Provides telecom services, in India

Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, 28 April 2022) · Read the law's page

• Connect all your ICT systems' clocks to the Network Time Protocol server of the National Informatics Centre or the National Physical Laboratory, or to an NTP server traceable to one of them, and ensure any other time source you use does not deviate from NPL or NIC.
• Report a listed cyber security incident, including a targeted attack, a data breach, a data leak, unauthorised access to your IT systems, an attack through a malicious or fake mobile app, or an attack on, or malicious or suspicious activity affecting, an AI or machine learning system, to CERT-In within six hours of noticing it or being notified of it, by email, phone, or fax; current reporting formats and channels are published on CERT-In's own website.
• Enable logs of all your ICT systems and retain them securely, within Indian jurisdiction, on a rolling 180-day basis, and provide them to CERT-In together with an incident report or when CERT-In orders or directs you to.
• Designate a Point of Contact to interface with CERT-In, using the format CERT-In publishes, and keep that designation current.
• If your own service is itself a data centre, a virtual private server provider, a cloud service provider, a virtual private network service, or a virtual asset (crypto) service provider, a narrower and heavier duty also applies: register and retain specified customer KYC information and financial-transaction records for five years. That narrower bound-party class is not one this profile's declared activities can identify on their own, so confirm applicability directly against the text if this describes your service.
• This binds a service provider, intermediary, data centre, body corporate, or Government organisation, the Information Technology Act's own general terms for essentially any commercial or professional actor operating a computer resource in India, not a licensed or sector-specific status; a company distributing software or operating a mobile app in India falls within this reach without needing a specific regulatory registration.
• Failing to furnish information CERT-In calls for, or to comply with a direction it issues, including these Directions, is punishable under section 70B(7) of the Information Technology Act with imprisonment for up to one year, a fine of up to one lakh rupees, or both.

Telecommunications (Telecom Cyber Security) Rules, 2024 (G.S.R. 720(E)), r. 7 · Read the law's page

• This binds a telecommunication entity, meaning any person providing telecommunication services, or establishing, operating, maintaining or expanding a telecommunication network, including an authorised entity under section 3(1) of the Telecommunications Act, 2023 (reached by declaring that you provide telecom services).
• Report a security incident affecting your telecommunication network or telecommunication service to the Central Government within six hours of becoming aware of it, with relevant details of the affected system including a description of the incident (rule 7(1)(a)). A security incident is an event having real or potential risk on telecom cyber security (rule 2(1)(e)).
• Within twenty-four hours of becoming aware of the incident, furnish, as applicable, the number of users affected, the duration of the incident, the geographical area affected, the extent to which your network or service is affected, the remedial measures taken or proposed, and any other information you consider relevant (rule 7(1)(b)).
• When the Central Government requires it, provide the information needed to assess the security of your network and service, including your telecom cyber security policy, and carry out a security audit by a certified agency (rule 7(3)).
• Carry out the Central Government's directions to remedy a security incident or prevent one when a significant threat has been identified, within the time limits it specifies (rule 7(4)).
• Where the Central Government requires you to inform the public of a security incident because disclosure is in the public interest, do so (rule 7(2)).

Telecommunications (Telecom Cyber Security) Rules, 2024 (G.S.R. 720(E)), rr. 4(3), 4(4) and 6 · Read the law's page

• This binds a telecommunication entity, meaning any person providing telecommunication services, or establishing, operating, maintaining or expanding a telecommunication network, including an authorised entity under section 3(1) of the Telecommunications Act, 2023 (reached by declaring that you provide telecom services).
• Adopt a telecom cyber security policy that covers security safeguards, risk management approaches, training, telecommunication network testing including hardening, vulnerability assessment and penetration testing, risk assessment and prevention of security incidents, a rapid action system to deal with security incidents, and forensic analysis of security incidents, and inform the Central Government that you have adopted it (rule 4(4)(a) and (b)).
• Conduct periodic telecom cyber security audits of your network, through your own mechanisms and through the certified agency, at the intervals the Central Government specifies on the portal, and share the audit report with the Central Government (rule 4(4)(f)).
• Establish a Security Operations Centre, by yourself or in collaboration with other telecommunication entities, within the time the Central Government specifies, to monitor telecom cyber security, security incidents, intrusions and breaches, and keep the logs and records rule 4(4)(h) lists for the period specified on the portal (rule 4(4)(h)).
• Ensure compliance with the directions and standards, including timelines for their implementation, that the Central Government issues to prevent misuse of telecommunication identifiers, equipment, networks and services (rule 4(3)).
• Appoint a Chief Telecommunication Security Officer who is a citizen and resident of India and responsible to your board of directors or similar governing body, give the officer's details to the Central Government in writing on the form specified on the portal, and promptly tell it of any replacement (rule 6(1) and (2)).