On 21 November 2024 the Department of Telecommunications notified the Telecommunications (Telecom Cyber Security) Rules, 2024 under the Telecommunications Act, 2023. They place hard obligations on every telecom service provider and network operator in India: a six-hour clock to report a security incident, a mandatory Chief Telecommunication Security Officer who must be an Indian citizen, and a standing duty to test, monitor and defend the network. Here is what the rules require, who they bind, and what a telecom entity has to put in place.
Who has to comply
The rules bind a 'telecommunication entity': anyone who provides a telecommunication service or operates a telecommunication network under the Telecommunications Act, 2023. In practice that is mobile operators, internet service providers, and the operators of the networks behind them. Equipment manufacturers and importers pick up a narrower set of duties around device identifiers, covered below.
The six-hour incident clock
The headline obligation is speed. A telecommunication entity that becomes aware of a security incident affecting its network or services must report it to the Central Government within six hours. A fuller report follows within twenty-four hours and must set out the number of users affected, the duration of the incident, the geographical area impacted, the extent of the disruption, the impact, and the remedial measures taken or proposed.
The CTSO — a named, accountable person
Every telecommunication entity must appoint a Chief Telecommunication Security Officer. The CTSO must be a citizen and resident of India, owns the implementation of the entity's telecom cyber security framework, and is the entity's liaison with the government for compliance and incident reporting. This is a named, accountable role rather than a committee: the point is that there is one person the regulator can hold responsible.
The standing security obligations
Beyond reporting, the rules require a telecommunication entity to run a real security programme. It must adopt a telecom cyber security policy covering risk assessment, network testing, incident response and forensics; put in place the means to monitor its network for security incidents; test its systems for vulnerabilities; keep the records the government may call for; and comply with the directions and audits the government issues. In plain terms: a written policy, a monitoring capability, regular testing, and the logs to prove it.
| Duty | What it means in practice | Owner |
|---|---|---|
| Report incidents | 6 hours to notify, 24 hours for the detailed report | CTSO |
| Cyber security policy | Risk assessment, testing, response, forensics | CTSO / board |
| Monitor the network | A SOC or equivalent watching for incidents | Security operations |
| Test for vulnerabilities | Vulnerability assessment and penetration testing | Security / external auditor |
| Keep records | Logs and evidence the government may require | IT / security |
| Cooperate with government | Furnish data and submit to directions and audit | CTSO |
The core duties and who owns them
What the government can ask for
The rules let the Central Government, or an agency it authorises, require a telecommunication entity to furnish traffic data and other data — not the content of messages — for the purpose of telecom cyber security. Data collected this way may be shared with other agencies or stakeholders only for telecom cyber security, and the rules require safeguards against unauthorised access. If you operate a network, assume the data you hold can be called for, and hold it accordingly.
Device identifiers (IMEI)
A separate strand binds device makers and importers. Manufacturers must register the International Mobile Equipment Identity (IMEI) of a device before its first sale in India, and importers must register identifiers before import. Tampering with a device identifier is prohibited, and devices with tampered identifiers can be blocked from networks. If your business touches the device supply chain rather than the network, this is the part of the rules that reaches you.
The compliance checklist
- Appoint a CTSO who meets the citizen-and-resident test and give them board-level access.
- Write and adopt the telecom cyber security policy — risk assessment, testing, incident response, forensics.
- Stand up monitoring: a security operations centre, in-house or managed, that can actually see an incident.
- Run a baseline vulnerability assessment and penetration test, and fix what it finds.
- Build one incident runbook that files the six-hour report to both the DoT and CERT-In, and rehearse it.
- Sort out logging and retention so you can produce what the government may require.
- Register device identifiers if you manufacture or import equipment.
Most of this you can reuse from CERT-In work
If you already run a CERT-In empanelled audit programme, you are closer than you think. The testing, monitoring and incident-response duties in these rules overlap heavily with the CERT-In 2022 Directions and the empanelled-audit process — see our walkthrough of the CERT-In empanelment process and the buyer's guide to a CERT-In empanelled audit. The practical gaps for most telecom entities are the named CTSO, the DoT reporting line, and proof that the monitoring and testing actually run. Macksofy covers those pieces as a CERT-In empanelled auditor: VAPT for the testing duty, a managed SOC for the monitoring duty, and digital forensics and incident response for the six-hour clock.
Macksofy is a CERT-In empanelled auditor. We run the VAPT, the SOC and the incident response the rules require, and help you stand up the reporting line and the evidence trail. Tell us where your network is today.