Telecommunication companies are avoiding audits due to their high cost.

        Telecom service providers in Nepal are reportedly choosing to pay penalties rather than undergo external information system audits as required by the Cyber Security Bylaw 2020. This bylaw mandates both internal and external audits for service providers to ensure cybersecurity compliance. However, the service providers claim that the cost of the external audit is significantly higher compared to the penalty for not conducting one.

According to sources, the cost of an external audit by certified auditors ranges from Rs600,000 to Rs1.2 million, whereas the penalty for non-compliance is only Rs50,000. Despite warnings about the risks to data privacy and security, telecom service providers are requesting amendments to the bylaw to remove the requirement for external audits due to its stringency.

The Nepal Telecommunications Authority and the Internet Service Providers Association Nepal have received requests from service providers to modify the bylaw. Officials have expressed sympathy for the service providers' concerns and have indicated their intention to amend the bylaw.

Critics argue that bypassing external audits puts data security at risk and undermines the purpose of the Cyber Security Bylaw 2020. External audits involve certified auditors assessing information systems for breaches, leaks, and overall data security measures. The audits are crucial for identifying vulnerabilities and ensuring the protection of sensitive information.

Despite these concerns, some service providers, such as Ncell, claim to prioritize cybersecurity and data privacy. However, the debate continues, with smaller service providers expressing financial constraints that make it difficult for them to comply with the costly external audit requirement.

In response to the situation, the government has formed a high-level panel to draft a report aimed at implementing a comprehensive cybersecurity policy. The ongoing discussions between regulators, service providers, and other stakeholders will likely shape the future landscape of cybersecurity regulations in Nepal.