IndiaTelecom Cyber Security Rules, Security Policy, Audits, Security Operations Centre and Security Officer
Telecommunications (Telecom Cyber Security) Rules, 2024 (G.S.R. 720(E)), rr. 4(3), 4(4) and 6
In force since .
A sector security regimes rule binding public and private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a telecommunication entity, meaning any person providing telecommunication services, or establishing, operating, maintaining or expanding a telecommunication network, including an authorised entity under section 3(1) of the Telecommunications Act, 2023 (reached by declaring that you provide telecom services).
- Adopt a telecom cyber security policy that covers security safeguards, risk management approaches, training, telecommunication network testing including hardening, vulnerability assessment and penetration testing, risk assessment and prevention of security incidents, a rapid action system to deal with security incidents, and forensic analysis of security incidents, and inform the Central Government that you have adopted it (rule 4(4)(a) and (b)).
- Conduct periodic telecom cyber security audits of your network, through your own mechanisms and through the certified agency, at the intervals the Central Government specifies on the portal, and share the audit report with the Central Government (rule 4(4)(f)).
- Establish a Security Operations Centre, by yourself or in collaboration with other telecommunication entities, within the time the Central Government specifies, to monitor telecom cyber security, security incidents, intrusions and breaches, and keep the logs and records rule 4(4)(h) lists for the period specified on the portal (rule 4(4)(h)).
- Ensure compliance with the directions and standards, including timelines for their implementation, that the Central Government issues to prevent misuse of telecommunication identifiers, equipment, networks and services (rule 4(3)).
- Appoint a Chief Telecommunication Security Officer who is a citizen and resident of India and responsible to your board of directors or similar governing body, give the officer's details to the Central Government in writing on the form specified on the portal, and promptly tell it of any replacement (rule 6(1) and (2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Government, which under rule 4(6) may seek further clarifications from a telecommunication entity and issue directions, orders or instructions to it for the protection of telecom cyber security.
Settledness
- As of
- Open questions
- Which intervals, time limits and log-retention periods apply to a telecommunication entity, given that rules 4(4)(f) and 4(4)(h) leave them to what the Central Government specifies on the portal?
What this law does
Rule 4(4)(a) requires every telecommunication entity to adopt a telecom cyber security policy and to inform the Central Government of its adoption. Rule 4(4)(f) requires a telecommunication entity to conduct periodic telecom cyber security audits of its network and to share the audit report with the Central Government. Rule 4(4)(h) requires a telecommunication entity to establish facilities such as a Security Operations Centre, by itself or in collaboration with other telecommunication entities.
Rule 6 requires every telecommunication entity to appoint a Chief Telecommunication Security Officer, who is responsible to the board of directors or similar governing body of the entity. Rule 4(3) requires every telecommunication entity to ensure compliance with the directions and standards the Central Government issues to prevent misuse of telecommunication identifiers, equipment, networks and services.
Rule 9 provides that any contravention of the Rules is dealt with in accordance with the provisions of the Telecommunications Act, 2023. The Rules came into force on the date of their publication in the Official Gazette. The Rules were made by a notification of the Ministry of Communications dated .
When LexLint raises it
When your app profile says your app provides telecom services.