading

CERT-In and Indian Primary Guidance

Regulatory and Standards Context

Analysis and Context (non-primary)

Closing

India is moving toward a technology assurance model that connects Artificial Intelligence-era exploitation speed, supply-chain visibility, cryptographic accountability, quantum readiness, and incident transparency into one operating standard.

The organizations that lead this transition will be the ones that understand their exposure, validate their controls, manage their cryptographic foundations, respond at speed, and can prove what they did.

Artificial Intelligence has changed the attacker’s timeline. Quantum computing will challenge the defender’s foundations. The response is not a compliance program. It is an operating model built for the environment that now exists.