Section 10(g) in The Information Technology (Certifying Authorities) Rules, 2000
(g)an undertaking that the Certifying Authority's operation would not commence until its operation and facilities associated with the functions of generation, issue and management of Digital Signature Certificate are audited by the auditors and approved by the Controller in accordance with rule 20;
