Resources Categories
INDUSTRY FACT FILE · GOVERNMENT, PSUS & PUBLIC DIGITAL SERVICES
Main Products and Services in Government and Public Digital Services
What India's ministries, state governments, PSUs, data centres and government technology providers deliver, the systems behind each service, and where those systems create cybersecurity and compliance exposure.
|
In this document 1. How public organisations deliver value and raise revenue 2. Products and services by entity type 3. The citizen layer: portals, apps, identity and documents 4. The operations layer: data centres, PSU plants, e-Office and vendors 5. The systems behind the products and services 6. Trends that change the attack surface 7. Mapping operations to Codec Networks engagements |
1. How public organisations deliver value and raise revenue
|
Revenue stream |
How it works |
Security relevance |
|
Citizen services and fees |
Certificates, licences, permits, registrations and taxes delivered online |
Portals, payment gateways, citizen data and document links |
|
Benefit and subsidy delivery |
Scheme enrolment, verification and direct benefit transfers |
Beneficiary databases, bank integrations, Aadhaar-linked flows |
|
PSU products and services |
Power, fuels, engineering, telecom, transport and financial services sold by PSUs |
ERP, billing, plant OT, customer portals and dealer systems |
|
Public procurement |
Purchase of goods and services through GeM and e-tenders |
Bid data, vendor identities, payment and approval workflows |
|
Government technology contracts |
Building, hosting and running portals, apps and data centres for departments |
Code, credentials, hosting access and shared libraries |
|
Internal administration |
Files, approvals, payroll, HR and finance across government offices |
e-Office, email, HRMS and finance systems holding official records |
2. Products and services by entity type
|
Entity type |
Main products and services |
Key systems |
|
Central ministries and departments |
Policy, schemes, approvals, grants, grievance redress and public information |
Scheme portals, e-Office, email, dashboards, payment and grant systems |
|
State governments |
Land records, treasury, police, health, transport, education and municipal services |
State portals, hospital information systems, treasury and police systems, mobile apps |
|
Central PSUs |
Energy, engineering, telecom, transport, finance and manufacturing products |
ERP, procurement portals, plant OT and SCADA, customer and vendor portals |
|
State PSUs and utilities |
Power distribution, water, transport, industrial land and state finance |
Billing, metering, ERP, SCADA, consumer apps |
|
State data centres and clouds |
Hosting, network connectivity, email and shared services for departments |
Virtualisation, firewalls, SWAN, backup, cloud consoles |
|
Government technology providers |
Application development, integration, hosting and support under contract |
Code repositories, CI/CD, deployment servers, remote support tools |
|
Citizen digital platforms |
Identity, documents, payments, procurement and unified service apps |
APIs, mobile apps, consent and authentication services, partner integrations |
3. The citizen layer: portals, apps, identity and documents
The citizen layer of government is now mostly digital. A resident applies for a certificate on a state portal, pays a fee through a payment gateway, receives the document in DigiLocker, tracks a benefit in a scheme app and files a grievance through a central system; a business bids on GeM, files returns and receives approvals online. Each step joins a front end, an API, a database and often several other government platforms, and many of them handle Aadhaar-linked identifiers, bank details, health data, addresses and family information. A single flaw in how a portal checks who may see which record can expose millions of people, and a scraped database becomes the raw material for targeted fraud calls in the government's name.
These services are built by many hands. NIC, state IT agencies, PSU IT teams and system integrators all write and host code, often on shared frameworks and libraries, and projects are launched against political and administrative deadlines. GIGW 3.0 sets quality, accessibility and cybersecurity requirements for websites and apps, and a security audit before hosting is a common requirement for government portals. But audits are often treated as a one-time gate: change requests, new modules, mobile apps and partner APIs go live later without retesting, and old sites linger long after a scheme ends, unpatched and unowned.
4. The operations layer: data centres, PSU plants, e-Office and vendors
The operations layer runs on data centres, networks and administrative systems. State data centres and NIC facilities host thousands of applications on shared infrastructure; state wide area networks connect district and block offices; e-Office, government email and finance systems hold official files, approvals and payments; and hospitals, police and municipal bodies run their own servers. The AIIMS New Delhi incident of 2022 showed what happens when servers sit on a poorly segmented network: five servers were encrypted and a national hospital fell back on manual processes while systems were rebuilt. Backups, segmentation and monitoring are the difference between a contained incident and a public outage.
Public-sector undertakings add plant and commercial systems. Power stations, refineries, factories, mines and telecom networks run OT and SCADA environments, while ERP, procurement, billing and dealer portals run the business. Ransomware at Oil India's headquarters in 2022 and at Madhya Pradesh's power management company in 2023 hit IT systems, not production, but showed how close attackers come. Behind both layers stand vendors: integrators with administrative access, AMC engineers with remote tools, and cloud and managed service providers, all of whom must be held to the CERT-In guidelines' controls for third-party access and outsourcing.
|
Highest-risk moments Launch of a new scheme portal or app against a deadline, examination, admission and benefit-payment windows, elections and national events that attract hacktivists, migrations to new data centres or clouds, change of system integrator or AMC vendor, staff transfers that leave accounts active, year-end procurement and payment rushes, and the months after a scheme ends when its website is forgotten are where public-sector incidents typically begin or escalate. |
5. The systems behind the products and services
Figure 2: Where cyber risk sits across the public digital service lifecycle.
|
Product / service |
Systems that deliver it |
Key cyber and compliance touchpoints |
|
Plan and procure |
Tender documents, GeM bids, project reports, vendor onboarding |
Security clauses, empanelled auditor requirements, bid confidentiality |
|
Build and test |
Code repositories, test servers, staging data, CI/CD |
Secure SDLC, code review, test data masking, pre-hosting audit |
|
Host and operate |
Data centres, government clouds, SWAN, admin consoles |
Segmentation, hardening, privileged access, backups, logging |
|
Serve citizens |
Portals, apps, APIs, payment and document integrations |
Authorisation testing, rate limiting, DDoS protection, DPDP |
|
Run government |
e-Office, email, ERP, HRMS, file servers |
Phishing defence, MFA, insider monitoring, CERT-In reporting |
|
Change and retire |
Upgrades, migrations, legacy and orphan websites |
Retesting after change, decommissioning, data retention and deletion |
6. Trends that change the attack surface
|
Trend |
What is changing |
Security implication |
|
Cloud-first government |
Departments move to MeitY-empanelled clouds and shared platforms |
Tenant configuration and identity decide security |
|
Digital public infrastructure |
Identity, documents and payments reused by many services |
API security and consent controls become critical |
|
Audit cycles in the guidelines |
Six-monthly internal and yearly third-party audits expected |
Recurring, evidence-based audit programmes |
|
Mobile-first citizen services |
Apps and messaging channels replace counters |
App security, fake apps and impersonation |
|
Converging IT and OT in PSUs |
Plant data connected to ERP, analytics and remote support |
Segmentation and OT monitoring become essential |
|
Privacy for State processing |
DPDP standards for the State from May 2027 |
Data maps, safeguards and breach workflows needed |
7. Mapping operations to Codec Networks engagements
|
If the organisation operates… |
Recommended starting engagement |
|
Citizen portals, mobile apps or APIs |
Security audit before hosting, authorisation and API testing, retests after every major change |
|
Servers in a state data centre, NIC facility or own server room |
Infrastructure VAPT, segmentation review, backup and recovery testing, 24x7 SOC |
|
Workloads on MeitY-empanelled clouds |
Cloud configuration review, identity hardening, logging and monitoring |
|
Plant, SCADA or OT networks in a PSU |
OT assessment, IT–OT segmentation, remote-access review, IEC 62443 gap analysis |
|
Citizen, beneficiary or employee personal data |
DPDP gap assessment, data mapping, vendor contract review and breach workflows |
|
Obligations under CERT-In's government guidelines |
CISO support, six-monthly and annual audit programme, closure tracking and reporting |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: Descriptions are general and based on public information available as of October 2026. Systems and exposures differ by ministry, state, PSU and platform.