Every telecom operator and network owner in India now has binding cyber security duties, with a six-hour clock for reporting security incidents to the government. The Telecommunications (Telecom Cyber Security) Rules, 2024 were notified by the Department of Telecommunications (DoT) on 21 November 2024 under the Telecommunications Act, 2023, and amended on 22 October 2025. This guide goes rule by rule: who counts as a telecommunication entity, the policy, audit, security operations centre and Chief Telecommunication Security Officer (CTSO) duties, incident reporting, equipment identifier rules, the 2025 amendment for businesses that rely on mobile numbers, and what it all means for the machine identities and automation that run modern networks. It is for CTSOs, CISOs, network security leads and compliance teams at operators, infrastructure providers, device makers and importers. For the wider jurisdiction picture see the Telecoms Security Laws Map.
Key takeaways
- Six hours, then 24 hours. Rule 7 requires a report within six hours of becoming aware of a security incident and fuller details (users affected, duration, area, remediation) within 24 hours.
- A named, Indian CTSO. Rule 6 requires a CTSO who is a citizen and resident of India and reports to the Board or equivalent governing body.
- Policy, audit and SOC are mandatory. Rule 4 requires a telecom cyber security policy, internal and certified-agency audits, and a security operations centre with retained logs.
- Identifiers are protected assets. Rule 8 requires IMEI registration before first sale or import and prohibits tampering with equipment identifiers.
- The 2025 amendment reaches beyond telcos. It defines Telecommunication Identifier User Entities (TIUEs), businesses that use phone numbers to identify customers, and sets up a Mobile Number Validation platform.
Scope: who and what is covered
The rules are made under Section 22(1) read with Section 56(2)(v) of the Telecommunications Act, 2023 and took effect on publication in the Official Gazette. They replaced the Prevention of Tampering of the Mobile Device Equipment Identification Number Rules, 2017.
| Party | Why in scope | Main rules |
|---|---|---|
| Telecommunication entities | Any person providing telecommunication services or establishing, operating, maintaining or expanding a telecommunication network, including authorised entities under Section 3(1) and entities exempted under Section 3(3) of the Act | Rules 3, 4, 6, 7 |
| Manufacturers of telecom equipment with an identifier | Must register each IMEI made in India before first sale | Rule 8 |
| Importers | Must register each IMEI before import for sale, testing, research or other purposes | Rule 8 |
| Telecommunication Identifier User Entities (2025 amendment) | Persons other than licensees or authorised entities that use telecom identifiers, such as mobile numbers, to identify customers or deliver services | Rules 5 and 7A as amended |
| Any person | Prohibited from endangering telecom cyber security, sending fraudulent messages or tampering with identifiers | Rules 4 and 8 |
Critical networks have a separate instrument: the Telecommunications (Critical Telecommunication Infrastructure) Rules, 2024, notified on 22 November 2024, add duties for networks the government notifies as critical. This guide focuses on the Cyber Security Rules and flags the overlap where it matters.
Key obligations
| Rule | Obligation | What to have ready |
|---|---|---|
| 3 | Government may seek traffic and other data (not message content) and direct entities to build collection infrastructure; recipients use it only for telecom cyber security under confidentiality safeguards | Data-sharing procedure, legal review of requests, access logging on any collection system |
| 4 (directions) | Follow government directions and standards, including implementation timelines | Tracker of directions received through the portal and their due dates |
| 4 (policy) | Adopt a telecom cyber security policy covering safeguards, risk management, hardening, vulnerability assessment, penetration testing, rapid response and forensic analysis; inform the government | Board-approved policy filed via the portal |
| 4 (audits) | Periodic audits, internal and by a certified agency, at intervals the government sets on the portal; share reports | Audit calendar aligned with portal intervals |
| 4 (SOC) | Set up a security operations centre, alone or jointly, monitoring incidents and threat actors and keeping logs from operations and maintenance, firewall, IDS/IPS, SIEM and other elements | SOC coverage map and log source inventory |
| 4 (records) | Keep records for the period the government specifies on the portal and make them available to authorised persons | Retention schedule matched to the portal value |
| 6 | Appoint a CTSO, citizen and resident of India, reporting to the Board; give details on the portal and update promptly | Appointment record, deputy cover, portal entry |
| 7 | Report incidents in six hours, details in 24 hours; government may require public disclosure, audits and remedial directions | Tested reporting runbook and templates |
| 8 | Register IMEIs; no tampering; block tampered IMEIs when directed | Registration workflow and blocking capability |
The CTSO role
The CTSO coordinates with the government on implementation of the rules and on incident reporting under Rule 7. Because the role reports to the Board, it works best where the CTSO also has authority over the SOC and the incident process. Groups with several licensed entities should decide whether one person serves all of them and confirm that each entity's portal record names that person.
Suspension and disconnection (Rule 5)
The government may act on telecommunication identifiers linked to activity that endangers telecom cyber security. The usual route is a notice with seven days to respond, a hearing if there is a response, and a reasoned written order to suspend for a period or disconnect permanently. In the public interest it may suspend immediately without notice, recording reasons. Affected persons may make a representation within 30 days. Orders can extend to linked identifiers, access to services may be limited for up to three years, and a suspended or disconnected number cannot be reallocated for one year (extendable to three). Operators need a reliable way to execute these orders quickly and to evidence that they did.
Timeline and current status
| Date | Event |
|---|---|
| 24 December 2023 | Telecommunications Act, 2023 receives assent (enabling Act) |
| 28 August 2024 | Draft rules published (G.S.R. 520(E)) |
| 21 November 2024 | Telecommunications (Telecom Cyber Security) Rules, 2024 (G.S.R. 720(E)) notified and in force on publication |
| 22 November 2024 | Critical Telecommunication Infrastructure Rules, 2024 notified |
| 22 October 2025 | Telecommunications (Telecom Cyber Security) Amendment Rules, 2025 (G.S.R. 771(E)) notified: TIUE definition, Mobile Number Validation platform, used-device IMEI checks |
| 29 October 2025 | Amendment mistakenly republished; corrected by a notification dated 25 November 2025 |
| 27 November 2025 | DoT states the October 2025 amendments are fully in force and enforceable |
Several values are not fixed in the rules themselves but set through the DoT portal: audit intervals, log retention periods and implementation timelines for directions. Treat the portal as part of the rulebook and check it at least quarterly. Status checked on 8 November 2026.
The 2025 amendment
- TIUEs: businesses such as messaging, ride-hailing, delivery and fintech platforms that use mobile numbers as customer identifiers are now a defined class and can be required to share identifier data with the government in specified circumstances.
- Mobile Number Validation (MNV): new Rule 7A sets up a platform to validate whether a mobile number belongs to the person in a business's records, for telecom cyber security and preventing security incidents.
- Second-hand devices: sellers of used or refurbished phones must check each device's IMEI against a central blocklist before resale.
- Immediate suspension: amended Rule 5 allows suspension orders that can reach both the telecom entity and the TIUE.
Enforcement and penalties
Rule 9 provides that contraventions are dealt with under the provisions of the Telecommunications Act, 2023. The Act sets the offences, civil penalties and adjudication process, so read its penalty provisions and schedules for the amounts that apply to your authorisation, and take legal advice on the category a given breach falls into. Beyond penalties, the rules give DoT practical levers: directions with deadlines (Rule 4), mandatory audits by a certified agency and public disclosure of incidents (Rule 7), and suspension or disconnection of identifiers (Rule 5). The CERT-In Directions of 2022 run in parallel for incidents that also fall under CERT-In's regime; see the CERT-In Directions 2022 Guide.
What it means for AI agents and non-human identities
Telecom networks are run by machines talking to machines: OSS and BSS integrations, network function credentials, orchestration service accounts, API gateways and, increasingly, AI agents in network operations and customer care. The rules do not mention these by name, but several obligations land on them. Our view at NHI Mgmt Group:
- SOC logs must include machine activity: the Rule 4 SOC duty lists logs from operations and maintenance systems. Most O&M access is by service accounts and automation, so authentication and command logs for those identities belong in the SIEM.
- Incidents often start with a machine credential: an exposed API key for a provisioning system or a stolen element manager password can cause a reportable incident. Your six-hour clock starts when you become aware, so credential exposure alerts must route to the incident process, not just to the owning team. See the Telecoms Identity Security Guide.
- Hardening and vulnerability assessment cover credentials: default and shared vendor accounts on network elements are a classic hardening gap. Inventory them, give each an owner and move them into a vault.
- AI agents that act on the network need limits: an agent that can change routing or provision SIMs should have a dedicated identity, least-privilege scopes, approval steps for high-impact actions and full action logs. See the AI Agent Authorisation Guide.
- MNV is an identity verification signal: TIUEs using mobile numbers for login or recovery can use validation to reduce account takeover through recycled or fraudulently obtained numbers. See the SIM Swap Fraud Guide.
Compliance steps
- Confirm your status. Decide whether each group company is a telecommunication entity, manufacturer, importer or TIUE, and whether any network is notified as critical telecommunication infrastructure.
- Appoint and register the CTSO. Check citizenship and residence, the Board reporting line and deputy cover, and enter details on the portal.
- Write or refresh the policy. Cover every element in the Rule 4 policy duty, approve it at Board level and inform DoT through the portal.
- Stand up or extend the SOC. Map log sources against the Rule 4 SOC duty, including O&M, firewall, IDS/IPS and SIEM, and match retention to the portal value.
- Build the incident runbook. Define "aware", pre-fill the six-hour template with affected system and description fields, and prepare the 24-hour data (users, duration, area, impact, remediation).
- Test it. Run a tabletop with a 03:00 start and a provider-originated incident; measure the time to submission.
- Plan the audit cycle. Schedule internal audits and a certified agency audit to the portal intervals; track findings to closure.
- Prepare for Rule 5 orders. Build a controlled process to suspend, disconnect and block reallocation of identifiers on order, with evidence.
- Handle identifiers. Manufacturers and importers: register IMEIs before first sale or import. Operators: be able to block tampered IMEIs on direction.
Own SOC or joint SOC
Rule 4 allows the SOC to be set up alone or jointly. Large operators with their own network operations centres usually run a dedicated SOC so that telecom-specific telemetry (signalling, O&M, element managers) is analysed by staff who know it. Smaller infrastructure providers and niche service providers may meet the duty through a joint or managed SOC; if so, the contract should fix log ownership, retention to the portal value, access for authorised persons and an escalation time that leaves room inside the six-hour window. Either way, the entity, not the provider, remains responsible for reporting.
Measuring progress
- Median and worst-case time from awareness to six-hour report in drills.
- Percentage of in-scope log sources (including machine identities on O&M systems) feeding the SOC.
- Open audit findings past due date.
- Shared or default vendor accounts on network elements remaining (target: zero).
- Time to execute a Rule 5 suspension order end to end.
Framework mapping
| Rule | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| 4 policy and risk assessment | GV.RM-01, ID.RA-01 | RA-3 |
| 4 audits | GV.OC-03 | CA-2 |
| 4 SOC and logs | DE.CM-01, DE.AE-02, PR.PS-04 | SI-4, AU-11 |
| 6 CTSO | GV.RR-02 | PM-2 |
| 7 incident reporting | RS.CO-02 | IR-6 |
| Machine credentials on network elements | PR.AA-01, PR.AA-05 | IA-5, IA-9, AC-6 |
Common failure patterns
- Waiting for certainty: teams that delay the six-hour report until root cause is known; the rule needs relevant details and a description, with fuller data at 24 hours.
- Ignoring the portal: retention and audit intervals set on the portal are missed because the policy only quotes the rules.
- SOC blind to O&M: network element logins by vendor and service accounts never reach the SIEM.
- CTSO without levers: a nominated officer with no authority over incident response or the SOC.
- TIUEs assuming they are out of scope: platforms that use phone numbers as identifiers but have not read the 2025 amendment.
Practitioner checklist
- Status decision recorded for every group entity (telecom entity, manufacturer, importer, TIUE, critical infrastructure).
- CTSO appointed, Indian citizen and resident, Board reporting, portal entry current.
- Telecom cyber security policy covering all the Rule 4 policy duty elements, filed with DoT.
- SOC live with O&M, firewall, IDS/IPS and SIEM logs, retention matched to the portal.
- Six-hour and 24-hour incident templates and an out-of-hours escalation tree.
- Internal and certified-agency audits scheduled to portal intervals.
- Service accounts and vendor accounts on network elements inventoried, owned and vaulted.
- Rule 5 order execution process tested, including reallocation blocks.
- IMEI registration and tampered-IMEI blocking procedures in place where relevant.
Standards and references
Source note: the Gazette and DoT main sites could not be reached when this page was checked; rule text was confirmed against the gazette text hosted on a Government of India court site and the DoT eServices portal. Confirm against the official Gazette of India text before relying on any obligation.
- Department of Telecommunications eServices: Telecom Cyber Security Rules, 2024 (notification of 21 November 2024)
- Telecommunications (Telecom Cyber Security) Rules, 2024, G.S.R. 720(E), with Amendment Rules, 2025, G.S.R. 771(E): gazette text hosted on a Government of India (nic.in) court site
- TRAI: The Telecommunications Act, 2023 (No. 44 of 2023)
- The Tribune (ANI): DoT clarifies telecom cyber security amendment rules are in force
- Internet Freedom Foundation: DoT notifies the Telecom Cyber Security (Amendment) Rules, 2025
- S.S. Rana and Co.: Government notifies Telecommunications Cyber Security Rules 2024 (secondary source)
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
Related NHI Mgmt Group resources: Telecoms Security Laws Map · Telecom Network Security Guide · Cyber Incident Reporting Requirements Map · India IT Act 2000 and SPDI Rules. This guide summarises the Telecommunications (Telecom Cyber Security) Rules, 2024 as amended in 2025, as at 8 November 2026, and is not legal advice.