A New Era for Telecommunication Infrastructure: DoT Releases New Rules for Critical Telecommunication Infrastructure

Classification of CTI. The Rules provide that the Government may classify certain telecom infrastructure as CTI based on an assessment of whether disruption of such infrastructure will have a debilitating impact on national security, economy, public health or safety of the nation. For the purposes of enabling such notification, the Government will seek details of telecommunication network, telecommunication services, elements of network, etc. from Telecom Entities.

Compliance Requirements. Telecom Entities will be required to adhere to specific security standards, specifications, interface requirements, etc. issued by the Government for CTI. This includes conformance to requirements and standards stipulated by the Telecommunication Engineering Centre, National Centre for Communications Security, etc. as well as the National Security Directive on Telecommunication Sector.

Power to Inspect CTI. The Government will have the authority to inspect CTI to ensure compliance with the Rules.

Chief Telecommunication Security Officer. Each Telecom Entity will be required to appoint a Chief Telecommunication Security Officer (CTSO) (appointed pursuant to the Telecommunications (Telecom Cyber Security) Rules, 2024 (Cybersecurity Rules)) who will be the point of contact to the Government for implementation of the Rules. The CTSO will be responsible for providing the details of (a) logs for real time monitoring by the Government, (b) service level agreements pertaining to CTI, (c) cyber-crisis management plan for CTI, etc.

Obligations of Telecom Entities. The Rules prescribe various obligations in relation to CTI. Some of the notable obligations are:

Compliance with to be prescribed standards, upgradation requirements, etc. for CTI.

Maintenance of a complete list of Critical Telecommunication Infrastructure along with the software and hardware details including details of architecture and any changes in such architecture.

Development and maintenance of adequate verification practices and protocols applicable for all personnel authorised to have access to CTI.

Maintenance of records of the supply chain of the telecommunication equipment and other equipment deployed in CTI till such CTI is in use.

Ensuring that remote access to CTI for the purpose of repair or maintenance and production of such logs to the government, if required.

Implementation of standard operating procedures for security incident response systems and mechanisms to ensure intimation of security incidents to the Government within 2 hours of occurrence of such incidents.

Intimation of Security Incidents. The Rules provide that any security incident (as defined under the Cybersecurity Rules) in relation to CTI will have to be intimated to the government within two hours of occurrence of such incident.

Prior Approval and Certification for Upgradation. Upgradation to equipment which form a part of the CTI will require prior written approval from the government.