SecurityIndia

NISPG 2019 v5.0

Organise information-security responsibilities across government work

Connect approved policies, responsible owners and evidence for information-security reviews.

Full title
National Information Security Policy and Guidelines (NISPG)
Issued by
Ministry of Home Affairs, Government of India
Version
Version 5.0, 2019
Applies to
Government ministries, departments and their organisations, and those handling government information on their behalf where required
Nature
Government policy and guidelines. Not a public certification scheme.
Access
The full document is marked Restricted and is made available to authorised government users through official channels

Overview

What NISPG is

The National Information Security Policy and Guidelines is the Ministry of Home Affairs’ baseline information security policy for government. It was prepared to raise the security posture of organisations that hold government information, including classified information, drawing on existing security standards, frameworks and global practice. Netra lists Version 5.0 of 2019.

NISPG sets a minimum standard, not a ceiling. Ministries, departments and their organisations are expected to implement it, and nothing in it stops an organisation from applying stricter measures. It covers how information is classified and handled, how information security is organised and governed within a ministry, and the baseline controls expected across the main areas of security, from networks and access to incident management.

Unlike most frameworks on Netra, the full text of NISPG is not a public document. It carries a Restricted marking and is circulated to authorised users through government channels. This page therefore describes NISPG only at the level that is publicly reported. Detailed requirements must be taken from the copy issued to your organisation, together with your ministry’s or department’s own instructions.

NISPG is usually applied alongside other government obligations, such as the CERT-IN directions on incident reporting, log retention and time synchronisation, and CERT-IN’s guidelines on information security practices for government entities.

Who it applies to

NISPG is relevant to:

  • Ministries and departments of the Government of India
  • Attached and subordinate offices, agencies and autonomous bodies
  • Public sector undertakings handling government information
  • e-Governance projects run by or for government bodies
  • Technology partners, system integrators and service providers that handle government information, where the ministry or department applies NISPG to them

Whether and how NISPG applies to a particular organisation or contract is decided by the ministry or department concerned. Confirm it with them before planning work.

Structure

What NISPG covers

This is a summary of the broad areas publicly associated with NISPG. It does not reproduce the document’s structure, section numbers or control text, which are available only to authorised users.

Foundation

Purpose, scope and classification

NISPG sets out a baseline policy for protecting government information across its life cycle, at all levels of the organisations it covers. It includes guidance on classifying information and on how information of each classification should be handled.

Governance

Organisation of information security

Sets out how information security is organised within government bodies, with senior leadership accountability, a designated security officer and defined responsibilities for policy, oversight and compliance.

Security areas

Baseline security across the organisation

NISPG sets baseline expectations across the main areas of information security for government systems and information, together with guidance on particular technologies and on security practices such as testing and audit. The specific areas, their grouping and the controls within them are set out in the authorised document and are not reproduced here.

Implementation roadmap

How to implement it, step by step

A practical route for a government body, or a partner working under its instructions. Detailed requirements come from the authorised copy of NISPG and departmental instructions.

  1. 1

    Obtain the authorised text and instructions

    Get the current NISPG version and any departmental security instructions through official channels, and confirm who may see them.

    OutputsAuthorised copyAccess list
  2. 2

    Confirm scope and applicability

    Agree with the ministry or department which offices, systems, projects and partners are in scope.

    OutputsScope note
  3. 3

    Set up governance

    Appoint the security roles and oversight structure your authorised copy and departmental instructions require, and give each security area an owner.

    OutputsAppointment ordersRole assignments
  4. 4

    Classify information and map systems

    Classify the information held and identify the systems that process it, so controls can be matched to classification.

    OutputsInformation classificationSystem inventory
  5. 5

    Assess gaps and implement controls

    Compare current practice with the baseline in each security area, record gaps with owners and dates, and implement the controls.

    OutputsGap assessmentRemediation plan
  6. 6

    Audit, review and improve

    Run security testing and audits, track findings to closure, and review policies as required by the document and departmental instructions.

    OutputsAudit reportsCorrective actions

Audit and evidence guide

What auditors look for, and the evidence to keep

NISPG is not a public certification scheme and no certificate is issued against it. Conformity is reviewed through the ministry’s or department’s own oversight, internal and external audits, and any reviews the government directs.

What reviewers look for

  • Use of the authorised, current version of NISPG and departmental instructions
  • Security roles appointed and the governance structure in place
  • Information classified and handled according to its classification
  • An owner and a current status for each security area
  • Access and privilege management in practice
  • Security testing and audit findings tracked to closure
  • Incident monitoring and reporting, including to CERT-IN
  • Partner and vendor obligations set out in contracts

Related timelines

Reporting listed cyber incidents to CERT-INWithin 6 hours
ICT log retention within India (CERT-IN)Rolling 180 days
Internal ICT audit, CERT-IN 2023 guidelinesEvery 6 months
External audit, CERT-IN 2023 guidelinesAnnually

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Governance

  • Appointment orders for security roles
  • Oversight meeting minutes
  • Role assignments

Classification

  • Information classification register
  • Handling procedures

Controls

  • Access reviews
  • Vulnerability and patch records
  • Monitoring and incident records

Assurance

  • Security testing reports
  • Audit reports
  • Corrective action tracker

Partners

  • Contract security clauses
  • Vendor assessments
  • Confidentiality undertakings

Areas that often need attention

  • Teams working from an old or unofficial copy of the document
  • Security roles appointed in name, without the authority or team to act
  • Information not classified, so handling rules cannot be applied
  • Security obligations not passed on to vendors and system integrators
  • Audit findings recorded but not closed
  • Sensitive material shared outside authorised environments while preparing evidence

How Netra helps

Where each part of the work lives in Netra

Netra helps organise NISPG work where the organisation is permitted to do so: owners, tasks, policy reviews and evidence, held under appropriate access controls.

Each security area owned and tracked

Task Engine

Approved requirements are loaded as tasks with owners and due dates, and recurring tasks keep reviews current.

Status for each area

Compliance Centre

Status is derived from completed tasks and evidence, never typed in.

Policy reviews

Policy Hub

A policy library generated at onboarding, with a score that moves as the work behind each policy is completed.

Risk treatment

Risk Manager

A risk register with inherent and residual heatmaps, with risks reduced as linked tasks are completed.

Systems in scope

Asset Management

Assets linked to tasks, so teams can see which systems each piece of work covers.

Audits and corrective actions

Audit Centre

Run internal audits and reviews end to end with findings and corrective actions, with evidence in a tamper-evident vault.

Netra organises work and evidence. It does not issue NISPG certification or government approval, does not by itself establish compliance, and does not supply the NISPG text. Classified or sensitive material should be handled only in environments and processes your organisation has authorised.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

CERT-IN Guidelines

Keep incident-readiness and record-keeping work organised

Security

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

Security

NIST SP 800-53

Organise a tailored security and privacy control programme

See NISPG 2019 v5.0 in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.