IndiaTelecom Cyber Security Rules, Reporting of Security Incidents
Telecommunications (Telecom Cyber Security) Rules, 2024 (G.S.R. 720(E)), r. 7
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds a telecommunication entity, meaning any person providing telecommunication services, or establishing, operating, maintaining or expanding a telecommunication network, including an authorised entity under section 3(1) of the Telecommunications Act, 2023 (reached by declaring that you provide telecom services).
- Report a security incident affecting your telecommunication network or telecommunication service to the Central Government within six hours of becoming aware of it, with relevant details of the affected system including a description of the incident (rule 7(1)(a)). A security incident is an event having real or potential risk on telecom cyber security (rule 2(1)(e)).
- Within twenty-four hours of becoming aware of the incident, furnish, as applicable, the number of users affected, the duration of the incident, the geographical area affected, the extent to which your network or service is affected, the remedial measures taken or proposed, and any other information you consider relevant (rule 7(1)(b)).
- When the Central Government requires it, provide the information needed to assess the security of your network and service, including your telecom cyber security policy, and carry out a security audit by a certified agency (rule 7(3)).
- Carry out the Central Government's directions to remedy a security incident or prevent one when a significant threat has been identified, within the time limits it specifies (rule 7(4)).
- Where the Central Government requires you to inform the public of a security incident because disclosure is in the public interest, do so (rule 7(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Government, which under rule 4(6) may seek further clarifications from a telecommunication entity and issue directions, orders or instructions to it for the protection of telecom cyber security.
Settledness
- As of
- Open questions
- Does the six-hour clock in rule 7(1)(a) run from the first indication of an event or from the point the entity concludes that the event is a security incident?
What this law does
Rule 7(1)(a) requires a telecommunication entity to report a security incident affecting its telecommunication network or telecommunication service to the Central Government within six hours of becoming aware of it, with relevant details of the affected system including a description of the incident.
Rule 7(1)(b) requires the entity to furnish, within twenty-four hours of becoming aware of the incident, the number of users affected, the duration, the geographical area affected, the extent to which the network or service is affected and the remedial measures taken or proposed. Rule 7(2) allows the Central Government to inform the public of a security incident where it determines that disclosure is in the public interest, or to require the affected telecommunication entity to do so.
Rule 7(3) allows the Central Government to require the entity to provide information needed to assess the security of its network and service, including its telecom cyber security policy, and to carry out a security audit by a certified agency. Rule 7(4) allows the Central Government to issue directions to remedy a security incident or prevent one when a significant threat has been identified, and to set time limits for implementing them.
Rule 2(1)(e) defines a security incident as an event having real or potential risk on telecom cyber security. Rule 9 provides that any contravention of the Rules is dealt with in accordance with the provisions of the Telecommunications Act, 2023. The Rules came into force on the date of their publication in the Official Gazette.
When LexLint raises it
When your app profile says your app provides telecom services.