Resources Categories
INDUSTRY FACT FILE · GOVERNMENT, PSUS & PUBLIC DIGITAL SERVICES
Market Landscape and the Drivers of Cybersecurity Demand in Government and PSUs
The business, technology, regulatory, legal and statutory forces that create audit, testing, monitoring, privacy and incident-readiness work for ministries, state governments, PSUs, data centres and government technology providers.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: CERT-In, NCIIPC, GIGW, MeitY cloud and DPDP 5. Legal and statutory drivers 6. How the drivers differ by entity type 7. What this means for buyers and for Codec Networks |
1. Market landscape
The public sector is the largest single buyer of technology in India and one of the largest buyers of cybersecurity services. Central ministries and their offices, 28 states and eight union territories, hundreds of central and state public-sector enterprises, thousands of municipal bodies, public hospitals and universities, and the national platforms that serve them all run digital systems. Purchasing runs through the Government e-Marketplace, which recorded a gross merchandise value of about ₹5.4 lakh crore in 2024-25, through e-tenders and through NICSI for NIC-supported projects. Tenders for security audits commonly require bidders to hold current CERT-In empanelment, and NICSI has empanelled CERT-In empanelled agencies for comprehensive security audits of applications, so empanelment status is often the first filter a vendor must pass.
Demand follows five pressures. Incidents: CERT-In handled more than 29.44 lakh cyber incidents in 2025, and AIIMS New Delhi, Kudankulam, Oil India and the Madhya Pradesh e-Nagarpalika portal showed that ransomware, malware and data corruption reach the heart of public services. Rules: CERT-In's 2023 guidelines for government entities set six-monthly internal and yearly third-party audits and a dedicated CISO function, its Directions set six-hour reporting, and its 2025 audit policy expects risk-based audits including OT. Platforms: cloud migration, digital public infrastructure and mobile apps multiply the number of systems that need testing before and after launch. Privacy: DPDP brings standards for processing by the State from May 2027. Capacity: MeitY's Cyber Surakshit Bharat programme had trained more than 1,500 CISOs and frontline IT officials by early 2024, but most entities still rely on external auditors, SOC providers and incident responders for depth.
|
₹5.4 lakh crore GeM gross merchandise value in 2024-25 |
231 Audit organisations empanelled by CERT-In (2025) |
29.44 lakh Cyber incidents handled by CERT-In in 2025 |
May 2027 Most DPDP obligations, incl. safeguards, take effect |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Central ministries and departments |
CISO-led programmes, NIC-hosted systems, procurement through NICSI, GeM and tenders |
Guideline audits, application audits, email security, SOC, awareness |
|
State governments |
State IT departments and agencies, state data centres, many department portals |
Audit programmes, portal and API testing, SOC, DPDP readiness |
|
Central PSUs |
Board-governed, often listed, IT and OT estates, tender-based buying |
Comprehensive and OT audits, ISO 27001, SOC, threat hunting |
|
State PSUs and utilities |
Mixed legacy and modern systems, constrained budgets, regulator oversight |
Infrastructure VAPT, OT reviews, recovery testing, managed SOC |
|
Data centres and government clouds |
Shared hosting for many departments; MeitY cloud empanelment |
Infrastructure and cloud audits, inventory, patching, 24x7 monitoring |
|
GovTech providers and platforms |
Integrators and platform teams under contract security clauses |
Secure SDLC, application testing, vendor audits, ISO 27001 |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Keeping citizen services running |
Outages at hospitals, portals or treasuries become public events |
Segmentation, backups, SOC, incident response |
|
Meeting the audit cycle |
Six-monthly internal and yearly third-party audits under the 2023 guidelines |
Audit programmes, VAPT, closure tracking |
|
Launching portals and apps |
Security audit expected before hosting and after major change |
Application, mobile and API testing, retests |
|
Answering auditors and legislators |
CAG observations and Parliament questions after incidents |
Gap assessments, evidence packs, Board reporting |
|
Protecting plants and networks |
PSU plants and utilities depend on OT and SCADA |
OT assessments, segmentation, monitoring |
|
Holding vendors to account |
Integrators and AMC providers have privileged access |
Vendor audits, contract clauses, privileged access reviews |
|
Protecting citizen data |
Scraping and leaks damage trust and invite fraud |
DPDP programmes, API testing, monitoring |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Government clouds and data centres |
Shared infrastructure, tenant misconfiguration, flat networks |
Cloud and data-centre reviews, segmentation, SOC |
|
Citizen portals and APIs |
Broken authorisation, scraping, injection flaws |
Application and API VAPT, rate limiting, retests |
|
Mobile apps and messaging channels |
Insecure apps, fake apps, impersonation |
Mobile app testing, brand and app-store monitoring |
|
e-Office and government email |
Spear-phishing and credential theft of officials |
Email security, MFA, phishing simulation, SOC |
|
PSU plant OT and SCADA |
Remote access, legacy controllers, IT–OT convergence |
OT assessments, IEC 62443 gap analysis, monitoring |
|
Data platforms and AI |
Large central databases and new analytics tools |
Data security reviews, access controls, AI risk review |
Figure 3: The four groups of drivers behind cybersecurity spending in government and the public sector.
4. Regulatory drivers: CERT-In, NCIIPC, GIGW, MeitY cloud and DPDP
|
Instrument |
Key requirements |
|
CERT-In Guidelines on Information Security Practices for Government Entities (2023) |
Nominated CISO and dedicated security team; internal audits every six months and third-party audits at least yearly, with CERT-In empanelled auditors available; controls for network, identity, applications, data, cloud and outsourcing |
|
CERT-In Directions (2022) and audit guidelines (2025) |
Six-hour incident reporting; 180-day ICT logs in India; risk-based independent audits covering infrastructure, applications, cloud and OT |
|
IT Act Sections 70 and 70A; NCIIPC |
Notified protected systems in government, strategic and public enterprises, power, telecom, transport and BFSI receive NCIIPC guidance and controls |
|
GIGW 3.0 (2023) |
Quality, accessibility, lifecycle and cybersecurity requirements for government websites and apps, developed with STQC and CERT-In; compliance assessed by STQC-empanelled labs |
|
MeitY cloud empanelment |
Empanelled cloud services audited by STQC, with data hosted in India, for government workloads |
|
DPDP Act 2023 and Rules 2025 |
Standards for processing by the State and its instrumentalities; possible exemptions for notified instrumentalities; security safeguards and breach intimation; most obligations from May 2027 |
|
Confirm applicability Obligations depend on the type of entity, ministry or state orders, any NCIIPC notification, listing status for PSUs and the contracts under which vendors operate. Confirm against the official instruments and your orders. |
Figure 4: Policy and regulatory timeline shaping government and PSU cybersecurity, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
IT Act, 2000 and CERT-In Directions |
Incident reporting, logging and offences against computer systems, applicable to government organisations |
SOC, logging, audits and incident response |
|
IT Act Sections 70, 70A and 70B |
Protected systems, NCIIPC and CERT-In's statutory powers |
Protected-system controls, audits, monitoring |
|
DPDP Act, 2023 and Rules, 2025 |
Personal data of citizens, beneficiaries and employees processed by the State |
Privacy programmes, data maps, safeguards |
|
Right to Information Act, 2005 |
Public authorities maintain and disclose records |
Records integrity, classification and access controls |
|
Official Secrets Act, 1923 |
Protection of classified official information |
Need-to-know access, insider controls, investigations |
|
General Financial Rules and CVC guidelines |
Transparent, competitive and accountable procurement |
Tender-ready, auditable security engagements |
|
Companies Act, 2013 and SEBI LODR (listed PSUs) |
Board risk responsibility; quarterly cyber incident disclosure |
Board reporting, incident records |
6. How the drivers differ by entity type
|
Entity type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Ministries and departments |
Service continuity, audit observations |
e-Office, email, NIC-hosted portals |
CERT-In 2023 guidelines, Directions, GIGW |
|
State governments |
Citizen services, public trust |
State data centres, portals, apps |
CERT-In guidelines, GIGW, DPDP |
|
Central PSUs |
Production, contracts, reputation |
ERP, plant OT, procurement portals |
CERT-In, NCIIPC if notified, SEBI LODR |
|
State PSUs and utilities |
Billing, supply continuity |
Billing, SCADA, consumer apps |
CERT-In, sector regulators, NCIIPC |
|
Data centres and clouds |
Uptime for many departments |
Virtualisation, SWAN, cloud consoles |
MeitY empanelment, CERT-In |
|
GovTech providers and platforms |
Contract renewal, vendor scrutiny |
Code, CI/CD, hosting access |
Tender clauses, DPDP as processor, CERT-In |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“Our six-monthly internal audit is due and the annual third-party audit is pending.” |
Audit programme against CERT-In's 2023 guidelines with a CERT-In empanelled auditor |
Recurring audit cycle and closure tracking |
|
“The new scheme portal goes live next month.” |
Pre-hosting application, mobile and API security audit |
Retests after every major release |
|
“We were told to report incidents within six hours, but nobody watches at night.” |
Managed SOC with reporting playbooks |
24x7 monitoring and an IR retainer |
|
“Our hospital servers sit on the same network as everything else.” |
Segmentation and ransomware-readiness review |
Backup testing and annual exercises |
|
“Hundreds of old websites are hosted in our data centre.” |
Asset inventory, external exposure scan and decommissioning plan |
Continuous exposure and defacement monitoring |
|
“How does DPDP apply to our beneficiary database?” |
DPDP gap assessment with data map and vendor contract review |
Annual privacy review and breach workflow drills |
|
“Our plant network was never assessed.” |
OT assessment and IT–OT segmentation review |
Periodic OT audits and monitoring |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal or regulatory advice. Obligations differ by type of entity, ministry or state instructions, any NCIIPC notification, tender and contract terms and the data each organisation handles; confirm them against the official CERT-In, MeitY, NCIIPC, NeGD, STQC and Data Protection Board instruments and your own orders and agreements.