Rule, 2014

Text

Reproduced from the document India Code holds for this instrument. The Gazette prints Hindi and English side by side and this is the English; the Department's own PDF remains the authority.

NOTIFICATION

New Delhi, ihe 16lh January, 2014

G.S.R. 19(E).- In exercise of ihe powers conferred by clause (zc) of sub-section (2) of Seclion 87. read wilh sub-section (3) of section 70A of the Information Technology Act, 2000 (21 of 2000). the Central Government hereby makes the following rules, namely:-

1. Short title and Commencement.— (1) These rules may be called the Information Technology (National Critical Information Infrastructure Protection Centre and Manner of Performing Functions and Duties) Rules, 2013.

(2) They shall come into force on the date of their publication in the Official Gazette.

2. Definitions.— (I) In these rules, unless the context otherwise requires, -

(a) "Act" means Information Technology Act, 2000 (2 i of 2000);

(b) "Appropriate Government" means appropriate Government as defined in clause (e) of sub-section (I) of seclion 2 of the Act;

(c) "Body Corporate" means body corporate as defined in Explanation (I) to section 43A of the Act;

(d) "Critical Information Infrastructure" means Critical Information Infrastructure as defined in Explanation to sub-section (1) of section 70 of the Act;

(e) "Critical Sector" means sectors, which are critical to the nation and whose incapacitation or destruction will have a debilitating impact on national security, economy, public health or safety; (0 "Indian Computer Emergency response Team" means the Indian Computer Emergency Response Team notified under sub-section (I) of section 70B of the Act;

(g) "Intermediary" means an intermediary as defined in clause (w) of sub-section (I) of section 2 of the Act;

(h) "Nodal Officers" means officer(s) nominated by the appropriate Governments) and its agencies, body corporates, and other entities in the designated critical sectors, who shall inform, cooperate with and support the designated Nodal Agency or its units as and when required for the protection of Critical Information Infrastructure and associated protected systems;

(i) 'Technical Centre" means technical units of the National Critical Information Infrastructure Protection Centre or critical sectorfs) or of the appropriate Governments and its agencies, which shall work cohesively in synergistic manner with the National Critical Information Infrastructure Protection Centre for the protection of Critical Information Infrastructure.

(2) Words and expressions used in these rules but not defined and defined in the Act shall have the same meaning as is assigned to them in the Act.

3. (1) National Critical Information Infrastructure Protection Centre (hereinafter referred to as NCIIPC) shall be the national nodal agency designated under section 70A of the Act in respect of Critical Information Infrastructure Protection and shall function at the address to be notified.

(2) National Critical Information Infrastructure Protection Centre shall be a part of and under the administrative control of the National Technical Research Organisation (NTRO),

(3) National Critical Information Infrastructure Protection Centre shall function on a twenty-four-hour basis on all days of the year including Government holidays. The address and other contact details of NCIIPC $Hall be published on its website.

(4) National Critical Information Infrastructure Protection Centre constituency shall be the Indian critical information infrastructure as notified by the Government from time to time and excluding those notified under the Ministry of Defence.

4. Functions and duties of the National Critical Information Infrastructure Protection Centre.— The functions and duties of the National Critical Information Infrastructure Protection Centre shall be the following, namely:-

(1) National Critical Information Infrastructure Protection Centre shall function as the national nodal agency for all measures to protect nation's critical information infrastructure.

(2) The National Critical Information Infrastructure Protection Centre shall essentially protect and deliver advice that aims to reduce the vulnerabilities of critical information infrastructure, against cyber terrorism, cyber warfare and other threats.

(3) Identification of all critical information infrastructure elements for approval by Ihe appropriate Government for notifying ihc same.

(4) Provide strategic leadership and coherence across Government to respond to cyber security threats against the identified critical information infrastructure.

(5) Coordinating, sharing, monitoring, collecting, analysing and forecasting, national-level threats to critical information infrastructure for policy guidance, expertise-sharing and situational awareness for early warning or alerts. The basic responsibility for protecting critical information infrastructure system shall lie with the agency running that critical information infrastructure.

(6) Assisting in the development of appropriate plans, adoption of standards, sharing of best practices and refinement of procurement processes in respect of protection of Critical Information Infrastructure.

(7) Evolving protection strategies, policies, vulnerability assessment and auditing methodologies and plans for their dissemination and implementation for protection of Critical Information Infrastructure.

(8) Undertaking research and development and allied activities, providing funding (including grants-in-aid) for creating, collaborating and development of innovative future technology for developing and enabling the growth of skHls, working closely with wider public sector industries, academia et al and with international partners for protection of Critical Information Infrastructure.

(9) Developing or organising training and awareness programs as also nurturing and development of audit and certification agencies for protection of Critical Informalion Infrastructure.

(10) Developing and executing national and international cooperation strategies for protection of Critical Information Infrastructure.

(11) Issuing guidelines, advisories and vulnerability or audit notes etc. relating to protection of critical information infrastructure and practices, procedures, prevention and response in consultation with the stake holders, in close coordination with Indian Computer Emergency Response Team and other organisations working in the field or related fields.

(12) Exchanging cyber incidents and other information relating to attacks and vulnerabilities with Indian Computer Emergency Response Team and other concerned organisations in the field.

(13) In the event of any threat to critical information infrastructure the National Critical Informalion Infrastructure Protection Centre may call for information and give directions to the critical sectors or persons serving or having a critical impact on Criiical Information Infrastructure.

S. Manner of per forming functions and duties.—

(1) (a) The National Critical Information Infrastructure Protection Centre shall essentially undertake its task and discharge its responsibilities in close association or coordination with the respective nodal officers of the critical sectors, Indian Computer Emergency Response Team and other organisations working in the field or related fields.

(b) Prioritisalion of actions against threats or vulnerabilities shall generally be based on the type, severity. affected entity and availability of resources and the methodology for prioritization in descending order shall be as follows, namely:-

(t) the threat or vulnerability could result in significant physical or economic or other damage to the national critical information infrastructure;

(ii) Government property covered under critical information infrastructure, is in danger;

(iii) a significant number of sectors) of the national critical information infrastructure are in danger;

(iv) a particular sector of the national critical information infrastructure is endangered.

(2) Communication with National Critical Information Infrastructure Protection Centre

(a) The respective nodal officers in the various critical sectors shall communicate with the National Critical Information Infrastructure Protection Centre using all appropriate or available means of communication.

(b) The National Criiical Information Infrastructure Protection Centre may also take suo moto cognizance of any vulnerability'threat that comes to its notice and thai affects, or can affect, the nation's Critical Information Infrastructure, and initiate suitable measures.

(c) The National Criiical Information Infrastructure Protection Centre shall maintain a 24X7 help desk to facilitate reporting of incidents.

(3) National Criiical Informalion Infrastructure Protection Centre - Operations and Response

(a) National Critical Information Infrastructure Protection Centre shall, in conjunction with the respective nodal officers and other agencies like Indian Computer Emergency Response Team working in the field, issue advisories or alerts and provide guidance and expertise-sharing in addressing the thrcats'vulncrahilitics for protection of Critical Information Infrastructure.

(b) II shall, in the event of a likely/actual national-level threat, play a pivotal role and coordinate the response of the various stake-holders in the area of critical information infrastructure in close cooperation with Indian Computer Emergency Response Team.

(c) For protection of critical information infrastructure, the National Critical Information Infrastructure Protection Centre may take recourse for monitoring and collection of traffic data in accordance with the provisions of section 69B of the Act and the rules notified thereunder specific to critical information infrastructure and relevant to their cyber protection needs only. (d> The powers to the National Critical Information Infrastructure Protection Centre for interception/monitoring/decryption and blocking of cyber information for the purpose of protection of critical information infrastructure shall be in accordance with the law and as per the Standard Operating Procedures/modalities to be jointly developed by Ministry of Home Affairs and NTRO.

6. Advisory Committee.—

(a) There shall be Advisory Committee to advise the National Critical Information Infrastructure Protection Centre on policy matters and measures relating to the protection of critical information infrastructure to enable it to fulfil its mandated role and functions.

(b) The Advisory Committee shall consist of the following:-

(i) Chairman/Scientific Advisor. NTRO

(ii) Representative of Ministry of Home Affairs

(iii) Representative of Ministry of Law & Justice

(iv) Representative of Department of Telecommunications (v> Representative of Department of Electronics & IT

(vi) Representative of Department of Expenditure

(vii) Representative of Ministry of Defence

(viii) Director General. CERT-IN

(ix) Representative of National Security Council Secretarial

(x) Representative of Cabinet Secretariat

(xi) Subject/Domain Experts (Nominated by the Chairman)

(xii) Two Representatives from NTRO

(xiii) Representative of Intelligence Bureau

(xiv) Representative of any other Ministry as and when required

(xv) Representatives from (a) Industry (b) body corporate

(xvi) Representative oi Stale Governments (by rotation)

(xvii) Director General, National Critical Information Infrastructure Protection Centre - Chairman - Member - Member - Member - Member - Member - Member - Member - Member - Member - Memberts) - Member) si - Member - Special Invitee - Special Invitee - Special Invitee - Member Convener

(c) The Advisory Committee shall meet as often as considered necessary.

(d) The Advisor)' Committee may constitute Sub-committees to address any specific issue relating to functioning

7. Research and development.— The National Critical Information Infrastructure Protection Centre may seek collaboration and support research and development (direct or indirect) in accorcancc with rules and procedures of Government in this regard from-

(i) Government organisations or bodies, institutes, Departments, agencies or societies etc.;

(ii) institutes of eminence within and/or outside India;

(iii) body corporates and industry associations; and

(iv) subject or domain experts.

(in) ^^tsTtroanBfcrt^ .... ?raw;

(0) \JOW;

...WfT;

Provisions this rule answers to

Read out of the instrument itself: an enabling provision is one it says it was made under, which is the power it rests on. The rest it names without resting on.

Other instruments under the same Act

All of the The Information Technology Act, 2000