INDUSTRY FACT FILE · GOVERNMENT, PSUS & PUBLIC DIGITAL SERVICES

Cybersecurity FAQs for Government, PSUs and Public Digital Services

Forty frequently asked questions and answers in five categories, written for secretaries and Boards, CISOs and IT heads, project and scheme directors, data centre and PSU plant teams, procurement and data protection officers.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, audit and procurement 3.  Category 3: Citizen platforms, applications and data 4.  Category 4: Data centres, networks, PSU plants and SOC 5.  Category 5: Vendors, people and readiness

Audience: Secretaries, heads of department, PSU Boards and CMDs

Q1. Why are government entities and PSUs such frequent targets?

Because they run services that cannot stop, hold data about millions of citizens and handle policy, infrastructure and commercial information that state-linked actors, criminals and hacktivists all want. Large estates, legacy systems and many vendors give attackers many ways in.

Q2. What are the biggest risks for a government department or PSU?

Ransomware on servers that deliver public services, spear-phishing and email compromise of officials, citizen data exposure through portals and APIs, vendor compromise, defacement and DDoS, OT intrusion at plants, insider misuse and slow detection that misses CERT-In's six-hour window.

Q3. Which incidents should leadership know about?

Ransomware at AIIMS New Delhi in November 2022, malware on an administrative network at Kudankulam in 2019, ransomware at Oil India in 2022 and at Madhya Pradesh's power management company in 2023, and the December 2023 attack on the e-Nagarpalika portal.

Q4. Is this an IT problem or a leadership problem?

A leadership problem. CERT-In's 2023 guidelines place responsibility on senior management to nominate a CISO, fund a security team and ensure audits are done and findings closed. Incidents land on citizens, legislators and auditors, not only on the IT department.

Q5. What should senior management review each quarter?

Status of six-monthly and annual audits and open findings, citizen platforms launched or changed without retesting, vendor access, backup and restore tests, SOC coverage and incidents reported to CERT-In, phishing results, and progress on DPDP and ISO 27001.

Q6. Who should own cybersecurity in a ministry or PSU?

A nominated CISO with a security team separate from IT operations, reporting to senior management, supported by project directors, data centre heads, procurement and a nodal officer for data protection, with a single inventory of systems, data and vendors.

Q7. How should we prioritise investment?

Close critical audit findings and exposed remote access first; segment networks and protect backups; test every citizen-facing portal and API; control vendor access; add 24x7 monitoring; then build DPDP, ISO 27001 and OT programmes over successive budget cycles.

Q8. How can Codec Networks help?

Codec Networks provides audits against CERT-In's guidelines, infrastructure and OT assessments, citizen portal, app and API audits, cloud and data centre reviews, DPDP programmes, ISO 27001 and crisis plans, 24x7 managed SOC, forensics and exercises for central ministries, state governments and PSUs.

Audience: CISOs, nodal officers, procurement and audit teams

Q9. What do CERT-In's 2023 guidelines for government entities require?

They apply to ministries, departments, attached and subordinate offices, government institutions and public-sector enterprises. They call for a nominated CISO and dedicated security team, controls across networks, identity, applications, data, cloud and third parties, and regular internal and third-party audits.

Q10. How often must we be audited?

The guidelines call for internal information security audits at least once every six months and third-party audits at least once a year, with deployment of controls based on the findings. CERT-In empanelled auditors may be used for the external audits.

Q11. Do CERT-In's Directions apply to government organisations?

Yes. The April 2022 Directions name government organisations alongside service providers, intermediaries, data centres and body corporates. Specified incidents must be reported within six hours of noticing them and ICT logs kept for 180 days within India.

Q12. Why do tenders insist on CERT-In empanelled auditors?

Empanelment shows that an auditing organisation has been assessed by CERT-In for information security auditing. Many government and PSU tenders for security audits make it an eligibility condition, and CERT-In reported 231 empanelled audit organisations in 2025.

Q13. What is NICSI's role in security audits?

NICSI procures IT services for NIC-supported projects and has empanelled CERT-In empanelled agencies for security audits of applications, so departments can place work orders through it. Codec Networks is empanelled with NICSI for application audit and compliance services (start-up category).

Q14. What does NCIIPC mean for us?

If a system is notified as a protected system under Section 70 of the IT Act, NCIIPC guidance and controls apply and unauthorised access is a serious offence. Government and public enterprises are among NCIIPC's critical sectors.

Q15. How does DPDP apply to government?

Processing by the State for subsidies, benefits, services, certificates and licences is a legitimate use, subject to standards in the DPDP Rules, and notified instrumentalities may be exempted on specified grounds. Reasonable security safeguards and breach intimation remain central; most obligations apply from May 2027.

Q16. What do GIGW 3.0 and STQC cover?

GIGW 3.0 sets quality, accessibility, lifecycle and cybersecurity requirements for government websites and apps; its cybersecurity chapter was prepared by CERT-In. STQC-empanelled labs assess compliance. A security audit of the application is a separate, complementary requirement.

Audience: Project and scheme directors, platform and development teams

Q17. When should a citizen portal be security audited?

Before it is hosted, after every major release or new module, when integrations with payment, identity or document platforms change, and at least annually. A clean audit at launch says little about the code running a year later.

Q18. What is the most common flaw in citizen portals?

Broken object-level authorisation: the portal checks that a user is logged in but not that the record requested belongs to them. Changing an application or certificate number then returns someone else's data, and scrapers can download whole databases.

Q19. How should APIs be protected?

Authenticate every caller, check authorisation on every object, limit the data returned to what the screen needs, apply rate limits and bot detection, log access centrally and test APIs used by mobile apps and partner departments, not only the web front end.

Q20. How should mobile apps be tested?

Test the app and its back-end APIs together: storage of tokens and personal data on the device, certificate pinning, tampering and reverse engineering, and authorisation on every API call. Monitor app stores for fake apps using the department's name.

Q21. How do we protect Aadhaar-linked and payment flows?

Keep identifiers masked and encrypted, call authentication and payment services only through approved channels, never log full identifiers, test integrations for tampering and replay, and limit which staff and vendors can query or export data.

Q22. What should we do about old websites?

Build an inventory of every domain and subdomain, assign an owner, patch or migrate content-management systems, archive and remove sites whose schemes have ended, and monitor the external attack surface continuously for new or forgotten assets.

Q23. How should development by integrators be controlled?

Require secure coding standards, code review and testing in contracts, keep production data out of test environments, protect repositories and deployment servers with MFA, check the integrity of shared libraries and retest before every release.

Q24. How does Codec Networks test citizen platforms?

Codec Networks performs web, mobile and API security audits aligned with OWASP methods and GIGW expectations, reports findings with evidence and risk ratings, retests fixes and issues closure reports suited to hosting and tender requirements.

Audience: Data centre, network, PSU plant, SOC and incident response teams

Q25. How should state data centres reduce shared risk?

Keep an accurate inventory of hosted applications and owners, isolate tenants and departments, patch shared platforms quickly, protect administrative consoles with MFA and privileged access management, and monitor all tenants from one SOC.

Q26. Why does segmentation matter so much?

Because ransomware spreads across flat networks. The government attributed the AIIMS New Delhi breach to improper network segmentation. Separating clinical, citizen-service, administrative, management and internet zones limits how far one compromised machine can reach.

Q27. How should backups be designed?

Keep offline or immutable copies separate from everyday administrator credentials, back up applications and configurations as well as data, test restores regularly and agree which services must be restored first. Madhya Pradesh restored its municipal portal from tape backups in 2023.

Q28. How should PSU plants and utilities approach OT security?

Map the OT network, separate it from corporate IT, control vendor remote access through jump hosts with MFA, monitor plant traffic, assess against IEC 62443 and include OT in the risk-based audits expected by CERT-In's 2025 guidelines.

Q29. Do government entities need a SOC?

Yes. Six-hour reporting, 180-day log retention and the threat of ransomware and espionage all require round-the-clock monitoring of servers, portals, email, cloud and vendor access. Smaller entities can use a managed SOC rather than build one.

Q30. What should the SOC monitor?

Remote-access and VPN sign-ins, privileged and vendor activity, endpoint alerts, lateral movement, mass file changes, web shells and defacement, DDoS indicators, email compromise, cloud configuration changes, scraping of citizen APIs and CERT-In advisories relevant to the estate.

Q31. What should we do in the first hours of ransomware?

Isolate affected systems without switching them off, protect backups, preserve logs and evidence, activate the crisis team, report to CERT-In within six hours, move critical services to manual procedures, communicate clearly with the public and engage forensics before restoring.

Q32. When should forensics be engaged?

As soon as ransomware, espionage, data exposure, defacement or insider misuse is suspected, or CERT-In or NCIIPC sends an alert, to establish what happened and what data was affected, preserve evidence for investigators and support reporting.

Audience: Procurement, HR, training and communication teams

Q33. How should we assess system integrators and AMC vendors?

Tier them by the access and data they hold, require MFA and logged, time-bound privileged access, review their security practices and certifications, audit them against contract clauses, and remove access promptly when contracts end or staff change.

Q34. What security clauses belong in government IT contracts?

Compliance with CERT-In's guidelines and Directions, incident reporting to the department within hours, logging and log access, security audits before hosting and after change, data localisation and deletion, background checks, right to audit and penalties for breaches.

Q35. How should officials be trained?

Short, regular awareness on phishing, passwords and handling of official information, realistic spear-phishing simulations using circular and meeting-notice lures, special briefings for senior officials and their offices, and refresher training after transfers and promotions.

Q36. What about staff transfers and retirements?

Transfers and retirements are frequent in government and leave accounts active. Link identity management to HR orders, remove or change access on the day of transfer, review shared and generic accounts and audit privileged access quarterly.

Q37. Should we run cyber crisis exercises?

Yes. Annual tabletop exercises with senior officials, the CISO, IT, data centre, communication and legal teams using ransomware, data-exposure, defacement and vendor scenarios test decisions on manual operations, public messaging and reporting before a real incident.

Q38. How do we handle public communication during an incident?

Agree spokespeople and holding statements in advance, tell citizens which services are affected and what alternatives exist, avoid speculation about attribution, coordinate with CERT-In and investigators, and publish updates on official channels to counter rumours and fake notices.

Q39. How do we stop fake portals and apps using our name?

Monitor domains, app stores and social media for impersonation, publish official links prominently, use government domains for all services, request takedowns promptly and warn citizens through official channels when fakes appear.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your departments, platforms, data centres, vendors and audit obligations, or place a work order through your usual procurement route; Codec Networks will propose a CERT-In-aligned audit, monitoring and readiness plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Confirm obligations against the official instruments applicable to your organisation, your ministry or state orders, any NCIIPC notification and your tender and contract terms.