Open data from BitScore
Two datasets, both free to use and free to quote. One tracks what Indian regulators have actually issued; the other counts what is actually happening.
Most numbers in Indian cyber security reporting cannot be checked. They arrive without a window, without a method, and without the underlying rows. These two can be: each is published as a file, under a licence that lets you use it, with the rule that produced every value written down beside it.
Both are free to use under CC BY 4.0. Attribution is the only condition — credit bitscore.in and link back to the dataset page.
Indian Cyber Regulation Register
Every cyber and data-protection instrument binding Indian regulated entities — reference, date, status, deadlines. Read at source; downloadable as JSON and CSV. 25 instruments from six regulators, each carrying its own reference number, its issue date, whether it is in force, any deadline it sets, and the date somebody last opened the regulator’s own notification to check. Last updated .
- Read the register — the full table, with the method and the source for every entry.
- india-cyber-regulations.json — one object per instrument, deadlines nested.
- india-cyber-regulations.csv — the same rows flattened for a spreadsheet.
- schema.json — JSON Schema for one record, so you can validate rather than guess.
India Threat Scorecard
A monthly count of publicly observable cyber threat activity affecting organisations in India, across 23 industry verticals. Aggregate data only; no organisations are named. The same 23 verticals and the same counting rules every month, so this month’s figure for your sector means something against last month’s. 1 edition published so far; a published edition never changes.
- Read the scorecard — the current grid, the archive, and the method behind the bands.
- latest.json — always the current edition, at a URL that does not change.
- schema.json — JSON Schema for one edition.
- Per-edition JSON and CSV are linked from each edition’s own page.
Using them
Every file is served with permissive cross-origin headers, so you can fetch it straight from a browser or a notebook without proxying it first. Nothing here is rate-limited, gated or behind a form.
If you publish something built on either dataset, we would like to see it — and if you find an entry that is wrong, tell us and we will re-read the source. The register carries a verification date per row precisely so that a stale entry is visible rather than assumed.