India to Mandate Strict Cybersecurity Framework for Connected Devices in Critical Sectors

Tech

Updated on 03 Nov 2025, 12:03 am

Reviewed By

Aditi Singh | Whalesbook News Team

Short Description :

India is developing a new, mandatory cybersecurity framework for all connected devices used in critical sectors, including healthcare, energy, and transportation. The National Security Council Secretariat (NSCS) is leading this initiative, which will require devices to undergo sourcing verification and rigorous security testing before deployment. While an initial timeline of January 1, 2027, was considered, the government is now likely to give industries three to four years to build the necessary capabilities.

India to Mandate Strict Cybersecurity Framework for Connected Devices in Critical Sectors

▶

Detailed Coverage :

The Indian government, through the National Security Council Secretariat (NSCS) under the Prime Minister's Office, is preparing to implement a stringent cybersecurity framework for connected devices across critical sectors. This proposed regulation aims to address identified gaps in cybersecurity certification, particularly concerning imported products and critical infrastructure, which are vulnerable to malware and component tampering.

The framework will mandate verification of the source of all connected devices and require thorough security testing before they are deployed in sectors such as medical scanners, smart meters, transport control systems, industrial equipment, power, health, and railways. While the initial target for policy implementation was January 1, 2027, officials now indicate a more realistic timeline of three to four years for industries to develop the capacity to comply.

Industry stakeholders have expressed concerns about the potential challenges in adhering to varying technical norms across different sectors, advocating for a uniform, BIS-like certification standard. The move is inspired by the telecom sector's approach to securing its ecosystem.

Impact This new framework could significantly affect manufacturers and technology vendors by necessitating higher compliance costs and product development efforts focused on security. Companies failing to meet these standards may face market exclusion for critical infrastructure projects. However, it also presents opportunities for domestic cybersecurity solution providers and secure hardware manufacturers. The extended timeline aims to facilitate a smoother transition and build robust indigenous capabilities. Impact Rating: 7/10

Difficult Terms:

* **Cybersecurity**: The practice of protecting computer systems, networks, and digital data from theft, damage, or unauthorized access. * **Malware**: Malicious software designed to disrupt, damage, or gain unauthorized access to computer systems. * **IoT (Internet of Things)**: A network of physical devices embedded with sensors, software, and connectivity to exchange data over the internet. * **DDoS Attack (Distributed Denial-of-Service Attack)**: A cyber-attack aimed at making an online service unavailable by overwhelming it with traffic from multiple sources. * **NSCS (National Security Council Secretariat)**: A key agency in India responsible for coordinating national security matters and providing strategic direction. * **BIS (Bureau of Indian Standards)**: India's national standards body, responsible for quality certification and standardization of goods and services. * **AoB Rules (Allocation of Business Rules)**: Government rules that define and allocate specific business responsibilities among different ministries and departments.