The auditor should adopt both compliance and risk-based approaches for the cybersecurity audit of the CII. For the compliance-based approach, the auditor should carry out compliance test to ascertain the adequacy and effectiveness of the controls applied in the CII to comply with the Act, subsidiary legislations, applicable written directions, CoP, and SoP. For the risk-based approach, the auditor should identify the risks and threats that the CII faces and ascertain if the controls put in place are appropriate to mitigate the known risks and threats.