NIC seeks tie-up with private players, says cybersecurity, complying with policies a challenge

Representative image.

India’s National Informatics Centre (NIC) is looking to partner with private players, saying it faces growing challenges in protecting the government’s digital infrastructure and complying with cybersecurity policies.

"Ministries and government organisations are facing an ever increasing challenge to comply with cyber security policies for protecting their ICT (information and communications technology) infrastructure," NIC said in an expression of interest floated for empanelling technological partners for cyber security.

The tender comes weeks after the Indian Computer Emergency Response Team’s (CERT-In) cybersecurity directions came into force.

These norms, which have to be followed not just by corporates but also government organisations, come with added compliance requirements such as a shorter cybersecurity reporting mandate.

The ministry of electronics and information technology (MeitY), under which NIC and CERT-In work, relaxed some of the directions for MSMEs after it was pointed out that micro, small and medium enterprises would find it hard to comply with them.

Though NIC hasn’t specifically mentioned CERT-In’s policy, it has admitted to cybersecurity “policies” being a challenge to comply with.

Moneycontrol has reached out to NIC for comments and will update the copy when the response comes in.

Citing the Digital India initiative of the government and the coronavirus outbreak, NIC said these led to heavier dependence on technology with the adoption of hybrid work environments and interconnected devices.

“Due to rapid changes in working environment and practices in the recent past, these cyber threats pose a greater challenge to maintain the sanctity of Government data. This renders the Government organisations more digitally vulnerable than ever before,” the tender said.

NIC is looking to partner with private players, who conform to the “Make in India” clause, to customise, supply and commission end-to-end cyber security solutions for ministries and various government agencies.

NIC will be the technical partner and will help in creating solutions that adhere to the government’s policies and guidelines.

Private players will have to create solutions for the government that can take up:

• Comprehensive security compliance assessment
• Security audit
• Data security
• Identity and access management
• Threat and vulnerability management
• Endpoint security
• Application security
• Network security including gateway security
• Cloud security
• Operational security
• Risk management
• Hardware and SCADA security
• Digital forensic services including incident analysis
• IoT security
• Security architecture design
• Secure software development life cycle
• Crisis management and business continuity plan
• Mobile security
• Master data management (MDM)
• Cryptography post quantum computing
• Biometric security
• Digital risk protection
• Security operations centre
• Security information and event management (SIEM)
• Email security

“It should be clearly indicated whether the service offered is based on non-indigenous products or services. Bidders may also indicate use of new technologies such as AI/ML, Big Data Analytics,  Blockchain, Quantum Computing, etc. and the extent of implementation in their product(s),” the tender said, referring to artificial intelligence and machine learning.

The tender comes a few days after the government issued strict cybersecurity guidelines for all its employees.

The government banned its employees from using third-party virtual private networks such as Nord VPN and Express VPN. It had also urged the staff not to save confidential information on services such as Google Drive or DropBox.

The government warned that “any non-compliance may be acted upon by the respective CISOs/Department heads” and employees may have to face consequences.