(a) whether the Common Criteria Recognition Arrangement Clearance is not adequate to certify
global telecom gear used in the country;
(b) if so, the details thereof;
(c) whether the Government proposes to put in place a mechanism to test the standards for
telecom gear in the country;
(d) if so, the details thereof; and
(e) the corrective measures taken by the Government to put a testing standard for telecom gear
to protect the potential cyber attack?
THE MINISTER OF STATE IN THE MINISTRY OF COMMUNICATIONS AND INFORMATION TECHNOLOGY
(SHRI MILIND DEORA )
(a) & (b) Madam, the Common Criteria Recognition Arrangement clearance based testing do not
address the security requirement of the national concerns as Common Criteria Testing is a
process based testing and largely addresses the security concerns of communication from
commercial point of view. Further, Common Criteria testing is limited to Information Technology
(IT) & IT related products whereas there are many other network elements in telecom network for
which Common Criteria testing has no test standard and testing mechanism. The telecom equipment
are governed by the 3rd Generation Partnership Programme (3GPP) & 3Gpp2 standards. However, it
has been decided to give due cognizance to the testing already carried out under Common Criteria
Recognition Arrangement while security certifying the equipment likely to be inducted into
telecom network, if it meets the national security objectives.
(c) to (e) The Government has decided to set up Telecom Testing and Secutity Certification
Centre to develop systems, processes, adopt/develop security standards, test tools, etc., for
telecom equipment security testing and certification. Based on these standards, processes and
tools, the Centre can accredit the test labs for security testing and certification of telecom
equipment used by various Telecom service Providers. Such test labs can be set up/established
under private or public or joint venture entity. Pilot lab has already been established at
Indian Institute of Science (IISc), Bangaluru to develop processes, tools and standards for
security testing and certification in respect of telecom equipment.