Madhya Pradesh Agency for Promotion of Information Technology

(A CERT-In Empanelled organisation of Govt. M.P Under Dept. of Science & Technology)

## 9.MAPIT Information Guidelines for Security Audit as per CERT-In Mandate

- 1. As per Section B.3.2.5 of Auditee Guidelines, MAPIT can not initiate any Security Audit or Security Testing unless a formal request is initiated from the Auditee Organisation in form of a Request letter or mail. A Non-Disclosure Agreement (NDA) between MAPIT and Auditee also needs to be signed before testing.
- 2. As per Section B.3.2.6 of Auditee Guidelines, there should be a well defined escalation matrix between auditee and MAPIT for addressing any issues or problem.
- 3. As per Section B of Auditee Guidelines, MAPIT will need clear and unambiguous direction from auditee management (written rules of engagement) which will clearly defined scope for security audit and input on what is required for planning &assessment, requirement analysis, test execution &analysis, results and documentation. This also include the phases of application to be tested and modules included in the testing.
- 4. As per Section B of Auditee Guidelines & Section C.3 , MAPIT shall not Test or Audit in parts or Modules, However as per letter from the dept. Security Testing in different phases can be initiated. The Certificate issued by MAPIT will mention the phase and URL for which the application is Tested or Audited.
- 5. As per Section B 3.2.1 &B3.2.2 of Auditee Guidelines, there should not be any changes in the application during testing or Audit and any change in the source code of application for which audit was performed, shall be considered as violation of Security and the issued certificate shall stand void and null.
- 6. As per Section C.3 of Auditee Guidelines, unstable, incomplete, broken and application still under developing phase will be neither tested nor audited nor can a request for the same be entertained.
- 7. As per Section C.9 &C.10 of Auditee Guidelines, the scope of testing should be well defined and no request to scale up the scope to further modules or parts of application during the testing will be entertained.
- 8. As per Section C.13 of Auditee Guidelines, the tool details to be used for testing and audit will not be shared with the Auditee and no request to use a particular tool will be entertained.
- 9. As per Section C.25 of Auditee Guidelines, All communication channels for delivery of report are end to end confidential and any communication to auditee will be done through the authorized mail id only. (Please refrain from using 3rd part mail services such as Gmail or yahoo mail etc.)
- 10. As per Section D.5 of Auditee Guidelines, scope of testing while VAPT will cover OWASP Top 10, SANS Top 25 programming errors and also GIGW Compliance for all Govt. related websites and application. Incompliance to any of the above shall have bearing on Security Testing or Audit Certificate.
- 11. As per Rule 20, 21, 22 of Auditor Guidelines, the Security Testing Certificate will be valid for a period of 1 year from the date of issue OR till date when a change (minor or major) is made in the Source Code of Application or Build. The Certificate shall stand Void & Null. It will be the responsibility of Auditee to inform MAPIT for any scheduled change or maintenance mentioned henceforth and initiate new request for security audit.
- 12. As per Section D.14 & D. 15 of Auditee Guidelines , the Auditee must refrain from using 'CERT - In' or 'MAP\_IT' Logos in any business or communication activities. Any unforeseen incident of Auditee using the same shall have bearing on Security Certification by MAPIT.
- 13. As per Section 5.3 of Policy Guidelines for Data Handling , a secure and authorized communication should exits between Auditee Organisation and MAPIT resource engage in Testing. The Auditee Organisation should not contact with other teams and employees of MAPIT for Security Audit or Testing related issues.
- 14. As per Sections of Policy Guidelines for Data Handling, the auditee organisation must follow the agreement as mentioned in the Non-Disclosure Agreement.
- 15. It is mandatory to follow all the points mentioned under Policy Guidelines for Data Handling, before and post Security Audit.

State IT Center, 47-A, Arera Hills, Bhopal -462011, Tel: +91-755-2518702

Website: www.mapit.gov.in|| Email: info@mapit.gov.in