Section 32(1) in The Information Technology (Certifying Authorities) Rules, 2000
(1)The auditor shall be independent of the Certifying Authority being audited and shall not be a software or hardware vendor which is, or has been providing services or supplying equipment to the said Certifying Authority.
