National Consultative Workshop on Strengthening Cyber Security Frameworks for State Data

📌 Summary:

• MeitY convened the National Consultative Workshop on "Strengthening Cyber Security Frameworks for State Data" at Hotel Ashok, New Delhi on 11 May 2026
• Chaired by Shri S. Krishnan (Secretary, MeitY); attended by Principal Secretaries/Secretaries of States & UTs, CERT-In, NIC, NeGD officials
• This is Stage II of a four-stage departmental summit initiated pursuant to PM Modi's directions at the 5th National Conference of Chief Secretaries
• Objective: produce a comprehensive national cybersecurity policy framework for all 36 States and UTs of India
• Key context: Digital Personal Data Protection (DPDP) Act, 2023 becomes fully enforceable from 13 May 2027 → cybersecurity is now a legal obligation for every State department holding citizen data
• Four foundational requirements for every State/UT: (i) formally notified Cyber Security Policy; (ii) appointed and empowered State-level CISO; (iii) operational State Security Operations Centre (SOC) integrated with NIC GSOC; (iv) Cyber Crisis Management Plan (CCMP) deployed and tested
• Principle of "Secure by Design" — cybersecurity embedded from earliest stages of application development and procurement
• AI-enabled cyber attacks flagged as growing threat; forward-looking risk frameworks needed
• Human dimension emphasised — awareness, cyber hygiene of govt officials via NeGD, ISEA Project, iGOT Karmayogi; regular cyber drills
• Preference for indigenously developed cybersecurity solutions (Aatmanirbhar Bharat alignment)
• Six national thematic areas: (1) Risk-based assessments & continuous monitoring of State IT assets; (2) Securing State Data Centres (SDCs) & State Wide Area Networks (SWAN) with modern perimeter, endpoint, cloud controls; (3) Strengthening incident detection/response via SOCs and State CSIRTs under CERT-In umbrella; (4) Legacy application modernisation, Secure-by-Design, Zero Trust Architecture; (5) Data classification, DPDP Act compliance, MHA's NISPG alignment; (6) CISO appointments across State departments, capacity building, citizen cyber awareness
• Dr. Sanjay Bahl (DG CERT-In): outlined threat landscape — ransomware on govt data, AI-enabled phishing, supply-chain compromises, misconfigured cloud risks
• V.T.V. Ramana (NIC Cybersecurity): outlined Government SOC (GSOC), VAPT programmes, Zero Trust integration
• Next steps: State-Level Workshops (Stage III) by 30 June 2026; Final National Departmental Summit (Stage IV) in August 2026; final note to Cabinet Secretariat

🎯 UPSC Relevance: GS3 — Cyber Security: pan-India State cybersecurity policy architecture, DPDP Act enforcement, CERT-In federated model, Zero Trust, AI threats. GS2 — Centre-State coordination, cooperative federalism in digital governance.

📝 Prelims Facts:

• DPDP Act, 2023 becomes fully enforceable: 13 May 2027
• CERT-In = Indian Computer Emergency Response Team — national nodal agency for cyber security incidents
• NIC = National Informatics Centre (under MeitY)
• NeGD = National e-Governance Division
• ISEA = Information Security Education and Awareness Project
• NISPG = National Information Security Policy and Guidelines (MHA)
• Four-stage Departmental Summit on State Cyber Security; Stage IV summit scheduled August 2026
• Foundational requirements for States: notified Cyber Policy, empowered CISO, operational SOC, CCMP

🔑 Key Term: Zero Trust Architecture — A cybersecurity model that assumes no user, device or application (inside or outside the network perimeter) is inherently trusted; access is granted continuously verified, least-privileged, and policy-driven for every request.