New security code kicks in for defence companies in India

New Delhi: The government has mandated new rules for defence companies operating in the country, with a special focus on enhancing cybersecurity to prevent data breaches and upgrading perimeter security for manufacturing facilities.

The new Security Manual for Licensed Defence Industries will require all players to invest in both information and physical security and conduct regular emergency drills, besides coordinating closely with law enforcement to verify the antecedents of employees.

There has been a massive surge in cyber attacks on Indian defence entities in recent years, with attempts peaking in the run up to Operation Sindoor when Pakistani and Chinese attackers attempted to take on critical cyber infrastructure. This is the first major overhaul of security rules for defence companies since the manual was issued in 2014.

As per the new rules, Indian companies will need to appoint a cyber information security officer who will be tasked to implement cyber security measures as recommended by the government. The cyber information security officer will also coordinate with government cyber security agencies to ensure that “systems handling classified and sensitive information are compliant with national cyber security directives”.

Companies have also been mandated to conduct annual cyber security audits by CERT-IN empanelled auditors. The findings of the audits need to be addressed and updates have to be shared regularly with the defence ministry.

Companies have also been told to invest in implementing measures to safeguard critical information infrastructure with things like multi factor authentication for access, encryption of sensitive communications and strict access control to systems handling defence-related data.

Defence companies will also need to create watch towers and physical perimeter security grids as per specifications mandated by the defence ministry. Biometric access control systems will also need to be installed at all entry and exit points. Employees handling classified information will also need to undergo periodic re-vetting.

India has seen an unprecedented boom in domestic defence manufacturing companies in the last decade, with dozens of players setting shop to produce defence equipment from drones to ammunition, explosives and small arms as the government has fully opened doors for the private sector.