Centre considering ‘support’ for MSMEs, startups to comply with new cybersecurity norms

The Ministry of Electronics and Information Technology is mulling over possible ‘considerations’ and ‘support’ that can be extended toward micro, small and medium enterprises (MSMEs) and startups to comply with the April 29 directions of the Indian Computer Emergency Response Team (CERT-In).

According to sources, this and other issues pertaining to the CERT-In directions were discussed during a meeting Minister of State in MeitY Rajeev Chandrasekhar held with representatives of industry bodies on Friday. The CERT-In directions bring in additional compliance requirements for all body corporate that cater to Indian citizens. Some of the provisions of reporting cybersecurity incidents within 6 hours, logging requirements, preserving logs, and so on, have raised concerns among major companies across the world.

In fact, citing the logging requirement of the directions, Canada-based VPN Surfshark and British Islands-based ExpressVPN has pulled their servers from India. As per the logging requirements, service providers have to store information such as customer names, and IP addresses of their customers for a time period.

In the meeting, which was reportedly held in response to representations made by several trade bodies and tech policy groups on the directions, it was pointed out that MSMEs and startups may not have the required infrastructure for many of the requirements of the CERT-In directions including reporting of cybersecurity incidents.

"The rules cannot be same for MSMEs and established businesses. The minister said that they can look certain into considerations for msmes and startups, which will be evaluated," Kanishk Gaur, founder of India Future Foundation told Moneycontrol. Gaur was one of the attendees in the meeting.