Section 3(10)(b) in The Information Technology (Recognition of Foreign Certifying Authorities not Operating under any Regulatory Authority) Regulations, 2013
(b)The Recognized Foreign Certifying Authority shall conduct internal half yearly audit of the Security Policy, physical security and planning of its operation.