Build a National Cyber Defence System for Critical Infrastructure

India’s electricity grids, banks, payment systems, telecommunications networks, transportation, hospitals and government services increasingly depend on interconnected digital systems.

A major cyberattack can therefore become much more than an IT failure. It can disrupt electricity, communications, financial transactions, transportation, or essential public services.

India already has institutions such as CERT-In for cybersecurity incident prevention and response, as well as sector-specific cybersecurity requirements. The challenge is to ensure that organizations operating critical infrastructure meet strong common standards and can respond collectively when major threats emerge.

Establish mandatory National Cybersecurity Standards for Critical Infrastructure covering sectors such as energy, banking and payments, telecommunications, transportation, healthcare, water, cloud infrastructure, and critical government systems.

Every critical operator should be required to maintain essential protections including encryption, strong authentication, network monitoring, rapid security patching, secure backups, system segmentation, supply-chain controls and tested incident-response plans.

Critical operators should also participate in a national cyber-threat network coordinated by India’s cybersecurity agencies.

When one organization discovers a serious new threat, relevant information should rapidly reach other organizations that may be vulnerable:

Detect → Share → Warn → Defend → Contain → Recover

India should regularly conduct independent penetration testing, Red Team exercises, and national cyberattack simulations. Operators should demonstrate not only that they can prevent attacks, but that essential services can continue operating and recover quickly when an attack succeeds.

Government should establish the standards and coordinate national intelligence and response. Individual banks, telecom companies, utilities, and other operators should remain responsible for protecting their own systems.

The United States provides a useful example of coordinated protection of critical infrastructure.

The U.S. identifies 16 critical infrastructure sectors, including energy, communications, financial services, transportation, healthcare, water, and information technology. Its Cybersecurity and Infrastructure Security Agency (CISA) works with government agencies and private operators to strengthen these systems’ security and resilience.

CISA has established cross-sector cybersecurity performance goals covering fundamental protections, while its Joint Cyber Defense Collaborative brings government and private organizations together to share information and coordinate responses to major cyber threats.
The United States also conducts Cyber Storm exercises that simulate major cyber incidents and test whether government and critical-infrastructure operators can respond and recover together.

India can build on its existing cybersecurity institutions using the same basic architecture:

Set standards → Monitor continuously → Share threats → Test defences → Respond together → Recover quickly

The objective is not to guarantee that India will never suffer a cyberattack. It is to ensure that attacks are harder to execute, detected earlier, contained faster, and far less capable of disrupting the country.