Protecting Critical Infrastructure in Cyberspace: Is India’s Legal Framework Preventive or Reactive?

By Saburie Kanal, Christ (Deemed to be University), Delhi NCR

A cyberattack on a typical digital system may cause data loss or business interruption. An attack on critical infrastructure, however, can affect essential services far beyond the system that was targeted. A disruption to a power system, for example, may have repercussions for hospitals, banking, telecommunications, transport and public administration. This is why the legal relevance of Critical Information Infrastructure (CII) stems from the effects of its failure rather than its technical sophistication.

The Explanation to Section 70(1) of the Information Technology Act, 2000 defines CII as “the computer resource, the incapacitation or destruction of which, shall have debilitating impact on national security, economy, public health or safety.”[1] Section 70 also allows the appropriate Government to declare certain computer resources to be protected systems. Section 70(3) provides that a person who “secures access or attempts to secure access to a protected system” in contravention of the section may face imprisonment of up to ten years and a fine. Section 66F(2) separately provides that a person who commits or conspires to commit cyber terrorism may be punished with imprisonment for life.

India has built an institutional framework for this through the IT Act, the National Critical Information Infrastructure Protection Centre (NCIIPC), the Indian Computer Emergency Response Team (CERT-In) and sector-specific regulators. Section 70A provides for a national nodal agency for the protection of CII, a role performed by NCIIPC, while Section 70B makes CERT-In the national agency for incident response.[2] The CERT-In Directions of 2022 require covered entities to report specified cyber incidents within six hours, retain logs for 180 days, synchronise system clocks and designate a point of contact for communication with CERT-In.[3]

At first glance, this looks like a structure with built-in deterrence. The real question, however, is whether having preventive institutions makes the legal framework itself preventive.

The Prevention Problem

India’s framework includes strong preventive elements. NCIIPC identifies critical sectors and carries out risk and vulnerability assessments. CERT-In issues alerts and advisories, allowing organisations to respond to risks before they become major incidents. These functions show that Indian law does not merely wait for an attack to occur.[2]

However, some of the framework’s most important requirements apply only once an incident has been identified. The six-hour reporting requirement under the CERT-In Directions is an example. Quick notification can help authorities coordinate a response and may reduce the harm, but the obligation is triggered only when an incident has been discovered. This creates an important distinction between responding quickly and preventing adequately.[3]

The 180-day log retention requirement presents a similar challenge. Logs are useful for assessing, investigating and planning responses to cyber incidents that have already occurred, and they may help identify future threats by revealing repeated patterns. They do not, however, prevent an attack. The framework therefore gives strong tools for understanding what happened, but fewer clear standards for judging whether organisations were adequately prepared beforehand.

Is Fragmentation Making Prevention Harder?

Another issue is institutional fragmentation. CII protection does not run through a single authority. NCIIPC and CERT-In operate alongside sector-specific regulators such as the Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI), the Insurance Regulatory and Development Authority of India (IRDAI) and the Department of Telecommunications (DoT).[4]

Sector-specific regulation is not always a flaw. Banking, telecommunications and electricity systems each carry distinct technical risks, which specialist regulators can address. The problem arises when several bodies enforce different mandates without assigning clear and comparable obligations for prevention, information sharing and accountability. The National Cyber Security Policy, 2013 illustrates the difficulty: it sets out broad aims, but it is a policy statement and not a set of binding standards. A preventive framework cannot rest on broad policy objectives alone. It must also define responsibilities and standards against which preparedness can be measured.[5]

The Supply-Chain Blind Spot

Supply-chain security is a further challenge. Critical infrastructure increasingly depends on imported hardware, software and technical components. This exposes it to risks such as vulnerabilities introduced during manufacturing, compromised components and flaws in third-party systems. A supply-chain vulnerability may exist for a long time before it emerges as a recognisable cyber incident, so it may escape a structure that relies on reporting after an issue has been observed. This is where preventive regulation matters: operators of critical infrastructure should be required not only to report incidents but also to examine their suppliers, test their systems and fix known vulnerabilities before they are exploited.

Conclusion

India’s CII protection system is best described as a hybrid model. NCIIPC’s protective mandate and risk assessments, together with CERT-In’s early-warning services, show a real preventive purpose. The real obstacle is not a lack of law but a gap between prevention on paper and prevention in practice. Protecting critical infrastructure cannot depend only on India’s ability to respond quickly to an attack. The most important measure of cybersecurity law should be the extent to which it requires critical infrastructure operators to identify, test and address vulnerabilities before they are exploited.

Recommendations

The question is not whether India needs new cyber laws. It already has a substantial legal and institutional framework. The more important question is whether the current framework can measure prevention. A stronger approach would require critical infrastructure operators to conduct risk assessments, test their resilience and incident response, address known vulnerabilities within specified timeframes, and examine supply-chain risks. These duties should be backed by closer coordination among NCIIPC, CERT-In and the sectoral regulators. Such requirements would shift the focus from asking “Was the incident reported?” to asking “What was done to prevent it?”[6]

India’s approach should not be dismissed as weak or reactive. It has real preventive institutions. The concern is that preventive purpose is not the same as preventive responsibility. A framework becomes truly preventive only when operators are required to demonstrate their readiness before a cyberattack.

References

• [1] Information Technology Act, 2000, s 70(1), Explanation.
• [2] Information Technology Act, 2000, ss 70A and 70B; Information Technology (National Critical Information Infrastructure Protection Centre and Manner of Performing Functions and Duties) Rules, 2013.
• [3] Indian Computer Emergency Response Team (CERT-In), Directions under sub-section (6) of Section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet, No. 20(3)/2022-CERT-In (28 April 2022).
• [4] Information Technology Act, 2000, ss 70A and 70B; Reserve Bank of India, Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, RBI/2023-24/107 (7 November 2023); Securities and Exchange Board of India, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, Circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 (20 August 2024); Insurance Regulatory and Development Authority of India, Information and Cyber Security Guidelines, 2023 (24 April 2023).
• [5] Ministry of Communications and Information Technology, Government of India, National Cyber Security Policy 2013 (2013).
• [6] Ministry of Communications and Information Technology, Government of India, National Cyber Security Policy 2013 (2013).

About the author: Saburie Kanal is a third-year law student at Christ (Deemed to be University), Delhi NCR.