CISA's Order on Unsupported Edge Devices: Cyber Risks, Corporate Liability, and Legal Remedies in India

The United States Cybersecurity and Infrastructure Security Agency (CISA) recently issued a binding operational directive mandating federal agencies to disconnect and purge unsupported, End-of-Life (EoL) edge devices from their networks. Edge devices—ranging from network firewalls, virtual private network (VPN) gateways, and routers to remote access controllers—sit directly at the perimeter of an organization's digital boundary. When manufacturers discontinue firmware updates and security patches, these hardware components become open doors for sophisticated cyber threat actors.

While CISA directives technically govern US federal systems, the systemic risk they address is global. In India, corporate networks, critical infrastructure entities, financial service providers, and small and medium-sized enterprises (SMEs) across commercial hubs like Mumbai, Thane, and Navi Mumbai routinely run obsolete hardware perimeter defenses.

This article examines the legal and operational ramifications of running unsupported edge devices in India, exploring regulatory obligations under the Information Technology (IT) Act, 2000, new criminal provisions under the Bharatiya Nyaya Sanhita, 2023 (BNS), and practical steps for victims in the Mumbai Metropolitan Region (MMR) to seek legal recourse.

Understanding the Threat: Why Edge Devices Are Under Siege

Edge devices serve as the gateway between external public networks (the internet) and an enterprise's secure internal network. Historically, corporate security focused heavily on endpoint protection (such as antivirus software on workstations). Attackers have adapted by targeting edge appliances directly.

When a device reaches its "End-of-Life" or "End-of-Support" date:

No Security Patches: Vendors no longer develop or push updates for newly discovered vulnerabilities.
Firmware Exploitation: Attackers reverse-engineer legacy firmware to deploy zero-day or known exploits, bypassing firewalls entirely.
Stealth and Persistence: Malicious actors establish initial access brokers (IABs), install web shells, and move laterally across corporate networks without triggering internal host-based detection tools.

If an unsupported firewall or VPN appliance in an office in Bandra-Kurla Complex (BKC) or Wagle Estate, Thane, is compromised, the breach does not stop at the device—it compromises proprietary data, employee databases, and consumer personal information.

Indian Regulatory Framework: Cyber Compliance and Negligence

In India, treating cyber hygiene as an optional IT matter rather than a legal compliance obligation creates substantial liability for directors and key managerial personnel.

1. CERT-In Directions (April 2022) Under Section 70B

The Indian Computer Emergency Response Team (CERT-In), operating under Section 70B of the Information Technology Act, 2000, imposes stringent compliance mandates on all Indian bodies corporate:

Mandatory 6-Hour Reporting: Entities must report specified cyber security incidents—including unauthorized access to IT systems/networks, compromise of critical systems, and identity theft—to CERT-In within six hours of noticing them.
Log Retention: Organizations must maintain system logs securely within Indian jurisdiction for a rolling period of 180 days.
Failure to Comply: Non-compliance with CERT-In directions attracts criminal penalties under Section 70B(7) of the IT Act, which carries imprisonment up to one year, a fine up to ₹1,00,000, or both.

2. Reasonable Security Practices (Section 43A, IT Act) & The DPDPA, 2023

Under Section 43A of the IT Act, read with the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, a company that handles sensitive personal data and fails to implement reasonable security practices is liable to pay damages by way of compensation to affected individuals.

Continuing to deploy unsupported network edge hardware after official deprecation or critical vulnerability advisories can be construed as a failure to maintain "reasonable security practices."

Furthermore, under Section 8(5) of the Digital Personal Data Protection Act, 2023 (DPDPA), data fiduciaries must protect personal data in their possession or control by taking reasonable security safeguards to prevent personal data breaches. Penalties under the DPDPA for failure to adopt adequate safeguards can reach up to ₹250 crore.

Criminal Provisions: Cyber Crimes Under the IT Act and BNS 2023

When an unauthorized party exploits an edge device to penetrate an Indian network, several penal provisions are engaged:

Provisions Under the Information Technology Act, 2000

Section 43: Civil liability for unauthorized access, downloading, extracting data, or introducing malware into a computer system.
Section 66: Criminal penalty for hacking and computer-related offenses (imprisonment up to 3 years or fine up to ₹5,00,000).
Section 66C & 66D: Identity theft and cheating by personation using a computer resource.

Provisions Under the Bharatiya Nyaya Sanhita, 2023 (BNS)

The BNS, which replaced the Indian Penal Code (IPC) effective July 1, 2024, applies to offenses involving digital deception and system infiltration:

Section 316 (Criminal Breach of Trust): Applicable if internal personnel or outsourced IT vendors knowingly expose network perimeters by refusing to retire decommissioned hardware, leading to misappropriation.
Section 318 (Cheating): Where unauthorized access facilitates corporate fraud, spoofing, or diversion of corporate funds.
Section 303 / 305 (Theft): Prosecuted in conjunction with the IT Act where electronic records or intangible property are extracted and stolen.

Procedural matters surrounding the search, seizure, and chain of custody for volatile memory and digital evidence extracted from edge devices are now regulated under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) and the admissibility of electronic records under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (BSA).

How Victims in Mumbai, Thane, and Mira Road Can Report and Seek Redress

If your organization discovers an unauthorized intrusion originating from an edge device, immediate legal and forensic steps are necessary.

Step 1: Secure and Preserve Digital Evidence

Do not immediately factory-reset or power off the edge device. Doing so destroys volatile RAM evidence. Work with a qualified incident response team to capture forensically sound disk images, routing tables, and access logs in compliance with Section 63 of the BSA (former Section 65B of the Indian Evidence Act).

Step 2: Lodge a Complaint on the National Cyber Crime Reporting Portal

File an immediate report at cybercrime.gov.in or call the national cyber financial fraud helpline at 1930 if funds were siphoned.

Step 3: Approach Dedicated Cyber Police Stations in the MMR

Victims located in Mumbai, Thane, or Mira Road should register an FIR with their jurisdictional cyber crime police station:

Mumbai: The Mumbai Police operates specialized cyber police stations, including the BKC Cyber Police Station (for western/central corporate jurisdictions) as well as regional cyber cells across North, South, and Eastern regions.
Thane: The Thane Cyber Crime Police Station, located near the Commissioner of Police Office, manages offenses across Thane City, Wagle Estate, and surrounding industrial belts.
Mira-Bhayandar / Vasai-Virar (MBVV): The MBVV Cyber Crime Police Station handles offenses originating in Mira Road, Bhayandar, and adjacent areas.

Step 4: Adjudication Under Section 46 of the IT Act

For civil recovery of damages arising from an intrusion (e.g., vendor negligence or targeted hacking), victims can file an adjudication petition before the Adjudicating Officer under the IT Act (typically the Principal Secretary of the Information Technology Department, Government of Maharashtra, located at Mantralaya, Mumbai). This statutory forum possesses powers to award financial compensation up to ₹5 crore.

Actionable Checklist for Businesses in Maharashtra

Hardware Inventory: Audit all perimeter equipment (firewalls, routers, VPN concentrators). Identify hardware past its End-of-Life (EoL) or End-of-Support date.
Immediate Isolation: Disconnect unsupported appliances from external exposure; migrate critical access routes to supported zero-trust architectures.
Review Vendor SLAs: Ensure third-party managed service providers (MSPs) contractually guarantee the timely decommissioning of legacy hardware.
Maintain Incident Logging: Retain verifiable firewall logs for at least 180 days in compliance with CERT-In directives.

Frequently Asked Questions (FAQs)

1. Does CISA's directive directly apply to private companies in India?

No. CISA directives apply strictly to US federal civilian executive branch agencies. However, CISA directives establish globally recognized benchmarks for network defense. In Indian regulatory or civil proceedings, failure to address widely publicized hardware vulnerabilities can be cited as evidence of negligence under Section 43A of the IT Act or the DPDPA, 2023.

2. What is the statutory time limit to report an edge device compromise to CERT-In?

Under the April 2022 CERT-In cybersecurity directions, all commercial entities and service providers must report covered incidents (including unauthorized access to systems or infrastructure) within six hours of becoming aware of the incident.

3. Can our company seek financial compensation if a cyber attack succeeds through an outdated device?

If the breach was enabled by the gross negligence of an external IT vendor who contracted to provide secure infrastructure, you may initiate proceedings for damages before the Adjudicating Officer (IT Act) in Maharashtra or pursue civil/commercial arbitration. However, if your own organization failed to act on hardware warnings, contributory negligence may limit civil recovery against third parties.

4. Which police station in Mira Road or Thane handles corporate cyber intrusion complaints?

For Mira Road, corporate and individual victims fall under the MBVV Cyber Crime Police Station. For Thane, matters are addressed at the Thane Cyber Crime Police Station at the Police Commissionerate. Serious corporate breaches involving high financial stakes or intellectual property theft are handled by dedicated cyber officers.

Consult APS Law for Cyber Incident Response & IT Compliance

Navigating a network compromise requires rapid coordination between technical containment and legal reporting. A procedural misstep—such as mishandling digital evidence or failing to file timely CERT-In intimations—can expose an organization to severe regulatory penalties.

APS Law advises businesses, startups, and individuals across Mumbai, Thane, and Mira Road on cyber law compliance, data protection frameworks, regulatory incident disclosures, and cyber litigation.

If your organization requires a cyber compliance audit, vendor contract review, or assistance with an active breach investigation, contact APS Law today to schedule a confidential legal consultation.