Thursday, November 28, 2019

Cyber security agency cautions govt over engaging foreign IT audit firms

India's cyber security nodal agency Cert-in has issued an advisory to government organisations over the hiring of foreign companies for their IT security audit and asked them to take clearance from the Home Ministry before roping in such firms.

The Indian Computer Emergency Response Team (Cert-In) in a letter dated November 21 to public organisations said that engaging foreign firms for auditing system of government organisations and critical sectors may expose sensitive information to entities or individuals with foreign links.

"In relation to the process of engaging the CERT-in empanelled IT security auditing organisations, on the advice of Intelligence Bureau/MHA, it is felt necessary to issue the following advisories to ensure that the engagement process is secure and does pose a threat to sensitive date/information belonging to the government and critical sectors," CERT-In said.

Cert-in, which is under the electronics and IT ministry, is the national nodal agency to secure Indian cyber space. It alerts about cyber security incidents and threats, provides emergency measures to handle cyber threats and issues guidelines and advisories relating to security practices and reporting of cyber incidents.

The agency has empanelled around 90 organisations, including foreign companies like KPMG, PricewaterhouseCoopers and Indian companies with foreign partnerships, for the audit of IT systems.

"Since engaging non-Indian firms for auditing requirements by the government organisations and critical sections may involve exposing sensitive information to non-Indian persons/entities or having foreign links, the concerned government ministries/organisations should obtain NOC from MHA before engaging any non-Indian firm," the advisory note said.

CERT-in has asked organisations to ensure that every audit firm and its auditors engaged should sign non-disclosure agreements before being allowed to commence the cyber security audit work.

"To the extent feasible, it may be ensured that any data collected during the auditing work and report prepared thereof is not allowed to be taken out of the government premises by such auditors or firms," the note said.

The cyber security watchdog has asked organisations to exercise caution even while engaging  audit firms empanelled by it.

2 comments:

  1. Thanks for your valuable information. stock investor is a stock related website which provides day to day information of the stock market.
    Siemens Ltd
    HCL Technologies Ltd

    ReplyDelete

  2. Nice Article.This blog contains valuable content.Visit us for more stock market news and updates...
    iFOREX
    IPO

    ReplyDelete