National Critical Information Infrastructure Protection Centre

The National Critical Information Infrastructure Protection Centre (NCIIPC) is India's national nodal agency for protecting computer resources whose failure could seriously harm essential national interests. Its statutory mandate under Section 70A of the Information Technology Act, 2000 covers all measures, including research and development, relating to the protection of critical information infrastructure.

Statutory basis and meaning of critical infrastructure

The Information Technology Act, 2000 provides the legal foundation for NCIIPC's mandate.

• Section 70A empowers the Central Government to designate, through notification in the Official Gazette, a government organisation as the national nodal agency for critical information infrastructure protection.
• The explanation to Section 70 defines critical information infrastructure as a computer resource whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health or safety.
• The statutory definition therefore turns on the consequences of a computer resource's failure, rather than merely its size, ownership or technological sophistication.

Protection, coordination and technical support

The NCIIPC Rules, 2013 elaborate how the Centre performs its functions. Its role combines preventive protection, technical guidance and coordination across organisations responsible for critical systems.

• It works to protect critical information infrastructure against unauthorised access, modification, use, disclosure, disruption, incapacitation or destruction through coordination and situational awareness.
• It identifies critical infrastructure elements for consideration by the appropriate government for notification as protected systems.
• It collects, analyses and forecasts threats to critical information infrastructure and provides early warnings and alerts to relevant stakeholders.
• It develops protective plans, policies, guidelines and methodologies, and supports the adoption of standards and practices by infrastructure owners.
• Its mandate includes research and development, capacity building and cooperation with relevant national and international organisations.

Relationship with protected systems and CERT-In

NCIIPC's specialised infrastructure-protection role should be distinguished from the legal power to notify protected systems and from the broader incident-response role of CERT-In.

• Under Section 70, the appropriate government may notify a computer resource directly or indirectly affecting critical information infrastructure as a protected system; NCIIPC's identification role does not replace this notification.
• CERT-In, under Section 70B, is the national agency for cyber incident response, whereas NCIIPC's mandate specifically concerns critical information infrastructure protection.