DoT revamps security certification for fibre broadband devices

The National Centre for Communication Security under the Department of Telecommunications has introduced a risk-based security certification framework for Passive Optical Network Optical Network Terminal (ONT) devices, a critical component of India’s fibre broadband infrastructure.

Earlier, manufacturers were required to conduct full security testing for every ONT product variant, even when multiple models shared the same System-on-Chip (SoC) and core software stack. Industry portfolios often include 10–20 variants derived from a single platform, resulting in extended approval timelines and higher compliance costs with limited incremental security benefit.

Under the revised framework, mandatory security testing will now be conducted once per unique SoC–SDK platform. Manufacturers may introduce additional ONT variants on the same certified platform through certificate modification and updated Self Declaration of Conformity (SDoC). Any change to the SoC or SDK will continue to require full re-testing, ensuring platform-level security integrity.

The shift reflects NCCS’s assessment that the primary security risk in ONT devices lies at the hardware and core software layer, while variant-level changes have minimal impact on overall security posture.

“By aligning security testing with actual risk points, this framework can reduce certification timelines from months to weeks for derivative models without weakening telecom security,” said Rishikesh Mishra, CEO, JR Compliance.

The revised framework applies exclusively to PON ONT devices; all other telecom equipment categories remain governed by existing ITSAR requirements.
BCS Bureau