Mimansa Joshi

(centre-IR)

Introduction

As India strides forward in its digital transformation, integrating digital infrastructure across governance, finance, healthcare, and everyday life, the importance of a secure cyberspace cannot be overstated. The country is now home to over 700 million internet users, with rapid digitisation driven by flagship initiatives such as Digital India. Yet, this growing digital footprint has brought with it a host of cyber threats ransomware attacks, phishing, espionage, and misinformation campaigns. Despite commendable efforts in building institutional mechanisms, India’s cybersecurity architecture remains fragmented, under-resourced, and vulnerable to sophisticated attacks. This article provides a grounded analysis of India’s current cybersecurity framework, identifies pressing structural and strategic gaps, and charts a feasible roadmap to strengthen national cyber resilience through phased, pragmatic, and politically aware reform.

Understanding the Existing Cybersecurity Framework

India’s cybersecurity ecosystem is anchored by a number of key institutions. The Indian Computer Emergency Response Team (CERT-In), established under the Information Technology (IT) Act, 2000, serves as the national nodal agency for responding to cyber incidents. Other significant players include the National Critical Information Infrastructure Protection Centre (NCIIPC), which focuses on protecting infrastructure like power grids and banking systems, and the National Cyber Coordination Centre (NCCC), tasked with metadata analysis and threat monitoring.

However, the institutional setup is far from seamless. Agencies often work in silos, and overlapping mandates can lead to delays and miscommunication during critical incidents. For instance, the responsibilities of CERT-In and NCIIPC sometimes intersect without a clear command hierarchy. Scholars like Sukumar and Sharma have noted the urgent need for a unified command structure through a National Cyber Command to address these coordination challenges effectively and overcome entrenched bureaucratic turf wars.

Key Gaps in India’s Cybersecurity Architecture

1. Human Capital Deficit: India faces a severe shortage of trained professionals. The 2013 National Cyber Security Policy set a goal to train 500,000 cybersecurity personnel by 2018, a target that remains unachieved. According to data from the Indian Cyber Crime Coordination Centre (I4C), many law enforcement units lack cyber forensics capacity, hampering effective investigation and prosecution.
2. Outdated Legislation: The IT Act, 2000, is ill-equipped to deal with new threats like deepfakes, AI-driven attacks, or quantum computing. Cross-border data flow rules and encryption policies remain ambiguous, complicating enforcement and cooperation.

• Low Digital Literacy and Awareness: A large portion of the population remains unaware of how to report cybercrimes or secure their digital presence. Studies show that only about 17% of people in some states know how to use the cybercrime reporting portal, leading to underreporting and delays.
• Limited Infrastructure Protection: Although the NCIIPC classifies telecom, power, and finance sectors as critical, many mid-sized entities within these sectors lack the resources to implement robust cybersecurity protocols. The ransomware attack on AIIMS Delhi in 2022 revealed the vulnerability of even premier institutions.
• Lack of Strategic Integration with Defence: The Defence Cyber Agency, established in 2019, has limited coordination with civilian agencies. In an age of hybrid warfare, where cyber operations accompany military strategies, this gap poses a significant strategic risk.
• Structural Barriers to Reform: Cybersecurity reforms often stall due to political inertia, fragmented federalism, and regulatory capture. Overlapping jurisdiction between state and central agencies leads to uneven implementation, and cybersecurity remains underfunded in most departmental budgets. Without addressing these systemic bottlenecks, even well-drafted policies struggle to translate into action.

Emerging Threats in the Indian Context

India’s threat landscape is complex and fast-evolving. State-sponsored groups, particularly from China and Pakistan, have targeted Indian infrastructure, including attempts to breach power grids during the Galwan Valley standoff. India also ranks high in phishing attacks and ransomware cases, especially targeting healthcare and banking systems.

The growing adoption of IoT devices, from smart meters to connected cars, adds new vulnerabilities. Many of these lack basic security features, making them easy targets. Simultaneously, deepfakes and misinformation campaigns are increasingly deployed to influence public discourse and democratic processes.

Strategic Roadmap: Building a Phased and Resilient Cyber Future

To move from reactive measures to building strategic cyber resilience, India needs a realistic, phased roadmap that prioritises actions based on feasibility, urgency, and available capacity. This roadmap must avoid being an idealistic wish list and instead engage with the practical sequencing, feasibility, and political trade-offs involved in reform.

Short-Term Priorities

1. Institutional Coherence and Leadership:
   1. Establish a National Cyber Command to unify military, intelligence, and civilian cyber functions, with clear demarcation of agency responsibilities. The authority must be empowered to overcome bureaucratic turf wars that frequently derail coordination. o             Streamline roles between CERT-In, NCIIPC, and NCCC to prevent duplication and delays, and establish a rapid-response mechanism for interagency crises.
2. Cyber Hygiene and Public Awareness:
   1. Launch mass digital literacy campaigns in rural and semi-urban areas. o          Promote cybercrime reporting via simplified tools like the 1930 helpline and ensure these platforms are accessible in regional languages.

Medium-Term Priorities

• Capacity Building and Workforce Development:
  • Partner with universities and private firms to offer certified training programs. o          Embed cybersecurity education in police and judicial training curricula, and establish incentives for public sector retention.
• Legal and Policy Reform:
  • Update the IT Act to cover emerging threats and set cross-border cooperation protocols. o Ensure that the Digital Personal Data Protection Act is enforced with strong checks against state overreach. Surveillance mechanisms must be transparent and subject to independent oversight to safeguard civil liberties.
• Support for Critical Infrastructure and SMEs:
  • Implement mandatory security standards for critical sectors. o    Provide grants or incentives to SMEs within these sectors, potentially through public-private partnerships, to build affordable and enforceable cybersecurity protocols.

Long-Term Priorities

• Adoption of Advanced Technologies:
  • Transition government networks to zero-trust architectures. o     Invest in quantum-safe encryption and build research alliances to prepare for quantum threats.

• Global and Public-Private Collaboration:
  • Learn from best practices in countries like Estonia (decentralised digital identity systems), Singapore (public-private cyber drills), and Israel (militarycivilian cyber talent pipelines). o    Actively participate in international cyber norms development, capacitybuilding exchanges, and multilateral cyber diplomacy.

Conclusion

India stands at a pivotal moment in its digital journey. While its digital ambitions are expansive, its cybersecurity posture must evolve rapidly to keep pace. Addressing the legal, institutional, and structural deficits is not just a technical necessity but a strategic imperative. This roadmap offers a grounded and phased pathway—prioritising short-, medium-, and long-term actions; balancing national security with privacy; and drawing lessons from successful global models. Through unified leadership, global collaboration, and peoplecentric reforms, India has the potential to not only secure its cyberspace but also emerge as a global leader in cybersecurity governance.

References 

• A K Bishwas and M Sen, Strategic Roadmap for Quantum-Resistant Security (2024)
• Cisco Systems, Cybersecurity Readiness Index: Indian Enterprises and AI-driven Threats (2025
• Y Fernandes and N Abosata, Analysing India’s Cyber Warfare Readiness and Developing a Defence Strategy (2024)
• ISB Institute of Data Science, Quantum Resilient Banking: Strategies for a Secure Transition (2025)
• Kaspersky, Strengthening the Cybersecurity Ecosystem: A Roadmap for Indian Enterprises and Organizations (2024)
• Ministry of Electronics and Information Technology, National Cyber Security Policy 2013 (Government of India)
• S S Tripathy, ‘A Comprehensive Survey of Cybercrimes in India Over the Last Decade’ (2025)
• AM Sukumar and RK Sharma, The Cyber Command: Upgrading India’s National Security Architecture (Observer Research Foundation Report, 2016)