**Executive Summary**
This document addresses an unstarred question in Lok Sabha regarding cyberattacks faced by Government websites since 2014, due to be answered on December 17, 2025. It outlines the Government's efforts to ensure a secure cyberspace and mitigate cybersecurity risks. The response emphasizes initiatives undertaken by the Indian Computer Emergency Response Team (CERT-In) and other measures to prevent cyber threats, including regular security audits and awareness programs.
**Key Points / Main Content**
* **Government Policy:** The Government aims to ensure a secure and trustworthy cyberspace through active risk mitigation measures.
* **CERT-In's Role:** CERT-In is the national agency for responding to cybersecurity incidents under the Information Technology (IT) Act, 2000. They issue advisories and remedial measures.
**Cybersecurity Initiatives:**
* **National Cyber Coordination Centre (NCCC):** Implemented by CERT-In to examine cyberspace for cybersecurity threats and share information.
* **Cyber Swachhta Kendra (CSK):** A CERT-In service that includes a Botnet Cleaning and Malware Analysis Centre, providing free tools and cybersecurity tips.
* **Cyber Security Audit Policy Guidelines:** CERT-In issued comprehensive guidelines in July 2025, mandating annual cybersecurity audits.
* **Empaneled Auditors:** CERT-In has empanelled 231 security auditing organizations to support Information Security Best Practices implementation.
* **Cybersecurity Audits:** CERT-In and NCIIPC conduct cybersecurity audits under the IT Act, 2000. All Government websites and applications are audited for cybersecurity before and after hosting.
* **Cybersecurity Drills:** CERT-In regularly conducts cybersecurity mock drills for preparedness assessment.
* **Threat Intelligence:** CERT-In operates an automated cyber threat intelligence exchange platform.
* **Alerts and Advisories:** CERT-In issues ongoing alerts and advisories on cyber threats/vulnerabilities and countermeasures.
* **Cyber Crisis Management Plan:** CERT-In has formulated a Cyber Crisis Management Plan for countering cyber attacks and cyber terrorism.
**Impact Analysis**
**Stakeholder: Government Websites and Applications**
* **Impact:** Subject to regular cybersecurity audits before and after hosting.
* **Action Required:** Adhere to cybersecurity audit requirements and guidelines.
**Stakeholder: Central Government Ministries/Departments, State Governments, and Critical Sectors**
* **Impact:** Required to implement the Cyber Crisis Management Plan.
* **Action Required:** Implement the Cyber Crisis Management Plan to counter cyber attacks and cyber terrorism.
**Stakeholder: Organizations and Citizens**
* **Impact:** Benefit from cybersecurity tips and tools provided by the Cyber Swachhta Kendra (CSK).
* **Action Required:** Utilize available cybersecurity resources and adhere to best practices.
**Stakeholder: Security Auditing Organizations**
* **Impact:** Have the opportunity to be empanelled by CERT-In to support and audit implementation of Information Security Best Practices.
* **Action Required:** Participate in the empanelment process to provide auditing services.
Key Entities Referenced
CERT-In: Indian Computer Emergency Response Team, designated as the national agency for responding to cyber security incidents.
Information Technology Act, 2000: Legal framework under which CERT-In operates; Section 70B is specifically referenced.
Ministry of Electronics and Information Technology: The primary ministry responsible for addressing cyberattacks on government websites.
National Cyber Coordination Centre (NCCC): Initiative implemented by CERT-In to detect cyber security threats in the cyberspace.
Cyber Swachhta Kendra (CSK): A citizen-centric service provided by CERT-In, extends the vision of Swachh Bharat to the Cyber Space.
GOVERNMENT OF INDIA
MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY
LOK SABHA
UNSTARRED QUESTION NO. 2844
TO BE ANSWERED ON: 17.12.2025
CYBERATTACKS FACED BY GOVERNMENT WEBSITES
2844. MS. MAHUA MOITRA:
Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:
(a) the number of incidents of cyberattacks faced by Government websites since 2014, year-wise;
(b) the top ten Government websites that have faced the most number of cyber attacks since 2014,
website-wise;
(c) the details of loss to the exchequer (in Rs.) as a result of these cyberattacks, since 2014, year-wise;
(d) the top ten cyberattacks on Government websites in terms of citizens affected since 2014 including
the details of the websites; and
(e) the number of cyberattack instances since 2014 where data lost could not be recovered, year and
website-wise including the number of citizens affected?
ANSWER
MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY
(SHRI JITIN PRASADA)
(a) to (e): The policies of the Government of India aim to ensure a secure and trustworthy
cyberspace while taking active measures to mitigate risk to India’s digital infrastructure.
With the advancement of technology and increasing use of digital infrastructure for businesses and
services, cyber-attacks pose threats to the confidentiality, integrity and availability of data and
services.
The Indian Computer Emergency Response Team (CERT-In) is designated as the national agency
for responding to cyber security incidents under the provisions of section 70B of the Information
Technology (IT) Act, 2000.
The impact of cyber incidents varies based on the nature and duration of service disruption. On
reporting of incidents, CERT-In issues advisories and remedial measures to the affected
organisations.
Further, the Government has undertaken following initiatives to prevent cyber threats including
cyberattacks faced by Government websites, which inter alia includes:
1. National Cyber Coordination Centre (NCCC), implemented by CERT-In, examines the
cyberspace to detect cyber security threats. It shares the information with concerned
organizations, state governments and stakeholder agencies for taking action.2. Cyber Swachhta Kendra (CSK)
• A citizen-centric service provided by CERT-In, which extends the vision of Swachh
Bharat to the Cyber Space.
• It is a Botnet Cleaning and Malware Analysis Centre and helps to detect malicious
programs and provides free tools to remove the same.
• It also provides cyber security tips and best practices for citizens and organisations.
3. CERT-In has developed and issued a Comprehensive Cyber Security Audit Policy
Guidelines in July 2025 with the strategy to carry out cyber security audits in a consistent, effective,
and secure manner across sectors. As per the guidelines, cyber security audit should be conducted
at least once in a year.
4. CERT-In has empanelled 231 security auditing organizations to support and audit
implementation of Information Security Best Practices.
5. CERT-In and National Critical Information Infrastructure Protection Centre (NCIIPC) carry
out cybersecurity audits under Information Technology Act, 2000 and Rules made thereunder.
6. All the Government websites and applications are audited with respect to cyber security prior
to their hosting. The auditing of the websites and applications is conducted on a regular basis after
hosting also.
7. Cyber security mock drills are conducted regularly by CERT-In, to enable assessment of
cyber security posture and preparedness of various organisations.
8. CERT-In operates an automated cyber threat intelligence exchange platform for sharing
tailored alerts with organisations across sectors for proactive threat mitigation.
9. CERT-In issues alerts and advisories regarding latest cyber threats/vulnerabilities and
countermeasures to protect computers, mobile phones, networks and data on an ongoing basis.
10. CERT-In has formulated a Cyber Crisis Management Plan for countering cyber attacks and
cyber terrorism for implementation by all Ministries/ Departments of Central Government, State
Governments and their organizations and critical sectors.
*****