Resources Categories
INDUSTRY FACT FILE · GOVERNMENT, PSUS & PUBLIC DIGITAL SERVICES
Industry Overview: Government, PSUs and Public Digital Services in India
Who runs India's public institutions and digital services, the cyber obligations that apply, who buys cybersecurity in government and why each type of entity needs its own approach.
|
In this document 1. Why public-sector cybersecurity matters now 2. The ecosystem at a glance 3. Categories of government and public-sector organisations 4. The cyber, audit and privacy framework at a glance 5. Policy, oversight, platform and delivery participants 6. Who buys cybersecurity inside a government organisation or PSU 7. Why each type of public entity needs a different approach 8. How Codec Networks works with government departments and PSUs |
|
Sector scope Sector: ministries and departments, state governments, central and state PSUs, state data centres, government technology providers and citizen digital platforms. Primary service proposition: security audits, citizen platform VAPT, SOC, privacy and incident readiness. Defence, power and smart cities have separate fact files. |
1. Why public-sector cybersecurity matters now
Government is the largest operator of digital services in India. Central ministries and their attached and subordinate offices run schemes, payments and approvals; state governments run land records, treasuries, police, health, transport and municipal services; central and state public-sector undertakings run power stations, refineries, factories, telecom networks, railways-linked services and financial institutions; and a layer of national platforms connects them to citizens. DigiLocker had more than 30 crore users and had issued about 675 crore e-documents by mid-2024, according to a reply in Parliament; UMANG brings thousands of central and state services into one app; and the Government e-Marketplace recorded a gross merchandise value of about ₹5.4 lakh crore in 2024-25. Behind these sit NIC and state data centres, MeitY-empanelled government clouds, state wide area networks and thousands of portals built by in-house teams and system integrators.
|
29.44 lakh Cyber incidents handled by CERT-In in 2025 |
1.3 TB Data encrypted in the AIIMS New Delhi attack (2022) |
30 crore+ DigiLocker users by mid-2024 (Parliament reply) |
6 hours To report cyber incidents to CERT-In |
That scale makes the public sector one of the most attacked parts of the economy. CERT-In reported handling more than 29.44 lakh cyber incidents in 2025, up from about 20.41 lakh in 2024, across all sectors. Government entities face every kind of adversary at once: ransomware groups that know a hospital or a municipal portal cannot stay offline, state-linked actors seeking policy, defence and infrastructure information, hacktivists who deface websites and launch denial-of-service attacks during periods of tension, fraudsters who impersonate departments and scrape citizen data, and insiders with privileged access to records that affect millions of people. Many organisations still run legacy applications, flat networks and websites that nobody owns, while procurement cycles and staff rotation make security programmes hard to sustain.
The public record is clear. On 23 November 2022 ransomware hit AIIMS New Delhi; the government told the Rajya Sabha that five physical servers hosting the NIC e-Hospital application were affected and about 1.3 TB of data was encrypted, that the breach was attributed to improper network segmentation, and that e-Hospital data was later restored from an unaffected backup server. In October 2019 the Nuclear Power Corporation of India confirmed malware on an internet-connected computer used for administrative purposes at the Kudankulam plant, after CERT-In had alerted the Department of Atomic Energy in September; the corporation said the administrative network was isolated from the plant's critical internal network. Oil India reported a ransomware attack at its Duliajan headquarters in April 2022 with a reported ransom demand of about US$7.5 million, while production continued. Madhya Pradesh's power management company reported ransomware on an internal IT system in May 2023, and in December 2023 a cyberattack corrupted data on the state's e-Nagarpalika portal serving 413 towns, forcing civic bodies to work offline until it was restored from backups.
The obligations are explicit. CERT-In's Directions of April 2022 apply to government organisations as well as companies: cyber incidents must be reported within six hours and ICT logs kept for 180 days in India. CERT-In's Guidelines on Information Security Practices for Government Entities of June 2023 apply to ministries, departments, their attached and subordinate offices, government institutions and public-sector enterprises; they call for a nominated CISO with a security team separate from IT operations, internal audits at least once every six months and third-party audits at least once a year, for which CERT-In empanelled auditors may be used. Its 2025 audit policy guidelines expect risk-based independent audits, including operational technology. NCIIPC protects notified critical information infrastructure under Sections 70 and 70A of the IT Act; GIGW 3.0 sets quality, accessibility and cybersecurity requirements for government websites and apps; and the DPDP Act and Rules set standards for processing by the State and its instrumentalities, with most obligations, including security safeguards and breach intimation, applying from May 2027.
|
Key takeaway In government, a cyber incident is a failure of public service and public trust. Audits on a fixed cycle, tested citizen platforms, segmented and monitored data centres, accountable vendors and rehearsed response are now baseline expectations, set out in CERT-In's own guidelines for government entities. |
2. The ecosystem at a glance
Figure 1: India's government, PSU and public digital services ecosystem.
3. Categories of government and public-sector organisations
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Central ministries and departments |
Ministries, departments and secretariats that run policy, schemes, approvals and payments |
Government of India |
CERT-In Directions and 2023 government guidelines; IT Act; DPDP; GIGW 3.0 |
|
Attached offices and autonomous bodies |
Directorates, commissions, regulators, institutes, hospitals and research bodies under ministries |
Government of India, statutory and autonomous bodies |
CERT-In government guidelines; ministry instructions; DPDP; GIGW 3.0 |
|
State governments and departments |
Revenue, treasury, police, health, education, transport, municipal and welfare departments |
State governments and union territories |
CERT-In Directions and guidelines; state IT policies; DPDP; GIGW 3.0 |
|
Central public-sector enterprises |
Energy, engineering, telecom, transport, finance and manufacturing undertakings |
Government of India, often listed |
CERT-In; NCIIPC where notified; DPE guidelines; SEBI LODR if listed; DPDP |
|
State PSUs and utilities |
Power, water, transport, industrial development and financial corporations |
State governments |
CERT-In; NCIIPC where notified; sector regulators; DPDP |
|
State data centres and government clouds |
NIC and state data centres, state wide area networks and MeitY-empanelled cloud services |
Government agencies and empanelled providers |
CERT-In; MeitY cloud empanelment with STQC audit; NCIIPC where notified |
|
Government technology providers and integrators |
System integrators, developers, managed service and AMC providers building and running public systems |
Private companies and government technology agencies |
Contract and tender security clauses; CERT-In; DPDP as processor |
|
Citizen digital platforms |
Identity, document, payment, benefit, procurement and service-delivery platforms used nationwide |
Government agencies and public-sector companies |
CERT-In; IT Act; DPDP; GIGW 3.0; NCIIPC where notified |
4. The cyber, audit and privacy framework at a glance
|
Instrument or expectation |
What it means for government entities and PSUs |
|
CERT-In Directions (28 April 2022) |
Apply to government organisations as well as service providers and body corporates: cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India; clock synchronisation; a designated point of contact |
|
CERT-In Guidelines on Information Security Practices for Government Entities (30 June 2023) |
Issued under Section 70B of the IT Act for ministries, departments, attached and subordinate offices, government institutions and public-sector enterprises; a nominated CISO with a security team separate from IT operations; internal audits at least every six months and third-party audits at least yearly, for which CERT-In empanelled auditors may be used; controls for network, identity, applications, data, cloud and third parties |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent and comprehensive cyber audits covering infrastructure, applications, cloud and operational technology, with closure of findings |
|
IT Act Sections 70 and 70A; NCIIPC |
Systems notified as protected systems receive NCIIPC guidance and controls; unauthorised access to a protected system is a serious offence; government, strategic and public enterprises are among the critical sectors |
|
GIGW 3.0 (2023) |
Guidelines for Indian Government Websites and Apps, developed with STQC and CERT-In, covering quality, accessibility to WCAG 2.1 Level AA, lifecycle management and a cybersecurity chapter; compliance assessed by STQC-empanelled labs |
|
DPDP Act 2023 and DPDP Rules 2025 |
Personal data processed by the State for subsidies, benefits, services, certificates and licences is a legitimate use under Section 7(b), subject to standards in the Rules; notified instrumentalities may be exempted under Section 17(2); reasonable security safeguards and breach intimation; most obligations from May 2027 |
|
MeitY cloud empanelment |
Government workloads hosted on cloud services empanelled by MeitY after STQC audit, with data hosted in India |
|
National Cyber Security Policy 2013 |
Policy framework calling for protection of critical information infrastructure, a 24x7 NCIIPC, security audits and capacity building |
|
ISO/IEC 27001 |
The management-system standard most often named in government and PSU tenders and in data centre and cloud contracts |
|
How these apply CERT-In's Directions and 2023 guidelines apply to government entities directly; NCIIPC duties apply to notified protected systems; GIGW applies to government websites and apps; DPDP applies with State-specific standards and possible exemptions. Confirm against the official instruments, your ministry or state orders and your contracts. |
5. Policy, oversight, platform and delivery participants
- MeitY and CERT-In set national cyber policy, issue Directions and guidelines, handle incidents and empanel information security auditing organisations; CERT-In reported 231 empanelled audit organisations in 2025.
- NCIIPC protects notified critical information infrastructure; NIC builds and hosts a large share of central and state applications, email and data-centre services; NICSI procures IT services, including security audits from CERT-In empanelled agencies, for NIC-supported projects.
- NeGD and STQC run national platforms and capacity-building such as Cyber Surakshit Bharat, test and certify software, websites and clouds, and audit cloud providers for MeitY empanelment.
- The Comptroller and Auditor General audits government and PSU accounts and IT systems; the Central Vigilance Commission oversees integrity in procurement; Parliament and state legislatures question ministers on incidents.
- Ministries, state governments, PSUs and their data centres own the systems and the obligations; state IT departments and agencies run state data centres, wide area networks and portals.
- System integrators, developers, cloud and managed service providers build and operate much of the public estate under contracts that increasingly carry security, audit and reporting clauses.
6. Who buys cybersecurity inside a government organisation or PSU
|
Stakeholder |
What they care about |
What they buy |
|
Secretary, CMD and Board |
Service continuity, public trust, audit observations, Parliament questions |
Cyber crisis plans, Board briefings, maturity assessments |
|
CISO and IT head |
CERT-In compliance, audits, monitoring, incident reporting |
Security audits, VAPT, SOC, incident response retainers |
|
Project and scheme directors |
Secure launch and operation of portals and apps |
Pre-hosting audits, application and API testing |
|
State data centre and cloud teams |
Hosting security, segmentation, backups, tenant isolation |
Infrastructure and cloud reviews, SOC, recovery testing |
|
Procurement and finance |
Tender compliance, empanelled auditors, value for money |
GeM and tender-based audit and SOC contracts |
|
Plant and operations heads in PSUs |
Safety and continuity of OT, SCADA and plant networks |
OT assessments, segmentation reviews, IEC 62443 gap analysis |
|
Nodal officers for data protection |
DPDP duties for citizen, beneficiary and employee data |
DPDP gap assessments, data mapping, vendor contract reviews |
7. Why each type of public entity needs a different approach
|
Entity type |
Highest-consequence risk |
Starting point for assurance |
|
Ministries and departments |
Espionage through phishing of officials; defacement of public websites |
CISO-led audit programme, email security, SOC, awareness |
|
State governments |
Ransomware on citizen-service and hospital systems; data scraping |
Segmentation, backups, portal and API testing, SOC |
|
Central PSUs |
Espionage, tender and payment fraud, OT intrusion |
Comprehensive and OT audits, threat hunting, vendor controls |
|
State PSUs and utilities |
Ransomware on billing and ERP; legacy plant networks |
Infrastructure VAPT, OT segmentation, recovery testing |
|
State data centres and clouds |
One flaw exposing many departments; orphan websites |
Asset inventory, patching, tenant isolation, 24x7 monitoring |
|
GovTech providers and platforms |
Supply chain compromise of code, credentials and hosting |
Secure SDLC, vendor audits, privileged access, SOC |
8. How Codec Networks works with government departments and PSUs
Codec Networks is a CERT-In empanelled information security auditing organisation, empanelled with NICSI for application audit and compliance services (start-up category), and certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. It serves central ministries, state governments and public-sector undertakings. For government entities, PSUs and public digital services we deliver audits against CERT-In's guidelines for government entities and its 2025 audit policy, comprehensive infrastructure and OT audits, security audits of portals, mobile apps and APIs before hosting and after change, MeitY cloud and state data centre reviews, DPDP programmes for citizen, beneficiary and employee data, ISO 27001 and cyber crisis management plans, 24x7 managed SOC with defacement, DDoS and threat-hunting coverage, ransomware response and forensics with six-hour reporting support, and tabletop exercises and phishing simulation for officials—each connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal or regulatory advice. Obligations differ by type of entity, ministry or state instructions, any NCIIPC notification, tender and contract terms and the data each organisation handles; confirm them against the official CERT-In, MeitY, NCIIPC, NeGD, STQC and Data Protection Board instruments and your own orders and agreements.