Regulation-making power governs certification standards, foreign recognition, key-compromise reporting, and parliamentary oversight through prescribed approval and publication.

The Controller may make regulations consistent with the Information Technology Act, 2000 and its rules after advisory consultation, prior Central Government approval, and Official Gazette publication. Regulations may govern Certifying Authority disclosure records, foreign recognition, licensing, standards, disclosures, application statements, and reporting of private-key compromise. Regulations must be laid before both Houses of Parliament, which may modify or annul them without invalidating prior actions taken under them.

---

---

---