From Strong Passwords to Multi-Factor Authentication: Delhi Government Steps Up Cybersecurity Measures

New Delhi: The Delhi government is taking proactive steps to strengthen cybersecurity across its departments and safeguard sensitive government data from growing cyber threats. Key measures include mandatory strong passwords, multi-factor authentication for access to sensitive systems, regular security audits of websites and applications, appointment of Assistant Chief Information Security Officers, and restrictions on the use of third-party email platforms.

The Department of Information Technology has issued detailed guidelines to all departments, local bodies, boards, and commissions to tighten cybersecurity protocols and ensure the protection of official IT infrastructure.

Unified Data Hub Under Protection

The initiative comes as the government expands its digital infrastructure and creates centralized databases for various welfare schemes. The guidelines emphasize that any breach could compromise administrative credibility, sensitive information, and service delivery. Delhi holds vast amounts of personal and household data—covering names, addresses, family details, income, education, profession, caste, and age—collected across multiple departments.

This data is being integrated into a unified data hub, centralizing records from departments such as Food & Civil Supplies, Revenue, Delhi Jal Board, Power, Trade & Tax, and Municipal Bodies. The goal is to create a “golden record” for beneficiaries, eliminate duplication, and streamline welfare delivery.

Strict Directives for Departments

Officials have stressed that robust data protection mechanisms are essential to safeguard public privacy, prevent misuse, and maintain trust in digital governance. Departments have been instructed to appoint an Assistant Chief Information Security Officer as a single point of contact for cybersecurity coordination.

The advisory cautions against opening anonymous links, suspicious websites, or email attachments and mandates the use of only official NIC email IDs for communication. Third-party platforms are prohibited for official work. Departments are barred from using pirated software and are required to install and regularly update antivirus systems. All devices, operating systems, software, and SSL certificates must be kept up to date to address vulnerabilities.

Access Controls and Incident Reporting

Departments are instructed to implement strong passwords and enable multi-factor authentication for sensitive systems. Password sharing is prohibited. Employees must log off systems before leaving, maintain a full inventory of IT infrastructure, and conduct regular data backups according to policy. Any cybersecurity incidents must be immediately reported to the National Cybercrime Helpline (1930) or via email to incident@cert-in.org.in and incident@nic-cert.nic.in.

This advisory has been circulated to all Additional Chief Secretaries, Principal Secretaries, Secretaries, Department Heads, Local Bodies, Boards, and Commissions under the Delhi government.