Archive · 3 Nov 2025
India to Implement Mandatory Cybersecurity Checks for Connected Devices
Imagine all your smart gadgets, like your phone or smart TV, had to pass a safety test before you could use them, especially if they are used in important places like hospitals or power plants.
The government in India is planning to make this happen for connected devices used in critical sectors.
This means manufacturers will have to prove where their devices come from and that they are secure and free from hidden problems.
This is because officials found that many devices, especially imported ones, might have security weaknesses that could be exploited by bad actors.
The goal is to protect important systems like electricity grids, hospitals, and transportation from cyber threats.
While the plan was initially for next year, it might take a few more years for industries to get ready.
This is similar to rules already in place for phone companies to use only trusted equipment.
India is proposing a new mandatory cybersecurity framework for connected devices in critical sectors.
The framework will require verification of sourcing and rigorous security testing for devices before deployment.
Sectors affected include medical, transport, industrial, power, and health, among others.
The initiative aims to address identified gaps in cybersecurity certification and mitigate risks from compromised imported products.
Implementation is expected to take three to four years, allowing industries time to build necessary capabilities.
- Who
- National Security Council Secretariat (NSCS)
- What
- Developing a mandatory cybersecurity framework for connected devices in critical sectors, requiring sourcing verification and security testing.
- When
- Initial timeline of January 1, 2027, is expected to be pushed back by three to four years.
- Where
- India
- Why
- To address gaps in cybersecurity certification and mitigate risks from malware and tampered components in critical infrastructure.
Government Perspective
Industry Concerns
Need for Uniform Standards
Government Perspective
The government, through NSCS, is developing a framework to address cybersecurity gaps across critical sectors, emphasizing the need for secured devices.
Industry Concerns
Industry stakeholders suggest that adhering to varying technical norms across sectors might be challenging for technology vendors, advocating for a uniform, BIS-like certification standard.
Implementation Timeline
Government Perspective
The initial timeline for developing a secure devices ecosystem policy was January 1, 2027, with a phased approach considering sectoral maturity.
Industry Concerns
Officials anticipate pushing back the timeline by three to four years to allow industries sufficient time to build the capability to implement the policy.
- Developing Authority
- National Security Council Secretariat (NSCS) under the Prime Minister’s Office
- Proposed Requirement
- Mandatory verification of sourcing and rigorous security testing before deployment
- Affected Sectors
- Critical sectors including medical, transport, industrial, power, health, and railways
- Reason for Framework
- Identified gaps in cybersecurity certification and risks from imported products/tampered components
- Implementation Timeline (Estimated)
- 3-4 years for industries to build capability, initially targeted for January 1, 2027
- Cybersecurity Incidents in India (Oct 2023 - Sep 2024)
- Over 369 million malware detections