MeitY Mandates Enhanced AI Cyber Defenses and OEM Guidelines Across Government Entities

In a crucial move to safeguard India's digital landscape, the Ministry of Electronics and Information Technology (MeitY) has issued a directive to all central ministries, state governments, and regulatory bodies to immediately reassess and enhance their cybersecurity readiness. This comes in response to the rapidly evolving threat landscape posed by Artificial Intelligence (AI)-enabled cyberattacks. MeitY Secretary S Krishnan, in a letter dated June 10, emphasized the transformative impact of generative AI, large language models, and autonomous agents on cybersecurity, necessitating a shift from periodic security checks to continuous exposure management and rapid remediation. The directive specifically urges the implementation of recommendations from CERT-In's 'Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure,' published on May 25. This blueprint advocates for patching vulnerabilities within 12 hours for internet-facing and "crown-jewel" systems and within one day for critical externally exposed vulnerabilities. Additionally, MeitY has mandated the circulation of newly released 'Guidelines for Original Equipment Manufacturers (OEMs),' dated June 10, to technology vendors across all sectors. These guidelines require OEMs and technology providers to regularly audit their products for security flaws, maintain updated Software Bill of Materials (SBOMs), promptly disclose critical vulnerabilities, and accelerate the release of security patches. The overarching goal is to fortify the resilience of India's digital systems and information and communication technology (ICT) infrastructure against sophisticated cyber threats, ensuring a robust and secure digital environment.