Section 3(9)(c) in The Information Technology (Recognition of Foreign Certifying Authorities not Operating under any Regulatory Authority) Regulations, 2013
(c)A Foreign Certifying Authority recognized under this regulation shall formulate its Information Technology and Security Policy for operation complying with these guidelines and submit it to the Controller: