Telecommunications (Telecom Cyber Security) Rules, 2024 were published on 21.11.2024.

Person includes an individual, any company or association or body of individuals, whether incorporated or not, by whatsoever name called or referred to.

Telecommunication Entity means any person providing telecommunication services, or establishing, operating, maintaining, or expanding telecommunication network, including an authorised entity holding an authorisation under sub-section (1) of section 3 of the Act, or a person exempted from the requirement of authorisation under sub-section (3) of section 3 of the Act.

Where the Central Government considers that immediate action under sub-rule (5) is necessary or expedient in the public interest, it shall without issuing a notice under Rule 5 (2), pass an order recording the reasons thereof, with appropriate directions to the telecommunication entity to temporarily suspend use of the relevant telecommunication identifier.

The person to whom notice is issued under Rule 5(2), shall send a written response to the Central Government within seven days of receipt of such notice, and if no response is received within such period, the Central Government shall proceed to issue an order under 5 (5) which may include: (a) temporarily suspend use of the relevant telecommunication identifier, in the manner and for a duration as may be specified in such order; or (b) permanently disconnect the use of the relevant telecommunication identifier.

As per Rule 4 of Telecommunications (Telecom Cyber Security) Rules, 2024: 1. Every telecommunication entity shall ensure compliance with the directions and standards, including timelines for their implementation, as may be issued by the Central Government for the prevention of misuse of telecommunication identifiers or telecommunication equipment or telecommunication network or telecommunication services for ensuring telecom cyber security. 2. Every telecommunication entity shall implement measures to ensure telecom cyber security as per Rule 4(4).

(1) A manufacturer of equipment that has International Mobile Equipment Identity (IMEI) number, shall register such IMEI number of such equipment manufactured in India with the Central Government, prior to the first sale of such equipment, in the form as may be specified for such purpose on the portal by that Government. (2) An importer of equipment that has an International Mobile Equipment Identity (IMEI) number, shall register such IMEI number of such equipment imported into India for sale or testing or research or for any other purpose, with the Central Government, prior to the import of such equipment into India, in the form as may be specified for such purpose on the portal. (3) No person shall — (a) intentionally remove, obliterate, change, or alter the unique telecommunication equipment identification number; or (b) intentionally use, produce, traffic in, have control or custody of, or possess hardware or software related to the telecommunication identifier or telecommunication equipment, knowing it has been configured as specified above.

A person within a period of thirty days from the date of issuance of the order, represent to the Central Government in writing, with reasons why such action should not be taken.

The Central Government shall, after examination of the information received under sub-rule (1) of the Telecommunications (Telecom Cyber Security) Rules, 2024, identify the telecommunication identifier, the use of which is alleged to have endangered telecom cyber security and the person to whom such telecommunication identifier has been issued, by the telecommunication entity, and issue a notice to such person, with details thereof.

As per Rule 4 of Telecommunications (Telecom Cyber Security) Rules, 2024: (1) No person shall – (a) endanger telecom cyber security; or (b) send any message which adversely affects telecom cyber security. (2) Without prejudice to the generality of sub-rule 4(1), no person shall endanger telecom cyber security by misuse of telecommunication equipment or telecommunication identifier or telecommunication network or telecommunication services or by – (a) fraud, cheating or personation; (b) transmitting any message which is fraudulent; (c) committing or intending to commit any security incident; (d) engaging in any other use which is contrary to the provision, of any other law for the time being in force; or (e) any other means which may have security risk on telecom cyber security.

Every telecommunication entity shall appoint a Chief Telecommunication Security Officer who shall be a citizen and resident of India, and responsible to the Board of Directors or similar governing body of the telecommunication entity.