Comply with cyber security policies: AIIMS to officials in August

A notice outside the Blood Bank in AIIMS, New Delhi.

Around three months before a cyberattack crippled the entire digital system of the All India Institute of Medical Science (AIIMS), the hospital-cum-medical institution, in a circular, had directed officials concerned to comply with cyber security policies issued by the Ministry of Home Affairs (MHA) and Ministry of Electronics and Information Technology (MeitY).

The subject of the circular dated August 16, issued by the Computer Facility at AIIMS (responsible for maintaining the IT systems at the hospital), read, “Compliance of security instructions provided under National Information Security Policies and guidelines issued by MHA in 2014 and cyber security policies issued by DeitY.”

This crisis is also happening at a time when the government has flagged the lack of cyber crisis management plan among government bodies, Moneycontrol had earlier reported. ‘CCMP for Countering Cyber Attacks and Cyber Terrorism’ was launched in 2019 to create a framework for ministries/departments/bodies to deal with cyberattacks.

The circular in question from August states that changes were made in regard to the appointment of personnel under cyber security roles. The roles were of chief information security officer, cyber security administrators, information security officer, system administrators, network security administrator and network administrator.

It is not clear why these changes were made with regards to cyber security roles in August. However, Moneycontrol had reported that two system analysts were suspended following the ransomware incident in November.

Moneycontrol has reached out to AIIMS with queries regarding the issue and the article will be updated when a response is received.

AIIMS officials had told Moneycontrol then that 50 servers and 5,000 computers were being scanned using antivirus software to check if systems were bugged beforehand.

Currently, the hospital has diverted nearly 250 personnel attached with doctors in research projects to work on patient services which is being done manually since the ransomware crippled the e-hospital system at AIIMS, Moneycontrol had earlier reported.