Govt approves National Security Directive on telecom sector, to declare list of trusted sources

In a move to enhance national security, the Cabinet Committee on Security (CCS) has accorded approval for the National Security Directive on Telecommunication sector under which the government will declare a list of trusted sources, trusted products for the benefit of telecom service providers to maintain the integrity of the supply chain security.

India is among the top three countries in the world facing cyber-attacks and in 2019, there were four lakh cyber incidents handled by CERT-In. A sum of Rs 1.24 lakh crores was lost due to cyber-crime in India during the last year.  Recent ransomware attacks, as well as data and identity thefts, are a serious cause for concern from a national security angle.

Telecom is also the critical underlying infrastructure for all other sectoral information infrastructure of the country such as Power, Banking & Finance, Transport, Governance and the strategic sector.  Security breaches resulting in compromise of the confidentiality and integrity of information or in disruption of the infrastructure can have disastrous consequences.  Telecom, today, is thus a crucial sector from the National Security perspective.

Briefing reporters after a meeting of Union Cabinet, Minister for Communications, Electronics and Information Technology Ravi Shankar Prasad said that telecom service providers are required to connect new devices which are designated trusted products.

The minister said the policy will come into operation after 180 days from the date of approval.
"Considering the need to ensure India's national security, the Cabinet has accorded approval for the National Security Directive on the telecommunications sector. Under the provisions of this directive, in order to maintain the integrity of the supply chain security, the government will declare a list of trusted sources, trusted products for the benefit of telecom service providers to be covered under this directive," he said.

The minister said the decision is important from point of view of national security.
He said the methodology to designate trusted products will be devised by the designated authority, who is the National Cyber Security Coordinator.

"Telecom Sevice providers are required to connect new devices which are designated, trusted products. The designated authority will make its determination based on approval of a committee headed by the Deputy NSA (National Security Advisor).

The committee, to be called National Security Committee on Telecom, will consist of members from relevant departments, ministries; will also have two members from the industry and an independent expert.
The minister said a list of designated sources from whom no procurement can be done may also be created.

Considering the security concerns and for the protection of India’s essential national security interests, the Cabinet has for the first time approved a framework by issuing the National Security Directive on Telecom Sector.  This will provide a significant boost in ensuring our national security by addressing 5G and supply chain concerns.  

Under the provisions of the Directive, in order to maintain the integrity of the supply chain security and in order to discourage insecure equipment in the network, Government will declare a list of ‘Trusted Sources/ Trusted Products’ for the benefit of the Telecom Service providers.

The list of equipment to be covered under this Directive and the methodology to designate ‘Trusted Products’ will be devised by the Designated Authority who is the National Cyber Security Coordinator (NCSC). Telecom Service Providers are required to connect new devices which are designated ‘Trusted Products”.

The minister said that from among the sources declared as a trusted source by the designated authority, those which meet the criteria of the Department of Telecom's preferential market access scheme will be certified as "India Trusted sources".

The National Security Committee on Telecom will take measures to increase the use of equipment from such trusted Indian sources, he said, adding that the guidance for the manner in which the enhanced supervision and effective control could be maintained by the telecom service provider will be issued by the designated authority at regular intervals.

Prasad said the present directive does not envisage mandatory replacement of the existing equipment already inducted in the network of telecom service providers. The directive will also not affect ongoing annual maintenance contracts or updates to existing equipment already inducted in the network as on the date of the effect of the directive, he added.

The minister said that the Department of Telecommunications will suitably modify guidelines and ensure monitoring of compliance by telecom service providers. The designated authority will put in place a portal for easy upload of the application by TSPs and equipment vendors.
Prasad said the move will also improve the ease of doing business by providing assessment methodology to TSPs and equipment vendors.

"DoT will make appropriate modifications in the license conditions for the implementation of provisions of the directive and the policy will come into operation after 180 days from the date of approval," he said.