Core Viewpoint - India's government has introduced new cybersecurity standards for telecom IoT devices, mandating manufacturers to provide access to source code for security reviews, as outlined in the Indian Telecom Security Assurance Requirements (ITSARs) [1][5]. Group 1: Government Standards and Requirements - The ITSARs published by the National Centre for Communication Security (NCCS) on March 5, 2026, require that source code be made available for review at designated locations [1][3]. - The draft version of ITSAR includes a variety of devices, such as anonymous feedback devices and kiosks, indicating a broad scope of application [2]. - The NCCS, established in 2018, is responsible for developing and implementing a framework for telecom equipment security testing and certification in India [3]. Group 2: Industry Response and Concerns - There is ongoing debate regarding the government's request for source code access, with industry representatives expressing concerns about intellectual property rights and the feasibility of sharing proprietary code [4][7]. - Current ITSAR documents are not yet implemented, and there is no formal request for secure source code at this time, according to industry experts [6][7]. - The expectation of achieving 'zero vulnerability' in software is deemed unrealistic, as vulnerabilities can arise from usage and software updates [11]. Group 3: Security Assessment Processes - The security assessment process includes maintaining a Technical Construction File (TCF) to ensure hardware integrity and prevent unauthorized access [12]. - A thorough review of the bill of materials (BOM) is conducted to validate the integrity of components and their origins, ensuring they come from trusted sources [12]. - Existing vulnerability assessment reports already include known vulnerabilities and mitigation plans, indicating that a structured process for addressing security issues is in place [14].