Cybersecurity in India — CERT-In, NCIIPC, DPDP Act

Why this matters now

India's digital economy now runs the world's largest real-time payments system (UPI), India Stack public infrastructure, the world's largest national biometric identity (Aadhaar), and the world's third-largest internet user base. Every one of these is an attack surface. Three reasons cybersecurity deserves its own GS-3 deep-dive. First, the threat landscape has grown 3.5× since 2019. Second, the legal-institutional architecture (IT Act, DPDP Act, CERT-In, NCIIPC) has not kept pace and is being rebuilt in real time. Third, recent incidents (AIIMS 2022, Kudankulam 2020, Cosmos Bank 2018) have brought cybersecurity into mainstream policy debate.

Threat landscape

• Ransomware — targeting hospitals, banks, government; ~50% increase in 2023;
• Nation-state attacks — China (APT41, Mustang Panda), Pakistan (SideCopy), North Korea (Lazarus);
• Phishing + smishing — affects millions;
• Financial fraud — UPI fraud, digital arrest scams; ~₹1,750 crore lost in 2023 per RBI;
• Critical infrastructure — power grids, ports, water utilities;
• AI-powered attacks emerging — deepfakes, automated phishing;
• IoT vulnerabilities — connected devices, smart meters, cars;
• Election threats — generative AI deepfakes in 2024 Lok Sabha.

Major incidents

Indian Computer Emergency Response Team (CERT-In)

India's nodal national cybersecurity incident-response agency. Established January 2004 by MeitY; given statutory backing through Section 70B of the IT (Amendment) Act 2008.

Functions

• Collect, analyse, disseminate cyber incident information;
• Forecast and alert on cyber threats;
• Issue guidelines, advisories, vulnerability notes;
• Coordinate national response to cyber incidents;
• Operate the National Cyber Coordination Centre (NCCC, 2017);
• Coordinate sector-specific CERTs — CERT-Fin (financial), CERT-Power, CERT-Telecom.

CERT-In Directions, 28 April 2022

Major regulatory expansion:

• Mandatory reporting of cyber incidents within 6 hours;
• Maintain logs for 180 days within India;
• VPN providers, data centres, virtual asset service providers must maintain customer KYC for 5 years;
• Global cybersecurity coordination — US-CERT, UK-CERT, ASEAN CERT, Asia-Pacific CERT.

NCIIPC and Critical Information Infrastructure

National Critical Information Infrastructure Protection Centre — established 16 January 2014 under Section 70A of the IT (Amendment) Act 2008. Parent: National Technical Research Organisation (NTRO) under the National Security Adviser.

Section 70(1) of the IT Act defines Critical Information Infrastructure as "computer resource the incapacitation or destruction of which shall have debilitating impact on national security, economy, public health or safety."

Seven CII sectors

1. Power & Energy — grid, refineries, gas pipelines;
2. BFSI — RBI, NPCI, banks, payment systems;
3. Telecom — Jio, Airtel, BSNL, submarine cables;
4. Transport — Railways, airports, ports;
5. Government — strategic e-governance (MCA21, GST, e-Office);
6. Strategic & Public Enterprises — HAL, BEL, BHEL, NTPC;
7. Health — major hospital networks and databases.

Section 70(3) — penalty up to 10 years imprisonment for unauthorised access to CII.

IT Act 2000 + 2008 Amendment

India's foundational cyber law. Enacted 17 October 2000; significantly amended 2008.

Key cybercrime sections

Section 66A (objectionable messages) was struck down by the Supreme Court in Shreya Singhal v. Union of India (2015) as violative of Article 19(1)(a).

IT Rules 2021

Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules — require platforms with 50+ lakh users to appoint Indian compliance officers, address traceability requirements (challenged by WhatsApp), and regulate OTT and online news.

DPDP Act 2023

The Digital Personal Data Protection Act 2023, enacted 11 August 2023 — India's first dedicated data protection law.

• Defines personal data and consent requirements;
• Establishes Data Protection Board of India;
• Rights — access, correction, erasure, grievance redressal;
• Significant penalties up to ₹250 crore for major violations;
• Child data — verifiable parental consent required;
• Cross-border data transfer rules;
• Exemptions for state agencies (national security);
• Implementation rules expected 2024-25.

DPDP also amended Section 8(1)(j) of RTI to broaden personal-information exemption — currently being challenged in the Supreme Court.

National Cyber Security Policy 2013 — and the proposed 2024 strategy

NCSP 2013 notified July 2013. India's first and currently only comprehensive national cyber policy. Vision: "To build a secure and resilient cyberspace for citizens, businesses, and government."

Four broad objectives:

1. Protect critical infrastructure;
2. Develop capacity (skilled professionals, R&D);
3. Enhance cooperation with international partners;
4. Cyber awareness for citizens.

NCSP 2013 created the roadmap for NCIIPC (2014), CERT-In expansion, NCCC (2017), and Cyber Surakshit Bharat (2018). A draft National Cyber Security Strategy 2020 was prepared by Lt Gen Rajesh Pant (India's first National Cyber Security Coordinator) but never officially released. The expected 2024+ strategy is overdue.

Key cybersecurity programmes

• Cyber Surakshit Bharat (2018) — CISO capacity building;
• Cyber Swachhta Kendra — Botnet Cleaning & Malware Analysis Centre by CERT-In;
• Cyber Hygiene Centre — public tools;
• National Cyber Coordination Centre (NCCC) — 2017; metadata-level monitoring;
• I4C — Indian Cyber Crime Coordination Centre (MHA, 2020);
• Cyber Crime Reporting Portal — cybercrime.gov.in;
• Citizen Helpline 1930 — cyber financial fraud reporting;
• Indo-US iCET cybersecurity collaboration;
• QUAD cybersecurity working group;
• Information Sharing & Analysis Centres (ISAC).

Gaps and path forward

• Workforce gap — India has ~5 lakh cyber professionals vs estimated need of 10-15 lakh;
• Strategy overdue — National Cyber Security Strategy 2024+ still pending release;
• Sector coordination — RBI, SEBI, IRDA, TRAI, PNGRB silos;
• Private sector engagement — limited threat intelligence sharing;
• Cross-border data — DPDP transfer rules pending;
• Pegasus and surveillance — accountability framework needed;
• AI security rules — emerging deepfake threat;
• State CERTs — only a few state-level CERTs operational;
• Joint Cyber Doctrine for armed forces — being developed.

"India's cybersecurity stack is being built while the threats it must counter are evolving faster than the law. The next decade will be defined by whether India can close the workforce, institutional, and legal gaps before the next major critical-infrastructure attack." — paraphrasing a recurring Standing Committee on Communications & IT theme

UPSC PYQs and likely future questions

• 2018 GS-3: "Discuss the potential threats of cyber attack and the security framework to prevent it."
• 2022 GS-3: "What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy."
• 2024 GS-3: "Discuss the role of CERT-In and NCIIPC in protecting India's Critical Information Infrastructure. What are the recent challenges?"
• 2020 GS-3: "Examine the role of supercomputers in the development of India's cyber and digital infrastructure."
• Likely 2026: "Examine the Digital Personal Data Protection Act 2023 in the context of India's cybersecurity architecture. What are the implementation challenges?"
• Likely 2026: "Discuss the AIIMS Delhi 2022 ransomware attack as a case study for India's critical-infrastructure cybersecurity. What lessons for policy?"

Related reading