INDUSTRY FACT FILE · SPACE, SATELLITE & GEOSPATIAL SERVICES

Industry Overview: Space, Satellite and Geospatial Services in India

Who builds, launches, operates and sells India's space and geospatial services, the rules that apply, who buys cybersecurity in the sector and why each segment needs its own approach.

India has opened its space sector to private enterprise in a few short years. Reforms announced in 2020 created the Indian National Space Promotion and Authorisation Centre (IN-SPACe) as a single-window body to promote, guide and authorise non-government space activities. The Indian Space Policy 2023, approved by the Cabinet Committee on Security on 6 April 2023, set out the division of labour: ISRO concentrates on research and new technology and steps back from making operational systems, NewSpace India Limited (NSIL) commercialises technologies and platforms built with public money, IN-SPACe authorises activities, and private entities may participate across the value chain, from building and operating satellites and launch vehicles to establishing ground stations and selling satellite-based services. IN-SPACe released its Norms, Guidelines and Procedures for authorising space activities in May 2024, covering the operation of space objects, launch and the establishment of ground systems, and from 1 April 2025 only IN-SPACe-authorised foreign satellites and constellations may provide capacity in India. In February 2024 the Union Cabinet liberalised foreign direct investment: up to 74% through the automatic route for satellite manufacturing and operation, satellite data products and ground and user segments, up to 49% for launch vehicles and spaceports, and up to 100% for satellite components and subsystems, with higher stakes possible through the government route.

The market is growing on the back of these reforms. IN-SPACe's Decadal Vision targets growth of the Indian space economy from about US$8.4 billion in 2022 to US$44 billion by 2033, including US$11 billion of exports, and in October 2024 the Union Cabinet approved a ₹1,000 crore venture capital fund for the sector under IN-SPACe. In a reply to Parliament in August 2026 the government reported about 440 space technology start-ups registered on the DPIIT Start-up India portal and 113 IN-SPACe authorisations granted to 52 non-government entities, 18 of them start-ups. Satellite communication is changing fastest: the Department of Telecommunications has issued satellite service permits to several operators, including low-earth-orbit broadband providers that also hold IN-SPACe authorisations, and reports in 2025 described additional national security conditions for satcom licensees covering lawful interception, monitoring and in-country data facilities. Earth observation and geospatial services have been liberalised too: the Department of Science and Technology's Geospatial Data Guidelines of 15 February 2021 removed the need for prior approval, security clearance or licences for most acquisition and publication of geospatial data and maps, replacing them with a list of sensitive attributes that may not be shown, and the National Geospatial Policy 2022 builds on them. NavIC, India's regional navigation satellite system, underpins location services alongside other GNSS constellations.

Every space service depends on systems on the ground. Satellites are commanded from mission control centres through telemetry, tracking and command (TT&C) links; ground stations and teleports run antennas, modems, baseband equipment and scheduling software, increasingly shared between operators or offered as ground-station-as-a-service; satcom providers run hubs, gateways, network management systems and fleets of user terminals that receive software updates; and earth observation, geospatial and location businesses deliver their products through cloud platforms and APIs. The most consequential cyber attack on a satellite service to date proved the point. On 24 February 2022, about an hour before Russia's invasion of Ukraine, attackers abused the management network of Viasat's KA-SAT service to push the AcidRain wiper to consumer modems; Viasat said tens of thousands of terminals were rendered inoperable and shipped nearly 30,000 replacements, and in Germany Enercon reported that about 5,800 wind turbines lost remote monitoring and control. The EU, the UK and the US attributed the attack to Russia in May 2022, and CISA and the FBI issued an advisory urging satcom providers and customers to use multi-factor authentication, least privilege, independent link encryption and monitoring. The satellites were never touched: the ground segment was the target.

Indian operators are firmly in the frame. ISRO's then chairman S. Somanath said in October 2023 that the agency faces more than 100 cyber attacks every day. Satellite navigation is under pressure as well: DGCA issued an advisory circular on GNSS interference in November 2023, and in December 2025 the government confirmed GPS spoofing reports near Delhi's airport and interference reports from several other major airports, a reminder that location services must be designed to cope with degraded or false signals. Cyber obligations apply across the sector. CERT-In's Directions require incidents to be reported within six hours and ICT logs to be kept for 180 days, and its July 2025 audit guidelines cover risk-based audits including OT; telecom entities, including satcom licensees, fall under the Telecommunications (Telecom Cyber Security) Rules 2024; the DPDP Act applies to personal and location data; and operators serving telecom, power, transport, BFSI or government customers may find that parts of their service touch systems notified as protected under Section 70 of the IT Act. Abroad, the European Commission proposed an EU Space Act in June 2025 with cybersecurity rules that reach ground as well as in-orbit infrastructure, which Indian firms serving European customers should track as it moves through the legislative process.

Figure 1: India's space, satellite and geospatial services ecosystem.

• The Department of Space frames space policy and IN-SPACe promotes, guides and authorises non-government space activities, while ISRO focuses on research and missions and NSIL commercialises space technologies and capacity.
• The Department of Telecommunications licenses satellite communication services and sets their security conditions, TRAI recommends terms such as spectrum pricing, and the Wireless Planning and Coordination Wing manages frequency matters.
• The Department of Science and Technology issues the geospatial guidelines and policy, and the Survey of India maintains national mapping and reference frameworks.
• CERT-In receives incident reports and issues advisories and audit guidelines; NCIIPC protects notified critical information infrastructure; MeitY frames IT and data policy, and the Data Protection Board enforces the DPDP Act.
• Satellite makers, component suppliers, launch start-ups, satellite operators, ground station and teleport operators, satcom providers and geospatial and location firms design, launch and run the services; government, telecom, BFSI, energy, agriculture, logistics and maritime users depend on them.
• Cloud providers, antenna and modem vendors, integrators, analytics and mapping vendors and international partners sit inside almost every service, and their weaknesses become the operator's incidents.

Codec Networks is a CERT-In empanelled information security auditing organisation, empanelled with NICSI for application audit and compliance services (start-up category), and certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For space, satellite and geospatial businesses we deliver ground station and teleport security assessments covering antenna control, baseband and modem networks, scheduling systems and segmentation; mission control and TT&C reviews focused on who can command a satellite and how command keys are held; satcom network assessments of hubs, gateways, network management systems, management VPNs and terminal update processes; VAPT of earth observation tasking and delivery APIs, geospatial and location platforms and cloud ground segment deployments, including tenant isolation testing; identity and privileged access reviews for operators, engineers and vendors; supply chain assurance for component and software suppliers, integrators and support vendors, including SBOM and software integrity reviews; OT assessments of launch ranges and test facilities; CERT-In empanelled audits; ISO 27001 readiness and support for telecom security obligations; DPDP programmes for location and customer data; 24x7 managed SOC for ground networks, NMS, cloud and APIs; and incident response and forensics for ground segment, terminal and data incidents. Radio frequency and link testing is performed only with authorisation, in controlled environments, coordinated with the customer and any required licences and permissions. Each proposal confirms auditor eligibility and independence against CERT-In's and the client's requirements. Codec Networks does not provide space authorisation, spectrum, licensing or export control advice.

Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, regulatory, licensing, export control or national security advice. Obligations differ by activity (manufacturing, launch, satellite operation, ground systems, satellite communication services, earth observation, geospatial data or navigation and location services), by the IN-SPACe authorisations, telecom licences and permissions held, by the customers and countries served, listing status, contracts and the data each organisation handles; confirm them against the official Department of Space, IN-SPACe, Department of Telecommunications, TRAI, Department of Science and Technology, CERT-In, NCIIPC, MeitY and Data Protection Board instruments, any space activities law if enacted, and your agreements. Radio frequency and link testing is described only as authorised testing in controlled environments, coordinated with the customer and any required licences and permissions. Incident references are summarised from official statements and widely reported events.