INDUSTRY FACT FILE · TELECOMMUNICATIONS & CONNECTIVITY

Cybersecurity FAQs for Telecom and Connectivity Providers

Forty frequently asked questions and answers in five categories, written for Boards, CTSOs, CISOs, network, IT, fraud and regulatory teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Telecom rules, audit and compliance 3.  Category 3: Network, 5G core and subscriber security 4.  Category 4: SOC, incident response and resilience 5.  Category 5: Vendors, privacy and emerging technology

Audience: Boards, CEOs, CTSOs and CISOs

Q1. Why is telecom cybersecurity critical?

Telecom networks carry banking OTPs, emergency calls and government services; compromises affect national security and millions of users.

Q2. What are the biggest risks?

Nation-state intrusion, signalling and core attacks, SIM-swap fraud, subscriber data theft, DDoS, ransomware on IT and vendor access abuse.

Q3. Which incidents illustrate the risk?

US authorities reported state-backed intrusions into major US carriers in 2024, and a large South Korean operator disclosed a subscriber SIM data breach in 2025.

Q4. Who is the Chief Telecommunication Security Officer?

A role telecom entities must appoint under the Telecom Cyber Security Rules, 2024, with details provided to the Government.

Q5. What should the Board review?

Compliance with the rules, incidents and reports, threat hunting results, core and network findings, vendor risks and SOC performance.

Q6. How should telecom security be organised?

Under the CTSO and CISO with clear ownership across network, IT, fraud and vendor management.

Q7. How should we prioritise investment?

Close gaps against the rules, harden network devices and cores, control vendor access and build telecom-aware monitoring.

Q8. How can Codec Networks help?

Codec Networks provides Telecom Cyber Security Rules assessments, network and 5G core security reviews, IAM and vendor access reviews, managed SOC and incident response.

Audience: Regulatory affairs, compliance and CTSO offices

Q9. When were the Telecom Cyber Security Rules notified?

On 21 November 2024 by the Department of Telecommunications under the Telecommunications Act, 2023.

Q10. What do the rules require?

A cyber security policy, a Chief Telecommunication Security Officer, facilities to monitor and address incidents, and incident reporting within six hours with details within 24 hours.

Q11. What details must follow within 24 hours?

Information such as the number of users affected, duration, geographical area and remedial measures taken.

Q12. What are the CTI Rules?

The Critical Telecommunication Infrastructure Rules, 2024 set additional obligations for networks notified as critical telecommunication infrastructure.

Q13. What is the trusted-source directive?

The National Security Directive on Telecom Sector requires providers to connect only trusted products from trusted sources, in force since 15 June 2021.

Q14. What is MTCTE?

Mandatory Testing and Certification of Telecom Equipment, including security testing against ITSAR by NCCS.

Q15. Do CERT-In Directions also apply?

Yes. Cyber incidents must also be reported to CERT-In within six hours, and ICT logs kept for 180 days in India.

Q16. Can Codec Networks assess our compliance?

Yes. Codec Networks is CERT-In empanelled and performs gap assessments, audits and testing mapped to the rules.

Audience: CTO, network engineering and fraud teams

Q17. How should routers and edge devices be secured?

Patch promptly, harden configurations, restrict management access, monitor configuration changes and hunt for persistence.

Q18. How do we secure a cloud-native 5G core?

Mutually authenticate and authorise network function APIs, harden Kubernetes, segment management and monitor core telemetry.

Q19. What about signalling security?

Filter and monitor SS7, Diameter and 5G signalling for abuse such as location tracking and interception attempts.

Q20. How do we prevent SIM-swap fraud?

Strong identity verification, dealer accountability and monitoring, cooling periods and SIM-change signals to banks.

Q21. How should BGP and DNS be protected?

Use route filtering and validation, monitor for hijacks and secure DNS infrastructure.

Q22. How do we defend against DDoS?

Combine upstream scrubbing, capacity planning, rate limiting and regular testing.

Q23. How should OSS/BSS be protected?

Segment from network management, test regularly, protect privileged access and maintain immutable backups.

Q24. How do we secure enterprise managed services?

Isolate customers in orchestration platforms, protect admin access and monitor for customer-impacting events.

Audience: SOC, NOC and incident response teams

Q25. What makes a telecom SOC different?

It ingests network, core and signalling telemetry alongside IT logs and hunts for stealthy, persistent adversaries.

Q26. What should incident playbooks include?

Containment, evidence preservation, reporting to DoT within six hours with details within 24 hours, CERT-In reporting and customer communication.

Q27. How should SOC and NOC work together?

Share telemetry and escalation paths so outages and attacks are distinguished quickly.

Q28. How long must logs be retained?

CERT-In requires ICT logs for a rolling 180 days within India; licence conditions may require more.

Q29. How should we prepare for ransomware?

Segment IT from network domains, protect backups of OSS/BSS and rehearse recovery.

Q30. Should we run red team exercises?

Yes—especially scenarios targeting network management, vendor access and the 5G core.

Q31. How often should DR be tested?

At least annually for core and critical IT, and after major changes.

Q32. When should forensics be engaged?

As soon as intrusion into network infrastructure or large-scale fraud is suspected.

Audience: Vendor management, privacy and innovation teams

Q33. How should vendor access be controlled?

Broker it through monitored, time-bound sessions with named accounts, MFA and recording.

Q34. How should vendors be assessed?

Review product security, update integrity, trusted-source status and support practices.

Q35. How does DPDP affect telecom providers?

Subscriber personal data requires safeguards and breach intimation; most DPDP obligations take effect in May 2027.

Q36. What subscriber data needs special care?

KYC records, call detail records, location data and SIM credentials.

Q37. What about private 5G networks?

Treat them like OT networks: segment, control access and monitor, especially in industrial settings.

Q38. What are the risks of Open RAN?

More multi-vendor interfaces and integration points that must be tested and monitored.

Q39. How is AI changing telecom security?

AI helps detect fraud and anomalies but introduces model and data risks that need governance.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your licence, network and vendors; Codec Networks will propose a gap assessment and testing plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Confirm obligations against the official DoT gazette notifications, licence conditions and CERT-In instruments.