Section 3(8) in The Information Technology (Recognition of Foreign Certifying Authorities not Operating under any Regulatory Authority) Regulations, 2013
(8)Issuance of recognition - (a) The Controller may, within a period of four weeks from the date of receipt of the application under this regulation, after considering the documents accompanying the application and such other factors, as he may deem fit, grant or renew the recognition or reject the application:Provided that in exceptional circumstances and for reasons to be recorded in writing, the period of four weeks may be extended to such period, not exceeding eight weeks in all as the Controller may deem fit:Provided further while rejecting the application, reasons for rejection of the same may be specified.(b)If the application for recognition of the Foreign Certifying Authority under this regulation is approved, the applicant shall:(i)submit a performance bond and furnish a banker's guarantee within one month from the date of such approval to the Controller in accordance with the provisions of sub-regulation (3) of regulation 3(A);(ii)execute an agreement with the Controller binding himself to comply with the terms and conditions of the recognition.
