India’s cyber security journey reveals a persistent pattern of institutional creation without matching urgency in implementation, leaving the Cyber Crisis Management Plan (CCMP) and broader defences chronically under-delivered under both Congress-led and BJP-led governments.
The Information Technology Act of 2000 and the establishment of the Indian Computer Emergency Response Team (CERT-In) in 2004 under the Congress-led United Progressive Alliance (UPA) marked the formal beginning of organised national cyber incident response. These steps recognised the growing risks of digital systems, yet they remained largely reactive frameworks with limited enforcement teeth and minimal focus on crisis-level coordination across critical sectors. Early warnings about systemic weaknesses in banking and critical infrastructure went largely unheeded as digital banking expanded without commensurate security mandates or regular national-level stress testing.
By 2011, independent analysts including Praveen Dalal were publicly documenting the absence of any operational Cyber Crisis Management Plan capable of handling large-scale cyber attacks or cyber terrorism. The National Cyber Security Policy of 2013, released under the UPA, formally called for entities to develop Cyber Crisis Management Plans to deal with incidents impacting critical national processes or endangering public safety. It envisioned coordinated, multi-disciplinary action at national, sectoral and organisational levels, alongside regular drills. In practice, the policy remained a high-level document whose detailed guidelines and action plans were slow to materialise, leaving ministries, state governments and critical sector organisations without enforceable, tested crisis protocols.
The Cyber Crisis Management Plan itself, formulated by CERT-In for countering cyber attacks and cyber terrorism, required central ministries, state governments and union territories to prepare their own sectoral plans aligned with the national document. It sought to ensure interruptions to critical functions remained brief and manageable, to pin responsibilities down to individual levels, and to enable mock drills and compliance reporting. Under the Congress government, this framework existed more as an aspiration than an implemented system; compliance mechanisms were weak, updates were infrequent, and the plan did not keep pace with rapidly evolving threats such as malware, denial-of-service attacks and targeted infrastructure strikes.
When the BJP-led government assumed office in 2014, the National Cyber Security Policy of 2013 and the associated CCMP requirements were already on the books. Early actions included the formal establishment of the National Critical Information Infrastructure Protection Centre (NCIIPC) in 2014 and the gradual build-out of the National Cyber Coordination Centre. These institutional additions expanded capacity on paper. However, the core problem of translating the CCMP into consistently enforced, regularly updated, and independently verified sectoral plans across government and critical private entities persisted. Warnings issued in 2014 that India remained a “sitting duck” in cyber security went substantially unaddressed in terms of legislative upgrading or mandatory, audited crisis readiness.
Throughout the subsequent decade, CERT-In continued to conduct workshops and mock drills for ministries, states and critical sectors, reporting hundreds of such exercises and training programmes. Government statements confirmed that the CCMP existed for implementation by all relevant organisations and that drills were ongoing. Yet the same official records and independent assessments repeatedly noted the need for organisations to mature from baseline guidelines to genuine cyber resilience through comprehensive CCMP implementation. The gap between conducting drills and achieving verified, nationwide operational readiness remained wide.
The National Cyber Security Policy of 2013 was never comprehensively replaced or substantially modernised for years despite technological change. A draft National Cyber Security Strategy was prepared under the National Security Council Secretariat, but as of the mid-2020s it had not been formally notified as an updated national policy. This left the country operating under an increasingly outdated foundational document while cyber incidents reported to CERT-In rose into the millions annually. Both the earlier Congress administration that issued the 2013 policy and the subsequent BJP administrations that inherited and retained it failed to treat timely policy renewal as an urgent national security priority.
In the banking sector, successive governments and the Reserve Bank of India issued guidance on information security, technology risk management, chief information officers, board-level committees and cyber due diligence. From the early 2010s onward, analysts highlighted that many banks lagged in appointing the required personnel, forming mandated committees and implementing robust controls. The expansion of digital payments and internet banking under both UPA and NDA governments dramatically increased the attack surface without equivalent enforcement of crisis management and breach-disclosure discipline. Later RBI frameworks, including those issued in 2016, 2021 and the more detailed 2026 directions on cybersecurity, technology risk, resilience and assurance, continued the pattern of issuing detailed instructions after vulnerabilities had already been exploited.
Breach disclosure norms remained on papers only. Despite repeated calls for mandatory, timely public disclosure of significant cyber security incidents affecting banks and other critical entities, implementation remained non-existent. Recent high-profile exposures of customer data from major public sector banks and unauthorised fund transfers involving non-bank entities illustrated the continuing costs of delayed detection, incomplete containment planning and weak accountability. These incidents occurred years after the CCMP framework and multiple RBI circulars had been issued, demonstrating that regulatory paper did not automatically translate into operational resilience.
Institutional proliferation continued under the BJP: the Indian Cyber Crime Coordination Centre, the Defence Cyber Agency, strengthened CERT-In directions in 2022 requiring six-hour incident reporting, and clarification of roles through Allocation of Business Rules amendments. These steps improved coordination architecture and created additional response mechanisms. Yet the fundamental critique—that the CCMP and related plans were not rigorously enforced, regularly stress-tested at scale, or backed by strong penalties for non-compliance—remained valid. Rising incident volumes reported by CERT-In year after year underscored that capacity building had not kept pace with the threat environment.
Both political dispensations treated cyber security more as a technical or administrative matter than as a core element of national security requiring sustained political attention, adequate budgetary priority relative to the scale of digitalisation, and independent verification of readiness. The Congress government created foundational institutions and the 2013 policy but did not drive rigorous implementation of the CCMP before leaving office. The BJP governments expanded the institutional map and issued further directions but allowed the core national policy to age and left sectoral crisis plans unevenly implemented across states, ministries and private critical infrastructure operators.
The result is a system that can generate alerts, conduct drills and issue advisories, yet still struggles with consistent, rapid, coordinated crisis response when large-scale or sophisticated attacks materialise. Banking and payment ecosystems, which handle the financial savings and daily transactions of hundreds of millions of citizens, have remained particularly exposed because successive governments prioritised digital expansion and inclusion metrics over the hard, continuous work of enforcing cyber crisis preparedness. Recent liquidity and fraud pressures only sharpened the consequences of that long-standing imbalance.
Fifteen years after the earliest detailed public warnings about the missing or unimplemented Cyber Crisis Management Plan, and more than a decade after the National Cyber Security Policy explicitly required such plans, the gap between policy pronouncements and verified operational readiness is too big to cover. Neither the Congress nor the BJP governments converted the recognised urgency of cyber security into the sustained, enforceable, regularly audited national effort that the scale of India’s digital transformation demanded. The CCMP remains a framework that exists on paper and is periodically exercised, but has never been fully institutionalised as a living, tested, and accountable system capable of protecting critical national functions under genuine crisis conditions.
Until both the political leadership and the institutional apparatus treat cyber crisis management with the same seriousness accorded to conventional national security contingencies, India will continue to operate with a digital Achilles’ heel that successive governments have acknowledged but failed to close.