India's Cyber Security Architecture: National Cyber Security Policy 2013, CERT-In and NCIIPC

National Cyber Security Policy 2013

Objectives and the Target of Five Lakh Professionals

The National Cyber Security Policy 2013 was India's first policy framework on cyber security. It came in 2013, the year in which documents leaked by Edward Snowden were reported to show that United States surveillance had focused on India's political, strategic and commercial interests. The policy treats cyberspace as "a complex environment consisting of interactions between people, software and services, supported by worldwide distribution of information and communication technology (ICT) devices and networks". It names the threats it must meet, among them identity theft, phishing, hacktivism, cyber terrorism, advanced persistent threats, denial of service, botnets and supply chain attacks. It describes the protection of "the confidentiality, integrity and availability of information in cyberspace" as the essence of a secure cyberspace.

The elements of cyber security that protect these three properties are set out as domains in CERT-In's guidelines on information security practices for government entities, issued in June 2023. They are data security, network security, application security, identity and access management, security monitoring, incident management and security auditing.

The mission of the policy is to protect information and information infrastructure, build the capability to prevent and respond to cyber threats, reduce vulnerabilities and limit damage. Its 14 objectives fall into five broad groups:

• Secure ecosystem: Trust in IT systems and transactions, an assurance framework built on global security standards, and a stronger regulatory framework.
• Early warning and protection: National and sectoral mechanisms that work 24 x 7, and a 24 x 7 NCIIPC to protect critical information infrastructure.
• Indigenous capability: Research into indigenous security technologies, and testing infrastructure to verify the security of ICT products.
• People: A workforce of five lakh professionals skilled in cyber security within five years, a culture of cyber security and privacy, and fiscal benefits for businesses that adopt standard security practices.
• Law and partnership: Protection of citizens' data, effective prevention, investigation and prosecution of cyber crime, public-private partnerships and global cooperation.

The workforce target of five lakh professionals is the policy's only objective with a number and a deadline.

The strategies are grouped under 14 headings, from creating a secure cyber ecosystem to a prioritised approach for implementation. The first is to designate a national nodal agency to coordinate all matters related to cyber security in the country. Others ask every organisation to designate a Chief Information Security Officer (CISO) from senior management, to earmark a specific budget for cyber security, and to adopt a crisis management plan.

The strategies also call for a 24 x 7 national CERT that would act as an umbrella for sectoral CERTs, a 24 x 7 NCIIPC, regular national and sectoral cyber security drills, mandatory security audits of critical information infrastructure, and procurement of trusted and indigenously made ICT products. The policy ends by stating that it would be operationalised through detailed guidelines and plans of action at the national, sectoral, State, ministry, department and enterprise levels.

Implementation Gaps and the Pending National Cyber Security Strategy

The 2013 policy set direction but left the means open. It fixed no budget and, apart from the workforce target, no timeline. Its strongest provisions for organisations were worded as encouragement. Entities were to be "encouraged" to designate a CISO, develop security policies and adopt guidelines for trusted procurement. Mandatory language was kept mainly for critical information infrastructure and e-governance, where security audits and best practices were to be mandated.

Three gaps remain:

• Private sector: The policy promised fiscal benefits and public-private partnerships to bring private organisations along, but it did not define either.
• Imported technology: Indigenous security products and trusted procurement remained an aim; as late as October 2021, the Central Electricity Authority's guideline on cyber security in the power sector had to make procurement from trusted sources, or malware testing before deployment, mandatory.
• Ageing policy: Threats the 2013 text does not name, such as attacks on artificial intelligence systems, virtual assets and Internet of Things devices, now appear in CERT-In's mandatory reporting list of 2022.

The Office of the National Cyber Security Coordinator has been preparing a new National Cyber Security Strategy since about 2019. The Government told the Lok Sabha in August 2021 that the strategy was "in the final stages of approval". In October 2023, the national cyber security exercise Bharat NCX 2023 highlighted "the need for a National Cyber Security Strategy" with governance structures supported by legal frameworks. In March 2025 the Government again cited the 2013 policy as the framework in force.

Institutions of India's Cyber Security Architecture

CERT-In Under Section 70B and Sectoral CERTs

CERT-In, the Indian Computer Emergency Response Team, is the national agency for responding to cyber security incidents. CERT-In was formed in January 2004 under the Ministry of Electronics and Information Technology (MeitY). It received a statutory base when the IT Amendment Act, 2008, inserted Section 70B, and the Central Government appointed it under that section by a notification of 27 October 2009.

Section 70B(4) lists its functions:

• Collection, analysis and dissemination of information on cyber incidents.
• Forecasts and alerts of cyber security incidents.
• Emergency measures for handling cyber security incidents.
• Coordination of cyber incident response activities.
• Guidelines, advisories, vulnerability notes and white papers on information security practices and on the reporting of cyber incidents.

Section 70B(6) gives CERT-In its sharpest power. It may call for information and give directions to service providers, intermediaries, data centres, body corporate and any other person. Under Section 70B(7), failure to provide the information or to comply is punishable with imprisonment of up to one year, or a fine of up to ₹1 crore, or both. The Jan Vishwas (Amendment of Provisions) Act, 2023, raised the fine from ₹1 lakh with effect from 30 November 2023.

The Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013, notified on 16 January 2014, set out how CERT-In works. Rule 12 of these Rules makes the reporting of listed types of cyber security incidents to CERT-In mandatory.

The 2013 policy envisaged CERT-In as an umbrella for sectoral CERTs. These sectoral teams have taken the form of Computer Security Incident Response Teams (CSIRTs) for finance, power and telecom. CSIRT-Fin, which works under CERT-In, has coordinated incident response in banking and finance since May 2022, and CSIRT-Power, an extended arm of CERT-In, has handled cyber security issues in the power sector since September 2024. CERT-In also oversees State CSIRTs run by State and Union Territory governments, and the Army, Navy and Air Force have each set up their own Cyber Emergency Response Teams.

NCIIPC and Protected Systems Under Section 70A

NCIIPC is the national nodal agency for the protection of India's critical information infrastructure. It was created under Section 70A of the IT Act through a gazette notification on 16 January 2014. It is a unit of the National Technical Research Organisation (NTRO), which places it under the Prime Minister's Office, and it is based in New Delhi.

The work of NCIIPC begins with the definition in Section 70 of the IT Act. Critical Information Infrastructure means "the computer resource, the incapacitation or destruction of which, shall have debilitating impact on national security, economy, public health or safety". The appropriate Government may, by notification, declare any computer resource that affects such infrastructure to be a protected system. Only persons authorised in writing may access it, and any person who secures or attempts to secure access in contravention of the section faces imprisonment of up to ten years and a fine. The Central Government prescribes the security practices for protected systems; it has done so through the Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018.

NCIIPC has identified six critical sectors:

• Power and energy.
• Banking, financial services and insurance.
• Telecom.
• Transport.
• Government.
• Strategic and public enterprises.

NCIIPC identifies critical information infrastructure for notification, provides near real-time threat intelligence and situational awareness, issues alerts and advisories to the entities that run such systems, and periodically assesses their vulnerabilities and risks. It runs a 24 x 7 help desk for incident reporting and a responsible vulnerability disclosure programme. The basic responsibility for protecting a critical system still lies with the agency that runs it.

National Cyber Security Coordinator and the Defence Cyber Agency

The National Cyber Security Coordinator heads the office in the NSCS that coordinates cyber security among the different agencies. The office was created in 2015 to advise the Prime Minister on strategic cyber security issues, and it is responsible for formulating the national cyber security strategy. The NSCS serves the National Security Council, which, like the NTRO, comes under the Prime Minister's Office, while CERT-In and the Defence Cyber Agency stay with their own ministries, MeitY and the Ministry of Defence. The NSCS also runs the national cyber security exercise Bharat NCX with Rashtriya Raksha University; the 2025 edition, held from 21 July to 1 August 2025, focused on the operational preparedness of Indian cyberspace.

Two operational centres support this coordination:

• National Cyber Coordination Centre (NCCC): Implemented by CERT-In, it scans Indian cyberspace at the metadata level to detect threats and shares threat intelligence with organisations, State Governments and agencies.
• Cyber Multi Agency Centre (CyMAC): Set up by the Ministry of Home Affairs under the Multi Agency Centre platform, it links agencies including the Intelligence Bureau, the Defence Cyber Agency, CERT-In, NCIIPC, the Indian Cyber Crime Coordination Centre (I4C) and the National Informatics Centre for real-time monitoring and shared threat intelligence.

The Defence Cyber Agency is the armed forces' answer to cyber threats. Its creation, along with the Defence Space Agency and the Armed Forces Special Operations Division, was approved on 28 September 2018 by upgrading the Defence Information Assurance and Research Agency. It was activated in November 2019 and became operational in August 2021. The agency draws personnel from all three Services, and its head, a two-star officer, reports to the Chief of Defence Staff through the Integrated Defence Staff. On 7 August 2025, the Chief of Defence Staff released the Joint Doctrine for Cyberspace Operations, which aims to defend national cyberspace interests through integrated offensive and defensive capabilities.

CERT-In Directions of 2022

Six-Hour Incident Reporting and Log Retention

The CERT-In Directions of 28 April 2022 were issued under Section 70B(6) of the IT Act to close gaps that CERT-In had met while analysing incidents. They apply to service providers, intermediaries, data centres, body corporate and Government organisations. They were to take effect 60 days after issue; in June 2022, CERT-In extended the deadline to 25 September 2022 for micro, small and medium enterprises, and for the customer-validation duties of data centres and of cloud, virtual private server and virtual private network (VPN) providers.

The Directions impose five main duties:

• Clock synchronisation: All ICT systems must be synchronised with the Network Time Protocol servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), so that logs from different systems can be matched.
• Six-hour reporting: Twenty types of cyber incident, listed in Annexure I, must be reported to CERT-In within six hours of noticing them or being told of them. The list runs from targeted scanning of critical networks and ransomware to data breaches, attacks on digital payment systems, fake mobile apps and attacks on artificial intelligence systems.
• Point of contact and assistance: Each entity must name a point of contact and must provide information or assistance when CERT-In orders it.
• Log retention: Logs of all ICT systems must be kept securely for a rolling period of 180 days.
• Subscriber and customer records: Data centres, virtual private server providers, cloud service providers and VPN providers must keep validated subscriber details, such as names, Internet Protocol (IP) addresses, period of hire and purpose, for five years. Virtual asset service providers, exchanges and custodian wallet providers must keep know-your-customer records and transaction records for five years.

CERT-In's frequently asked questions (FAQs) of May 2022 clarified several points. Logs may be stored outside India, as long as they can be produced to CERT-In within a reasonable time. The VPN duties apply to providers of "Internet proxy like services" to general users, not to the internal VPNs of companies. On privacy, CERT-In stated that it does not seek information from service providers as a standing arrangement but only case by case, in connection with incidents.

Debate on VPN and Data Centre Obligations

The Directions divided opinion. Their purpose is visibility. When incidents are quietly handled and never shared, CERT-In cannot warn others, and logs are often missing when an attack has to be traced. Prompt reporting, common clock time and stored logs make an attack traceable and let warnings go out while a campaign is still running.

Critics raised three objections:

• Tight deadline: Six hours is short beside comparable rules abroad; the European Union's General Data Protection Regulation allows up to 72 hours to report a personal data breach to the supervisory authority.
• Cost: Reporting 20 types of incident and keeping logs of every ICT system weighs most on small firms, which is why the deadline for micro, small and medium enterprises was extended.
• Privacy: Keeping validated identities, IP addresses and purposes of VPN users for five years runs against the reason many people use VPNs. After the Directions, ExpressVPN announced that it would move its India-based servers to Singapore and the United Kingdom, and NordVPN closed its physical servers in India in 2022.

The Government's reply, set out in the FAQs, is that the right to informational privacy is not affected, because information is sought only case by case for incidents and service providers remain bound to protect users' data. The Digital Personal Data Protection (DPDP) Act, 2023, which received assent on 11 August 2023, now adds a separate duty to report personal data breaches to the Data Protection Board of India and to the persons affected.

Comprehensiveness of India's Cyber Security Strategy

Strengths: Institutions, Drills and Cyber Swachhta Kendra

India's cyber security effort is broad in its institutions. Incident response, critical infrastructure, coordination, crime and military defence each have a named agency with a legal or executive basis. The scale of the work has grown with the threat. Cyber security incidents tracked by CERT-In rose from 15,92,917 in 2023 to 20,41,360 in 2024 and 29,44,248 in 2025. In 2025, CERT-In issued 1,530 alerts, 390 vulnerability notes and 65 advisories.

India prepares for attacks in five ways:

• Drills: CERT-In held 122 cyber security drills and exercises in 2025, with about 1,570 organisations from sectors such as defence, space, atomic energy, finance, power and transport.
• Crisis plan: The Cyber Crisis Management Plan of CERT-In guides Ministries, Departments, State Governments and their organisations in countering cyber attacks and cyber terrorism.
• Audits: All Government websites and applications are audited before they are hosted, and 237 information security auditing organisations were empanelled by CERT-In as of August 2026.
• Training: MeitY's Cyber Surakshit Bharat programme, run in public-private partnership mode, trains CISOs and IT staff of Central and State Governments, banks and public sector units. Its Information Security Education and Awareness project has held 6,650 awareness workshops covering over 11.37 lakh participants.
• Funding: The Union Budget 2026‑27 provides ₹790 crore for MeitY's cyber security projects, against ₹782 crore in 2025‑26, and a further ₹269 crore for CERT-In.

The Cyber Swachhta Kendra, the Botnet Cleaning and Malware Analysis Centre, carries cyber hygiene to citizens. CERT-In launched it on 21 February 2017. It tracks computers, phones, Internet of Things devices and home routers infected with malware, alerts their users through internet service providers, and offers free tools to clean them. By December 2025, it covered 98 per cent of India's digital population, had 1,427 organisations on board and recorded 89.55 lakh downloads of its malware removal tools.

Gaps: No Overarching Law, Skills and Coordination

India has many institutions but no single cyber security law. Cyber law is not named in any of the three lists of the Seventh Schedule, so it falls under the residuary powers, on which only Parliament can legislate. Duties are spread across the IT Act, CERT-In's executive Directions, the DPDP Act and sector rules such as the power sector guideline of 2021. A firm that runs a payment system or a power utility may answer to CERT-In, NCIIPC, its sector regulator and the Data Protection Board at the same time, each with its own reporting rules.

The main gaps are these:

• No new strategy: Five years after it was called nearly final, the strategy has not replaced the 2013 policy.
• Skills: Training is spread across several schemes with no combined count; in 2025, CERT-In's own 32 training programmes covered 20,799 participants.
• Coordination: Agencies sit under five different authorities, the NSCS, the NTRO, MeitY, the Ministry of Home Affairs and the Ministry of Defence. Platforms such as the NCCC and CyMAC were built to share threat information, but integration is still under way; agencies are being encouraged to fully integrate with CyMAC.
• Disclosure: NCIIPC does not reveal details of breaches of critical infrastructure, on grounds of national security, which limits public learning from past attacks.

International Cooperation on Cyber Security

Budapest Convention and India's Position

The Budapest Convention on Cybercrime of the Council of Europe was the first international treaty on internet and computer crime. It was opened for signature in Budapest on 23 November 2001 and entered into force on 1 July 2004; by August 2025, 81 states had ratified it. It requires parties to criminalise offences such as hacking and child sexual abuse material, gives investigators powers such as the expedited preservation of stored data, and sets up a 24 x 7 network for speedy assistance among parties.

India has not joined the Budapest Convention. It declined on the ground that it did not take part in drafting the treaty. It began reconsidering its stand in 2018 because of the surge in cyber crime, but concerns about sharing data with foreign agencies remain. Those concerns bear on a provision of the Convention that allows a party to access stored computer data in another country without mutual assistance, where the data is public or the person with lawful authority consents.

UN Cybercrime Convention 2024 and Bilateral Cyber Dialogues

The United Nations Convention against Cybercrime is the first global treaty focused on cooperation against cyber crime. The UN General Assembly adopted it on 24 December 2024 by Resolution 79/243. It opened for signature in Hanoi on 25 and 26 October 2025, where 72 states signed, and it stays open at UN Headquarters in New York until 31 December 2026. It requires parties to criminalise offences such as illegal access to a system, data interference, computer fraud and child exploitation, and it provides for the preservation and sharing of electronic evidence across borders.

India signed the Convention on 25 September 2026, one of 13 countries that signed that month. As of 12 November 2026, the Convention had 96 signatories but only three parties, Azerbaijan, Qatar and Vietnam. It will enter into force on the ninetieth day after the fortieth instrument of ratification is deposited, so it is not yet in force.

Human rights organisations have criticised the treaty for a vague definition of cyber crime and for leaving human rights safeguards to each country.

India's bilateral and group cooperation runs alongside these treaties:

• CERT-to-CERT agreements: CERT-In signed a memorandum of understanding with the United Kingdom's Cabinet Office in May 2016, and earlier ones with Korea, Canada, Australia, Malaysia, Singapore, Japan and Uzbekistan.
• Quad: The Quad Cybersecurity Partnership issued Joint Principles for Secure Software on 20 May 2023, and the Quad held a Cyber Challenge in October 2024.
• Dialogues: India and France hold a cyber dialogue, which met in Paris on 9 January 2024.
• Counter-ransomware work: In September 2022, CERT-In hosted the exercise "Synergy" with Singapore's Cyber Security Agency for 13 countries, under the International Counter Ransomware Initiative.

Sources

• MeitY: National Cyber Security Policy 2013
• Wikipedia: National Cyber Security Policy 2013
• MeitY: Information Technology Act, 2000
• MeitY: The Jan Vishwas (Amendment of Provisions) Act, 2023
• Wikipedia: Information Technology Act, 2000
• CERT-In: Directions under sub-section (6) of section 70B of the Information Technology Act, 2000, 28 April 2022
• CERT-In: FAQs on Cyber Security Directions of 28.04.2022
• PIB: CERT-In issues directions relating to information security practices, 28 April 2022
• PIB: CERT-In extends timelines for enforcement of Cyber Security Directions till 25 September 2022
• PIB: Government Strengthens Cyber Security Preparedness of Central Government Digital Platforms and Citizen Services, 14 August 2026
• PIB: CERT-In, India's Frontline Defender against Cyber Threats, 23 January 2026
• PIB: India's Cybersecurity Ecosystem Scales New Heights, 29 October 2025
• PIB: Cyber Security Infrastructure, Ministry of Home Affairs, 2 December 2025
• PIB: Government of India Taking Measures to Protect Critical Infrastructure and Private Data Against Cyber Attacks
• PIB: Government Taking Measures to Strengthen National Preparedness Against Cybersecurity Threats
• PIB: Cyber Warfare, Ministry of Defence, 4 August 2021
• PIB: Bharat National Cyber Security Exercise 2023 Concludes
• PIB: Government releases guideline for the Cyber Security in Power Sector, 7 October 2021
• Wikipedia: Indian Computer Emergency Response Team
• Wikipedia: National Critical Information Infrastructure Protection Centre
• Wikipedia: National Security Council (India)
• Wikipedia: Defence Cyber Agency
• Wikipedia: Digital Personal Data Protection Act, 2023
• Wikipedia: General Data Protection Regulation
• Wikipedia: ExpressVPN
• Wikipedia: NordVPN
• Wikipedia: Budapest Convention on Cybercrime
• United Nations Treaty Collection: United Nations Convention against Cybercrime, status as at 12 November 2026
• UNODC: Momentum builds as new countries sign the UN Convention against Cybercrime, 25 September 2026
• UNODC: Seventy-two nations sign first UN treaty to fight cybercrime
• Wikipedia: United Nations Convention against Cybercrime
• MEA: Quad, updated July 2026
• MEA: India-France Bilateral Brief, June 2026
• Union Budget 2026‑27: Notes on Demands for Grants, Demand No. 27, Ministry of Electronics and Information Technology
• PIB: Bharat NCX 2025 Commences, Advancing India's Cyber Resilience through Proactive Capacity Building
• Wikipedia: Prime Minister's Office (India)
• NCERT: Class 11 Political Science: Indian Constitution at Work, Chapter 7
• UPSC: Civil Services Examination question papers