Telecom Cybersecurity Necessary But Should Not Be Burdensome

The Telecommunications (Telecom Cyber Security) Rules, 2024, made under sections 22 and 56 of the Telecommunications Act, 2023, recently came into force. They are the first systemic step in bolstering the safety and resilience of the telecom sector, replacing the Prevention of Tampering of the Mobile Device Equipment Identification Number Rules, 2017. They aim to prevent increasing cyber threats disrupting digital communication networks by requiring them to establish accountability, enhance security frameworks and respond rapidly to cyber incidents.

The rules aim to achieve these objectives by having every telecom entity implement cybersecurity policies setting out security safeguards, risk identification, assessment and management, and the prevention of and recovery from security incidents. A security incident is defined as an event posing an actual or potential risk to telecom cybersecurity. This includes not only actual attacks and breaches but also