Resources Categories
INDUSTRY FACT FILE · TELECOMMUNICATIONS & CONNECTIVITY
Industry Overview: Telecommunications and Connectivity in India
Who runs the networks the country depends on, how they are regulated, who buys cybersecurity inside them and why each needs a distinct approach.
|
In this document 1. Why telecom cybersecurity matters now 2. The ecosystem at a glance 3. Categories of telecom and connectivity players 4. The regulatory framework at a glance 5. Government, public-sector and private participants 6. Who buys cybersecurity inside a telecom provider 7. Why each player type needs a different approach 8. How Codec Networks works with telecom providers |
|
Sector scope Sector: telecommunications and connectivity — telecom operators, ISPs, enterprise connectivity providers and infrastructure and network vendors. Primary service proposition: network/5G security, cloud-native core assessment, IAM, SOC and telecom cyber compliance. Cloud and data centre providers are covered in a separate fact file. |
1. Why telecom cybersecurity matters now
India has one of the world's largest telecom markets, with rapid 5G roll-out, expanding fibre and growing enterprise and IoT connectivity. Telecom networks carry banking OTPs, emergency calls, payment traffic and government services—so their security protects everything that runs over them.
|
21 Nov 2024 Telecom Cyber Security Rules notified |
6 hours To report security incidents to the Central Government |
24 hours To furnish incident details such as users affected |
Jun 2021 Trusted sources and products directive in force |
Telecom networks are prime targets for nation-state espionage and criminal fraud. In 2024, US authorities reported that a state-backed group had compromised several major US telecom carriers; in 2025, a large South Korean mobile operator disclosed a breach of subscriber SIM data. SIM-swap fraud, smishing and DDoS remain persistent everyday threats.
The Telecommunications Act, 2023 and the Telecommunications (Telecom Cyber Security) Rules, 2024, notified on 21 November 2024, now require telecom entities to adopt a cyber security policy, appoint a Chief Telecommunication Security Officer and report security incidents within six hours.
|
Key takeaway For a telecom provider, cybersecurity is a licence and national-security obligation as well as a business one. Network, core and subscriber-facing controls must be evidenced under the new rules. |
2. The ecosystem at a glance
Figure 1: India's telecommunications and connectivity ecosystem.
3. Categories of telecom and connectivity players
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Mobile network operators |
4G and 5G mobile voice, data and messaging |
Private operators and public-sector operators |
Telecommunications Act 2023; Telecom Cyber Security Rules 2024; licence conditions |
|
Fixed-line and broadband ISPs |
Fibre, cable and wireless broadband |
National and regional ISPs |
Telecommunications Act; ISP authorisation; Cyber Security Rules |
|
Enterprise connectivity providers |
MPLS, SD-WAN, leased lines, managed networks |
Operators and managed service providers |
Authorisation terms; customer contracts |
|
Infrastructure providers |
Towers, fibre, ducts and in-building systems |
Tower and fibre companies |
Infrastructure registration; Critical Telecommunication Infrastructure Rules where notified |
|
Network and equipment vendors |
RAN, core, transport, OSS/BSS and CPE |
Global and Indian vendors |
Trusted-source directive; MTCTE security testing |
|
Private 5G and IoT operators |
Captive and campus networks for industry |
Enterprises and system integrators |
Spectrum and authorisation terms |
|
Interconnect and exchanges |
Peering, roaming and internet exchanges |
Exchanges and carriers |
Interconnect agreements; telecom rules |
4. The regulatory framework at a glance
|
Instrument |
Key requirements |
|
Telecommunications Act, 2023 |
Framework for authorisation of telecom services and networks, including powers on security of networks and services |
|
Telecom Cyber Security Rules, 2024 (21 November 2024) |
Telecom entities adopt a cyber security policy and appoint a Chief Telecommunication Security Officer, with details provided to the Government Security incidents reported within six hours of becoming aware, with details such as users affected and remedial measures within 24 hours |
|
Critical Telecommunication Infrastructure Rules, 2024 |
Additional obligations for networks notified as critical telecommunication infrastructure |
|
National Security Directive on Telecom Sector (2021) |
Telecom service providers connect only trusted products from trusted sources (in force from 15 June 2021) |
|
MTCTE and ITSAR |
Mandatory testing and certification of telecom equipment, including security testing against Indian Telecom Security Assurance Requirements by NCCS |
|
CERT-In Directions (2022) and DPDP Act 2023 / Rules 2025 |
Six-hour reporting to CERT-In and 180-day logs; safeguards for subscriber personal data, with most DPDP obligations from May 2027 |
|
Verify the notifications Telecom rule details are summarised from the notifications and public sources. Confirm requirements and timelines against the official DoT gazette notifications and your licence conditions. |
5. Government, public-sector and private participants
- The Department of Telecommunications (DoT) administers the Telecommunications Act, licensing and telecom security rules.
- TRAI regulates tariffs, quality of service and commercial communications, including spam controls.
- NCCS runs security testing and certification of telecom equipment.
- CERT-In and NCIIPC handle incident response and protection of critical information infrastructure.
- Public-sector and private operators compete alongside infrastructure providers and global vendors.
6. Who buys cybersecurity inside a telecom provider
|
Stakeholder |
What they care about |
What they buy |
|
Board and CEO |
Licence compliance, national-security duties, resilience |
Board advisory, crisis exercises |
|
Chief Telecommunication Security Officer / CISO |
Cyber Security Rules compliance, incidents |
Gap assessments, SOC, threat hunting |
|
CTO and network engineering |
5G core, RAN and transport security |
Network and core assessments |
|
IT and OSS/BSS heads |
Billing, CRM and provisioning |
VAPT, ransomware resilience |
|
Fraud and revenue assurance |
SIM-swap, smishing, subscription fraud |
Fraud controls and analytics |
|
Regulatory affairs |
DoT, TRAI and CERT-In obligations |
Compliance assessments and evidence |
|
Vendor management |
Network vendors and managed partners |
Vendor and supply-chain assessments |
7. Why each player type needs a different approach
|
Player type |
Highest-consequence risk |
Starting point for assurance |
|
Mobile operator |
Core and signalling compromise, SIM-swap fraud |
5G core assessment, SIM-change controls, SOC |
|
Broadband ISP |
Router and CPE compromise, DDoS |
Network device hardening, DDoS testing |
|
Enterprise connectivity |
Customer network compromise via managed services |
Managed service and SD-WAN security reviews |
|
Infrastructure provider |
Physical tampering and remote site access |
Physical and remote-access assessments |
|
Network vendor |
Supply-chain and support-access abuse |
Product security and vendor access reviews |
|
Private 5G / IoT operator |
Weak segmentation of industrial networks |
Private network and OT security reviews |
8. How Codec Networks works with telecom providers
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For telecom providers we deliver network and 5G security assessments, cloud-native core reviews, IAM and vendor access reviews, managed SOC with threat hunting and Telecom Cyber Security Rules compliance support.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. Telecom rule details are summarised from notifications and public sources. Confirm obligations against the official DoT gazette notifications, licence conditions and CERT-In and MeitY instruments.