Strengthening Cybersecurity Framework for States

National Workshop on Strengthening Cybersecurity Framework for State Data

Overview:

• Organizer: Ministry of Electronics and Information Technology (MeitY)
• Event: National Consultation Workshop on "Strengthening Cybersecurity Framework for State Data"
• Date: May 11, 2026
• Location: Ashok Hotel, New Delhi
• Participants: Secretaries and senior officials from state and union territory governments, representatives from CERT-IN, NIC, and senior officials from MeitY and NeGD.

Objectives:

• To develop a comprehensive national cybersecurity policy framework for all 36 states and union territories.
• To ensure the protection of citizen data in the digital governance system.

Key Highlights:

1. Legal Framework:

   • The Digital Personal Data Protection Act, 2023 will be fully implemented by May 13, 2027, making cybersecurity a legal obligation for state governments.

2. Cybersecurity Requirements:

   • Each state must establish:
     • A formally notified cybersecurity policy, reviewed periodically.
     • A designated and empowered Chief Information Security Officer (CISO).
     • An operational State Security Operations Center (SOC).
     • A Cyber Crisis Management Plan (CCMP) applicable across all departments.

3. Operational Guidelines:

   • Emphasis on continuous operational vigilance, not periodic checks.
   • Importance of integrating 'Secure by Design' principles in application development.

4. Training and Capacity Building:

   • Structured training and certification programs for state officials to enhance cybersecurity human capital.
   • Regular cybersecurity drills to test and improve incident response capabilities.

5. Indigenous Solutions:

   • Preference for domestically developed cybersecurity solutions that meet established technical standards, in line with the Atmanirbhar Bharat initiative.

Discussion Areas:

• Risk-based assessment and continuous security monitoring of state IT assets.
• Security controls for state data centers (SDCs) and State Wide Area Networks (SWANs).
• Enhancing incident detection and response through dedicated SOCs and CSIRTs (Computer Security Incident Response Teams).
• Modernization of legacy applications and compliance with the Digital Personal Data Protection Act, 2023 and the National Information Security Policy and Guidelines (NISPG).

Future Steps:

• Phase III: Internal state-level workshops by all states and union territories to be completed by June 30, 2026.
• Phase IV: A national departmental summit in August 2026 to discuss key action points and priority reform areas based on state feedback.

Importance:

• The workshop is part of a four-phase departmental summit aimed at enhancing cybersecurity measures across India, ensuring that state governments are adequately equipped to protect sensitive citizen data and maintain a secure digital governance framework.

Conclusion:

• The initiative underscores the necessity of a robust cybersecurity architecture and the importance of collaboration between central and state governments to address the evolving cyber threats and ensure data protection for citizens.