The scale explains why this is no longer an ordinary education-department issue. CBSE’s own 9 February 2026 circular said the Board conducts Class X and XII examinations annually for nearly 46 lakh students in India and across 26 countries. For 2026, CBSE decided to introduce On-Screen Marking for Class XII answer books, while Class X evaluation would continue physically. The official promise was efficiency, transparency, reduced manual intervention, lower transportation time and elimination of totalling errors.
NEET operates on a different but equally high-stakes plane. NTA’s 2026 information bulletin describes NEET-UG as the common national entrance test for undergraduate medical education, including MBBS, BDS and AYUSH-linked courses. NTA scheduled NEET-UG 2026 for 3 May in pen-and-paper mode. Reports citing NTA state-wise data put the candidate base at about 22.7 lakh aspirants, with Uttar Pradesh, Maharashtra, Rajasthan and Bihar alone accounting for roughly 41% of the pool. The exam fee structure itself shows the operating scale: domestic fees range from ₹1,000 for SC/ST/PwBD/third-gender candidates to ₹1,700 for general candidates. A simple fee-envelope calculation on 22.7 lakh registrations places the gross candidate-fee pool somewhere between ₹227 crore and ₹386 crore before accounting for category mix, refunds or operating cost.
This is not a small administrative service. It is a national allocation engine. Board marks decide university eligibility, scholarships and family planning. NEET decides entry into the country’s medical education funnel. When such systems fail, the cost is not limited to re-exams or revised marksheets. It hits coaching cycles, counselling calendars, college admissions, travel costs, mental health and household finances.
NEET Is the Front-End Failure: Custody, Leakage and Re-Test Risk
The NEET-UG 2026 episode is the clearest example of the old examination problem in its most expensive modern form. NTA’s 12 May 2026 press release stated that, based on inputs examined with central agencies and investigative findings shared by law-enforcement agencies, the 3 May NEET-UG examination could not be allowed to stand. NTA cancelled the exam with the approval of the Government of India and said the matter had been referred to the Central Bureau of Investigation for a comprehensive inquiry.
The operational consequences were immediate. NTA’s 15 May public notice scheduled the re-examination for 21 June 2026, again in pen-and-paper mode, in 13 languages. It carried forward candidates’ registration data, candidature and examination centres, said no fresh registration would be required, and said no additional fee would be levied. It also allowed address and exam-city updates because many candidates would have moved between the original test and the retest.
That is the visible cost of a front-end breach. The hidden cost is larger. A cancelled national medical entrance exam forces millions of students to restart peak preparation. Coaching centres must re-run revision calendars. Families must rearrange travel and accommodation. Medical counselling authorities must protect the seat matrix and admission timelines. State governments are pulled into facilitation. In Delhi, for instance, the political response included free bus travel for NEET re-test candidates. What begins as a breach in the chain of custody becomes a full public-administration event.
The Supreme Court’s response also shows the limits of instant technological fixes. On 1 June, the Court declined to direct that the 21 June re-test be shifted to computer-based mode at that late stage. That refusal is important. It shows that “make it digital” is not a remedy that can be ordered into existence during a live national crisis. Computer-based testing requires centre capacity, device hardening, invigilation design, candidate familiarity, network redundancy, accessibility planning and failure protocols. A badly rushed digital system can simply exchange one type of leakage risk for another type of platform risk.
CBSE is that warning made concrete.
CBSE Is the Back-End Failure: When the Marking Platform Becomes the Weakest Link
CBSE’s On-Screen Marking system was supposed to solve the classic problems of physical evaluation. Students still wrote physical answer books. Those books were scanned. Human examiners evaluated the scanned copies on a computer. The system automatically totalled marks, linked question-wise marks to the marking scheme and allowed review by Additional Head Examiners and Head Examiners.
CBSE’s OSM FAQ makes clear that the Board did not treat this as a casual technology switch. It says OSM had first been conceptualised in 2014 but was not continued because answer books then could not be scanned without cutting them, raising the risk of page mix-ups. For 2026, CBSE said book scanners made it possible to scan answer scripts without cutting the spine or de-threading them. It described a scanning chain involving regional offices, first-level quality checks, a dedicated quality-control team, evaluator rejection of poor scans, rescanning where required and barcode-linking checks to ensure that scanned booklets were clear, complete and correctly mapped.
The Board also described a large training operation. Its FAQ says teachers received webinars, individual online training, practice with five answer books, mass mock evaluation, guides, videos, doubt-clearing sessions and hand-holding. It says a mass mock evaluation was conducted on 26 February in five slots for teachers across India, and that a live webcast on exam modalities and OSM drew about 4 lakh online views. It also says marking schemes for all 116 Class XII subjects were uploaded on the OSM portal and provided physically.
On paper, this looks like a serious rollout. In practice, the controversy suggests the actual risk was not whether OSM as a concept was sound. It was whether the system was audited, procured, secured and tested like critical public infrastructure before being used on a national board exam. CBSE’s own OSM materials show that the operational risk did not sit only in scanning quality. It sat in identity and access management. The Board required schools to ensure basic digital readiness: computer labs, public static IPs, Windows 8 or higher, browsers, Adobe Reader, reliable internet and uninterrupted power. Its FAQ says login credentials for examiners were generated from teacher data available on the OASIS portal. It also says principals were given an OSM dashboard to monitor which teachers had logged in, who had completed mock evaluation, and to correct teacher details so credentials could be delivered properly.
That is a very different risk map from the public debate around “blurred scans”. Once answer books are digitised, the decisive questions become: whether the right examiner got the right access, whether credentials were properly issued, whether weak or stale school data created misrouting risk, whether static IP controls were meaningful, whether logins were rate-limited, whether role-based permissions prevented excess access, and whether every view, annotation, edit, rejection and submission created an immutable audit trail. The scanner turns paper into image. The identity layer decides who can touch the future of the student.
Two Teenagers Found the Governance Gap
The damaging part of the CBSE episode is that the challenge did not come first from a formal audit. It came from students.
Seventeen-year-old Sarthak Sidhant, a Class XII student from Jharkhand, published an investigative blog alleging that CBSE’s tender terms for OSM were rewritten in ways that favoured Coempt EduTeck, the vendor linked to the digital evaluation infrastructure. His claims, as reported in the cluster, focused on alleged dilution of tender requirements and process changes across multiple points. Later reporting by The Times of India added a procurement wrinkle: Coempt allegedly edged past Tata Consultancy Services in the technical evaluation and secured the contract with a significantly lower financial bid, intensifying scrutiny of tender design.
Nineteen-year-old ethical hacker Nisarga Adhikary attacked the system from the other end. He claimed he had accessed the OSM portal and could read, write and edit answer-sheet-related documents. He also alleged that sensitive student examination data was exposed through insecure cloud storage and that personally identifiable student information may have been processed through automation scripts linked to Google Gemini. The Hindu’s technology editor, in the supplied cluster, framed the alleged Gemini trace as a data-sovereignty issue because the claim implied that student data may have been passed into an AI system with servers outside India.
CBSE disputed aspects of the hacking claim, including by saying earlier that some circulated material related to a testing environment rather than the live evaluation portal. But by 31 May, the Board stated that vulnerabilities in the OnMark portal of its service provider had been contained and that cybersecurity professionals from government agencies and IITs were being deployed to fortify the system and rule out other exploitable weaknesses.
That sequence is the institutional problem. Whether every allegation is ultimately proven or not, the episode created a public perception that students had stress-tested the system before the state had convincingly demonstrated that it had done so.
The Tender Question Is Not a Side Issue. It Is the Business Model of Risk.
The procurement dispute matters because exam technology is not ordinary software outsourcing. In a consumer app, a bad release can be patched. In a national exam system, a bad release can disturb admissions, trigger litigation and permanently damage trust in a credential.
The core procurement question is not whether the lowest bidder should lose merely for being cheap. It is whether the scoring model priced operational risk correctly. A vendor that offers a lower financial bid may deliver obvious savings. But if the tender does not adequately weight cyber maturity, cloud architecture, incident-response history, secure software development, access-control design, independent audit rights, data localisation, audit logs, disaster recovery, indemnities and breach penalties, the public authority may simply be buying a cheaper failure mode.
That is the operator’s view of the CBSE controversy. The visible contract is for scanning and digital evaluation. The invisible contract is for legitimacy. The vendor is not just serving files to examiners. It is holding a national trust ledger: answer books, student identifiers, examiner access, marks, scripts, annotations, uploads, logs and grievance outcomes.
The tender economics sharpen the governance question. Coempt quoted roughly ₹24.8–₹25.7 per answer booklet, while TCS quoted ₹53–₹65. Bid value of about ₹384.6 crore for Coempt against nearly ₹951.3 crore for TCS — a gap of around ₹566 crore. That is not a marginal saving. It is the kind of delta that can dominate a Quality-and-Cost-Based Selection model once financial scores are weighted.
The technical scores were close. Reported tender records put Coempt at 91 out of 100 and TCS at 89. Business Today reported that the decisive technical gap came from prior experience specifically in scanning and distributing subjective answer scripts for digital evaluation, where Coempt received full marks and TCS scored zero, even as TCS scored higher in the technical presentation and live demonstration segment and received full marks for turnover. This is the procurement crux: the tender appears to have rewarded narrow exam-scanning experience more heavily than enterprise-scale systems-integration capacity. That may be defensible on paper. But for nearly 9.9 million Class XII answer books, the public test is whether narrow domain experience was enough to underwrite national-scale platform trust.
This is why the Coempt-versus-TCS angle is commercially significant. TCS is one of India’s largest enterprise technology service providers. Coempt is far less publicly visible at that scale. If a smaller or lower-cost vendor wins, the procurement file must be especially strong on risk controls. The public should not need to infer competence from post-crisis assurances. The tender itself should show how risk was tested before award.
The most uncomfortable due-diligence issue is not just Coempt’s current performance. It is the adverse-event file around the same corporate identity and its predecessor name, Globarena Technologies. Times of India’s Hyderabad reporting has linked the company to the 2019 Telangana Intermediate results fiasco, where an expert committee reportedly found “systemic failures, procedural collapse, and glaring negligence”. The same report said the project involved the results of 8.7 lakh students, that no formal agreement had been signed, that the system operated on a work order, and that the software had shown faults months before results were declared. It also reported specific result anomalies, including missing Geography practical marks in 531 cases, “AP” appearing instead of marks in 496 cases, and single-digit mathematics marks for 4,288 MEC students.
A separate Times of India Nagpur report said Coempt was under scrutiny at Nagpur University after taking over preliminary and post-examination work under a three-year ₹5 crore contract. The report said more than 3.17 lakh students were affected, over 1,200 winter examinations faced delays, more than 300 students filed complaints, and 60% of major-course results missed the 45-day deadline. Coempt has contested allegations in that matter and due process is continuing. But from a public-procurement standpoint, the issue is not conviction. It is risk disclosure. A national examination tender should require a bidder to submit a litigation-and-performance schedule covering prior result failures, blacklisting allegations, name changes, contract cancellations, pending criminal proceedings, regulatory notices and court disputes. Without that, a tender committee is underwriting price without underwriting history.
The Cloud and AI Questions Are the New Paper Leak
The traditional paper leak is easy for the public to understand. A physical paper leaves custody before the exam. The digital version is more technical but not less serious. An exposed storage bucket, weak authentication, misconfigured access permissions, leaked credentials or unsafe API call can produce the same outcome: unauthorised access to examination material.
In a scanning-and-evaluation architecture, cloud risk is not peripheral. It sits at the centre of the workflow. Answer books must be scanned, uploaded, stored, assigned, accessed, evaluated, reviewed and retrieved. Every step creates a permission layer. Who can view? Who can edit? Who can download? Who can delete? Who can trigger rescanning? Who can reassign an answer book? Who can see personally identifiable data? Who can access logs? Who can override roles?
If AI tools are added to that workflow, even for automation or quality assurance, the governance burden rises sharply. Student answer books are not generic documents. They are educational records tied to minors and young adults. Under India’s Digital Personal Data Protection framework, systems processing personal data must have lawful basis, security safeguards and processor accountability. For public exam bodies, that means vendor contracts must be able to answer four basic questions: what data is processed, where it is stored, who can access it and whether any third-party AI or cloud service touches it.
The CBSE controversy has forced these questions into the open. It is no longer enough to say that the marks were human-evaluated. The system must also show that the digital environment around that human evaluation was secure.
Student Relief Is Necessary but Not Sufficient
CBSE has now opened a formal route for affected students. Its 2 June press release said the portal for verification of issues in supplied scanned copies and re-evaluation of answers would remain open from 2 June to midnight on 6 June. The facility is available only to students who obtained scanned copies of their evaluated answer books. The fee is ₹100 per answer book for verification of issues and ₹25 per question for re-evaluation.
The categories of issues listed by CBSE are revealing. Students may apply for missing pages, missing supplementary sheets, missing maps or graphs, blurred pages, incorrect answer books or evaluation against a different set. These are not minor clerical anxieties. They go to the authenticity and completeness of the record that forms the basis of a student’s marks.
The low fee is a useful corrective, particularly after earlier concerns over post-result costs. But a grievance window resolves individual errors. It does not answer the systemic question. If 100 students are corrected, that does not prove the system was robust. If 1,000 students are corrected, that may prove the opposite. CBSE therefore needs to publish aggregated data after the process: number of applications, issue categories, subjects involved, accepted corrections, rejected claims, mark changes and root causes. Without that data, the Board will be asking students to trust the same black box they are challenging.
The Law Has Moved, but the Infrastructure Has Not Caught Up
India has already recognised the exam-integrity problem legislatively. The Public Examinations (Prevention of Unfair Means) Act, 2024 was brought in to deter paper leaks and organised malpractice in public examinations. Its statutory schedule expressly includes examinations conducted by the National Testing Agency, and the law’s objects speak of delays and cancellations affecting millions of youth. The statute also covers service-provider-related risks in the conduct of public examinations.
But the CBSE episode shows that the next layer of reform cannot be only criminal law. Punishment after a breach does not build secure architecture before a breach. The harder task is pre-emptive governance: procurement standards, mandatory third-party audits, penetration testing, vulnerability disclosure, red-team exercises, data-protection impact assessments, cloud-configuration certification, escrow of logs and real-time incident protocols.
NEET needs better custody, centre selection and question-paper security. CBSE needs platform assurance, vendor governance and digital-chain integrity. Together, they show that India’s examination problem is no longer a single leak to be plugged. It is an end-to-end operating system to be rebuilt.
What a Serious Reset Would Look Like
A serious examination reset would begin by treating high-stakes exams as critical public infrastructure. That means three changes.
First, exam bodies should publish pre-launch audit certificates for major technology transitions. These need not reveal sensitive security details. But they should confirm that independent experts tested authentication, access control, cloud storage, encryption, logging, backup, disaster recovery and incident response.
Second, procurement should move from lowest-cost compliance to risk-weighted evaluation. Large exam-tech tenders should include cyber warranties, breach indemnities, mandatory sub-vendor disclosure, audit rights, source-code review rights, data-localisation commitments and blacklisting triggers. The public authority should know not only who won the bid, but why that vendor was operationally fit for the risk being assumed.
Third, students need a protected disclosure and grievance architecture. If a student finds a vulnerability, the first path should not be a viral blog or social-media escalation. It should be a responsible disclosure channel with acknowledgement, safe-harbour conditions, technical triage, defined timelines and independent escalation. The fact that teenagers became the most visible auditors of a national exam platform is not charming. It is an indictment of the audit design.
Why This Matters
The CBSE controversy matters because it expands the meaning of exam integrity. For years, India’s anxiety was that papers could leak before the exam. NEET shows that risk remains alive. CBSE now shows that digitisation creates a second anxiety: records can become suspect after the exam.
That distinction matters for every exam body in India. Digital systems can reduce human error, speed up evaluation and make audits easier. But only if they are designed for auditability from the start. Otherwise, digitisation merely moves opacity from sealed trunks and evaluation rooms to cloud buckets, dashboards, credentials and APIs.
For students, the fairness question is brutally simple. Did I receive the right paper? Was my answer book evaluated correctly? Was my data secure? Did anyone else have unauthorised access? Can I verify the record without fighting the institution?
For the state, the question is more strategic. Can India run the world’s largest education allocation systems with the same rigour that financial institutions apply to payments, banks apply to customer data and exchanges apply to trading systems? Until the answer is yes, every reform will carry the same risk: it may modernise the interface without hardening the institution.
CBSE’s OSM crisis is therefore not just a board-exam controversy. It is the digital half of India’s examination reckoning. NEET exposed the fragility of paper custody. CBSE has exposed the fragility of platform trust. Together, they show that the future of merit in India will depend not only on how students perform, but on whether the systems judging them can finally prove that they deserve to be trusted.
.svg)
Politics
Economy
Business
World
Defence
Law & Justice
Science & Technology
Rida Prime
About us