CGA Mandatory Security Guidelines for PFMS Users 2026: Order Issued (Feb 2026)

The Controller General of Accounts (CGA) has issued a critical security alert for all Public Financial Management System (PFMS) users. Vide Office Memorandum No. V-12025/5/2025-PFMS/C.N. 18742 dated 05 February 2026, the Ministry of Finance has mandated a strict “Cyber Hygiene” protocol. All Program Divisions (PDs), Drawing & Disbursing Officers (DDOs), and Data Operators must immediately adhere to these new guidelines to prevent unauthorized access and potential financial fraud.

The “Cyber Hygiene” Protocol: What Changed?

Until now, many departmental users treated PFMS login credentials casually, often sharing passwords between “Makers” and “Checkers” to expedite bill processing. This practice is now explicitly flagged as a security violation. The new order comes in the wake of increased cyber-attack risks targeting government financial infrastructure.

Audit Warning: Sharing of user credentials (User ID/Password) or OTPs with colleagues, even for “official work,” is now a punishable lapse. If a fraudulent transaction occurs from an ID used by multiple people, the registered owner of the ID will be held solely responsible under the CGA Inquiry Rules Vigilance Order 2026 PEO PO Guidelines.

DDO & Data Operator Checklist (Mandatory)

Section Officers and AAOs managing the PFMS terminals must ensure the following “Do’s and Don’ts” are strictly enforced in their sections. This is not just an IT advisory; it is an operational directive.

The order specifically highlights the risk of “Remote Access” tools. Installing software like AnyDesk or TeamViewer on a dedicated PFMS terminal is strictly prohibited unless authorized by the NIC/PFMS technical team for troubleshooting.

System Security & Bill Processing Impact

Non-compliance with these guidelines may lead to the disabling of user IDs without prior notice. For DDOs, this means a potential halt in bill generation and payment processing.

For more technical details on e-bill prerequisites, refer to the PFMS e-Bill Mandatory Prerequisites CGA Order 2026. Failure to secure the system can be treated as “Administrative Negligence” in future inspections.