CBSE Cybersecurity Lapses in On-Screen Marking System: Governance and Data Privacy Concerns

Hindustan Times - India · 7 Jun 2026 · 2 min read
Prelims · Polity Mains · GS2 Governance High relevance

Coempt Edu Teck submitted expired and misrepresented cybersecurity certificates to CBSE for its On-Screen Marking (OSM) system, which later revealed critical vulnerabilities exposing student data, raising serious governance and privacy issues.

Key points

Coempt Edu Teck submitted two cybersecurity certificates to CBSE for its OSM system tender, both of which were either expired or misrepresented, failing to meet procurement standards.

Prime Infoserv LLP certificate from November 2023 was nearly two years old when submitted in August 2025, and its validity had lapsed as per its own terms.

A3S Tech & Company certificate from October 2025 audited a different application (OneX) in a pre-production environment, not the actual CBSE deployment, indicating a lack of proper validation.

CERT-In acknowledged critical vulnerabilities in the OSM system to a parliamentary panel, including unauthorized access to student marks, answer scripts, and evaluator banking details.

SQL injection attack vulnerability allowed researcher Tirth Parmar to gain administrator-level access to sensitive databases, exposing systemic security failures in Coempt's software.

[GS2-Governance] This incident highlights systemic flaws in government procurement processes, where inadequate verification of vendor claims can compromise critical systems.

[GS3-Security] The data breaches underscore India's weak cybersecurity infrastructure, particularly in educational institutions handling sensitive student information.

Way Forward: CBSE must implement mandatory third-party audits for all IT procurements, establish a dedicated cybersecurity compliance cell, and enforce stricter penalties for vendor misrepresentation to prevent future lapses.

Key terms

On-Screen Marking (OSM)

A digital evaluation system where examiners mark answer scripts electronically. For UPSC, its governance implications include transparency concerns, technological reliability, and data privacy issues under the Digital Personal Data Protection Act 2023.

SQL Injection Attack

A code injection technique that exploits vulnerabilities in database-driven applications, allowing unauthorized access. Relevant for GS3 (security) as it demonstrates India's cybersecurity challenges in critical systems like education and finance.

Government Procurement Rules

The framework regulating public sector purchases, including technical qualifications and vendor compliance. For UPSC, this connects to GS2 governance reforms, transparency in tendering, and accountability mechanisms to prevent fraud.

CERT-In

The Indian Computer Emergency Response Team (CERT-In) is the national nodal agency for cybersecurity under MeitY, mandated to handle cyber threats and advisories. Its role is critical for UPSC as it intersects with GS3 (security) and GS2 (governance) topics, particularly in digital infrastructure protection.