National Critical Information Infrastructure Protection Centre - Revision history

Ajay Kumar: Updated the article +/-

2023-09-25T18:51:20Z

Updated the article +/-

← Older revision		Revision as of 00:21, 26 September 2023
Line 1:		Line 1:
			{{Short description\|A unit of the National Technical Research Organisation (NTRO), India}}
	{{Use dmy dates\|date=July 2019}}		{{Use dmy dates\|date=July 2019}}
	{{Infobox government agency		{{Infobox government agency
Line 33:		Line 34:
	}}		}}

	'''National Critical Information Infrastructure Protection Centre (NCIIPC)''' is an organisation of the [[Government of India]] created under ~~the~~ Section 70A of the [[Information Technology Act, 2000]] (amended 2008), through a gazette notification on 16 January 2014.<ref>{{Cite web\|title=Archived copy\|url=http://meity.gov.in/sites/upload_files/dit/files/downloads/itact2000/itbill2000.pdf#\|url-status=dead\|archive-url=https://web.archive.org/web/20170119125539/http://meity.gov.in/sites/upload_files/dit/files/downloads/itact2000/itbill2000.pdf#\|archive-date=2017-01-19\|access-date=2017-01-04}}</ref><ref name="tifrh.res.in">{{Cite web\|title=Archived copy\|url=http://cc.tifrh.res.in/webdata/documents/events/facilities/IT_act_2008.pdf#\|url-status=dead\|archive-url=https://web.archive.org/web/20170103170226/http://cc.tifrh.res.in/webdata/documents/events/facilities/IT_act_2008.pdf#\|archive-date=2017-01-03\|access-date=2017-01-03}}</ref><ref>{{Cite web \|url=http://meity.gov.in/sites/upload_files/dit/files/S_O_18(E).pdf# \|title=Archived copy \|access-date=2017-01-02 \|archive-url=https://web.archive.org/web/20170125024443/http://meity.gov.in/sites/upload_files/dit/files/S_O_18(E).pdf# \|archive-date=2017-01-25 \|url-status=dead }}</ref> Based in New Delhi, India, it is designated as the National Nodal Agency in terms of Critical Information Infrastructure Protection.<ref>{{cite web\|url=http://thehackernews.com/2017/01/protect-critical-infrastructure.html\|title=NCIIPC: It's Time to Step Forward And Protect Our Critical Infrastructures from Cyber Attacks\|publisher=}}</ref> It is a unit of the [[National Technical Research Organisation]] (NTRO) and therefore comes under the Prime Minister's Office (PMO).<ref>https://www.nciipc.gov.in/documents/Guidelines_for_Identification_of_CII.pdf</ref>		'''National Critical Information Infrastructure Protection Centre (NCIIPC)''' is an organisation of the [[Government of India]] created under Section 70A of the [[Information Technology Act, 2000]] (amended 2008), through a gazette notification on 16 January 2014.<ref>{{Cite web\|title=Archived copy\|url=http://meity.gov.in/sites/upload_files/dit/files/downloads/itact2000/itbill2000.pdf#\|url-status=dead\|archive-url=https://web.archive.org/web/20170119125539/http://meity.gov.in/sites/upload_files/dit/files/downloads/itact2000/itbill2000.pdf#\|archive-date=2017-01-19\|access-date=2017-01-04}}</ref><ref name="tifrh.res.in">{{Cite web\|title=Archived copy\|url=http://cc.tifrh.res.in/webdata/documents/events/facilities/IT_act_2008.pdf#\|url-status=dead\|archive-url=https://web.archive.org/web/20170103170226/http://cc.tifrh.res.in/webdata/documents/events/facilities/IT_act_2008.pdf#\|archive-date=2017-01-03\|access-date=2017-01-03}}</ref><ref>{{Cite web \|url=http://meity.gov.in/sites/upload_files/dit/files/S_O_18(E).pdf# \|title=Archived copy \|access-date=2017-01-02 \|archive-url=https://web.archive.org/web/20170125024443/http://meity.gov.in/sites/upload_files/dit/files/S_O_18(E).pdf# \|archive-date=2017-01-25 \|url-status=dead }}</ref> Based in New Delhi, India, it is designated as the National Nodal Agency in terms of Critical Information Infrastructure Protection.<ref>{{cite web\|url=http://thehackernews.com/2017/01/protect-critical-infrastructure.html\|title=NCIIPC: It's Time to Step Forward And Protect Our Critical Infrastructures from Cyber Attacks\|publisher=}}</ref> It is a unit of the [[National Technical Research Organisation]] (NTRO) and therefore comes under the Prime Minister's Office (PMO).<ref>{{Cite web \|url=https://www.nciipc.gov.in/documents/Guidelines_for_Identification_of_CII.pdf \|title=Archived copy \|access-date=21 July 2020 \|archive-date=13 May 2020 \|archive-url=https://web.archive.org/web/20200513045217/https://nciipc.gov.in/documents/Guidelines_for_Identification_of_CII.pdf \|url-status=dead }}</ref>

	==Critical Information Infrastructure==		==Critical Information Infrastructure==
Line 47:		Line 48:
	* Strategic & Public Enterprises		* Strategic & Public Enterprises

	Information Security Practices and Procedures for Protected System Rules, 2018 <ref>http://nciipc.gov.in/documents/Rules_procedures_new2018.pdf</ref><ref>{{cite web\|url=http://www.digitalpolicy.org/nciipc-evolving-framework/\|title=The NCIIPC & Its Evolving Framework - Digital Policy Portal\|website=www.digitalpolicy.org}}</ref>		Information Security Practices and Procedures for Protected System Rules, 2018 <ref>{{Cite web \|url=http://nciipc.gov.in/documents/Rules_procedures_new2018.pdf \|title=Archived copy \|access-date=22 October 2018 \|archive-date=2 September 2018 \|archive-url=https://web.archive.org/web/20180902005224/http://nciipc.gov.in/documents/Rules_procedures_new2018.pdf \|url-status=dead }}</ref><ref>{{cite web\|url=http://www.digitalpolicy.org/nciipc-evolving-framework/\|title=The NCIIPC & Its Evolving Framework - Digital Policy Portal\|website=www.digitalpolicy.org}}</ref>

	==Vision==		==Vision==
Line 53:		Line 54:

	==Mission==		==Mission==
	"To take all necessary measures to facilitate protection of Critical Information Infrastructure, from unauthorized access, modification, use, disclosure, disruption, incapacitation or ~~distraction~~ through coherent coordination, synergy and raising information security awareness among all stakeholders. " <ref name="nciipc.gov.in"/>		"To take all necessary measures to facilitate protection of Critical Information Infrastructure, from unauthorized access, modification, use, disclosure, disruption, incapacitation or destruction through coherent coordination, synergy and raising information security awareness among all stakeholders. " <ref name="nciipc.gov.in"/>

	== Functions and Duties ==		== Functions and Duties ==
	* National nodal agency for all measures to protect nation's critical information infrastructure.		* National nodal agency for all measures to protect the nation's critical information infrastructure.
	* Protect and deliver advice that aims to reduce the vulnerabilities of critical information infrastructure, against cyber terrorism, cyber warfare and other threats.		* Protect and deliver advice that aims to reduce the vulnerabilities of critical information infrastructure, against cyber terrorism, cyber warfare and other threats.
	* Identification of all critical information infrastructure elements for approval by the appropriate Government for notifying the same.		* Identification of all critical information infrastructure elements for approval by the appropriate Government for notifying the same.
	* Provide strategic leadership and coherence across Government to respond to cyber security threats against the identified critical information infrastructure.		* Provide strategic leadership and coherence across Government to respond to cyber security threats against the identified critical information infrastructure.
	* Coordinate, share, monitor, collect, analyze and forecast, national level ~~threat~~ to CII for policy guidance, expertise sharing and situational awareness for early warning or alerts. The basic responsibility for protecting CII system shall lie with the agency running that CII.		* Coordinate, share, monitor, collect, analyze and forecast, national-level threats to CII for policy guidance, expertise sharing and situational awareness for early warning or alerts. The basic responsibility for protecting CII system shall lie with the agency running that CII.
	* Assisting in the development of appropriate plans, adoption of standards, sharing of best practices and refinement of procurement processes in respect of protection of Critical Information Infrastructure.		* Assisting in the development of appropriate plans, adoption of standards, sharing of best practices and refinement of procurement processes in respect of protection of Critical Information Infrastructure.
	* Evolving protection strategies, policies, vulnerability assessment and auditing methodologies and plans for their dissemination and implementation for protection of Critical Information Infrastructure.		* Evolving protection strategies, policies, vulnerability assessment and auditing methodologies and plans for their dissemination and implementation for protection of Critical Information Infrastructure.
	* Undertaking research and development and allied activities, providing funding (including grants-in-aid) for creating, collaborating and development of innovative future technology for developing and enabling the growth of skills, working closely with wider public sector industries, academia et al. and with international partners for protection of Critical Information Infrastructure.		* Undertaking research and development and allied activities, providing funding (including grants-in-aid) for creating, collaborating and development of innovative future technology for developing and enabling the growth of skills, working closely with wider public sector industries, academia et al. and with international partners for protection of Critical Information Infrastructure.
	* Developing or organising training and awareness programs as also nurturing and ~~development~~ of audit and certification agencies for protection of Critical Information Infrastructure.		* Developing or organising training and awareness programs as also nurturing and developing of audit and certification agencies for protection of Critical Information Infrastructure.
	* Developing and executing national and international cooperation strategies for protection of Critical Information Infrastructure.		* Developing and executing national and international cooperation strategies for protection of Critical Information Infrastructure.
	* Issuing guidelines, advisories and vulnerability or audit notes etc. relating to protection of critical information infrastructure and practices, procedures, prevention and response in consultation with the ~~stake holders~~, in close coordination with Indian Computer Emergency Response Team and other organisations working in the field or related fields.		* Issuing guidelines, advisories and vulnerability or audit notes etc. relating to protection of critical information infrastructure and practices, procedures, prevention and response in consultation with the stakeholders, in close coordination with Indian Computer Emergency Response Team and other organisations working in the field or related fields.
	* Exchanging cyber incidents and other information relating to attacks and vulnerabilities with Indian Computer Emergency Response Team and other concerned organisations in the field.		* Exchanging cyber incidents and other information relating to attacks and vulnerabilities with Indian Computer Emergency Response Team and other concerned organisations in the field.
	* In the event of any threat to critical information infrastructure the National Critical Information Infrastructure Protection Centre may call for information and give directions to the critical sectors or persons serving or having a critical impact on Critical Information Infrastructure.		* In the event of any threat to critical information infrastructure, the National Critical Information Infrastructure Protection Centre may call for information and give directions to the critical sectors or persons serving or having a critical impact on Critical Information Infrastructure.

	==Operations==		==Operations==
			* NCIIPC maintains a 24x7 Help Desk to facilitate reporting of incidents. Toll Free No. 1800-11-4430.
	* Issues advisories or alerts and provide guidance and expertise-sharing in addressing the threats/vulnerabilities for protection of CII.		* Issues advisories or alerts and provide guidance and expertise-sharing in addressing the threats/vulnerabilities for protection of CII.
	* In the event of a likely/actual national-level threat, it plays a pivotal role to coordinate the response of the various CII ~~stake-holders~~ in close cooperation with CERT-India.		* In the event of a likely/actual national-level threat, it plays a pivotal role to coordinate the response of the various CII stakeholders in close cooperation with CERT-India.

	== Programs ==		== Programs ==
	NCIIPC runs a number of programs to engage with its ~~Stakeholders~~. Some of them are as follows:		NCIIPC runs a number of programs to engage with its stakeholders. Some of them are as follows:
	* Responsible Vulnerability Disclosure Program (RVDP)		* Responsible Vulnerability Disclosure Program (RVDP)
	* Incident Response (IR)		* Incident Response (IR)
Line 94:		Line 96:
	NCIIPC releases its quarterly newsletter encompassing latest developments in the field of Critical Information Infrastructure(CII) and its protection along with various initiatives taken by NCIIPC to spread awareness and best practices and much more.		NCIIPC releases its quarterly newsletter encompassing latest developments in the field of Critical Information Infrastructure(CII) and its protection along with various initiatives taken by NCIIPC to spread awareness and best practices and much more.

			* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Jul22.pdf July 2022]
			* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Apr22.pdf April 2022]
			* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Jan22.pdf January 2022]
			* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Oct21.pdf October 2021]
	* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Jul21.pdf July 2021]		* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Jul21.pdf July 2021]
	* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Apr21.pdf April 2021]		* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Apr21.pdf April 2021]
Line 138:		Line 144:
	[[Category:Cyberwarfare]]		[[Category:Cyberwarfare]]
	[[Category:Cyber Security in India]]		[[Category:Cyber Security in India]]
			[[Category:Computer security organizations]]
			[[Category:Indian intelligence agencies]]

imported>NCNL2020: /* Operations */

2021-08-03T04:29:37Z

Operations

New page

{{Use dmy dates|date=July 2019}}
{{Infobox government agency
| name = National Critical Information Infrastructure Protection Centre
| seal = Emblem of India.svg
| seal_size = 70px
| seal_caption = [[Emblem of India]]
| logo =
| formed = 16 Jan 2014
| jurisdiction =
| headquarters = [[New Delhi|New Delhi, Delhi]]
| employees =
| budget =
| chief1_name = Navin Kumar Singh, Director General
| chief1_position =
| chief2_name =
| chief2_position =
| chief3_name =
| chief3_position =
| chief4_name =
| chief4_position =
| chief5_name =
| chief5_position =
| chief6_name =
| chief6_position =
| chief7_name =
| chief7_position =
| chief8_name =
| chief8_position =
| chief9_name =
| chief9_position =
| parent_department = [[National Technical Research Organisation]]
| website = https://www.nciipc.gov.in/
}}

'''National Critical Information Infrastructure Protection Centre (NCIIPC)''' is an organisation of the [[Government of India]] created under the Section 70A of the [[Information Technology Act, 2000]] (amended 2008), through a gazette notification on 16 January 2014.<ref>{{Cite web|title=Archived copy|url=http://meity.gov.in/sites/upload_files/dit/files/downloads/itact2000/itbill2000.pdf#|url-status=dead|archive-url=https://web.archive.org/web/20170119125539/http://meity.gov.in/sites/upload_files/dit/files/downloads/itact2000/itbill2000.pdf#|archive-date=2017-01-19|access-date=2017-01-04}}</ref><ref name="tifrh.res.in">{{Cite web|title=Archived copy|url=http://cc.tifrh.res.in/webdata/documents/events/facilities/IT_act_2008.pdf#|url-status=dead|archive-url=https://web.archive.org/web/20170103170226/http://cc.tifrh.res.in/webdata/documents/events/facilities/IT_act_2008.pdf#|archive-date=2017-01-03|access-date=2017-01-03}}</ref><ref>{{Cite web |url=http://meity.gov.in/sites/upload_files/dit/files/S_O_18(E).pdf# |title=Archived copy |access-date=2017-01-02 |archive-url=https://web.archive.org/web/20170125024443/http://meity.gov.in/sites/upload_files/dit/files/S_O_18(E).pdf# |archive-date=2017-01-25 |url-status=dead }}</ref> Based in New Delhi, India, it is designated as the National Nodal Agency in terms of Critical Information Infrastructure Protection.<ref>{{cite web|url=http://thehackernews.com/2017/01/protect-critical-infrastructure.html|title=NCIIPC: It's Time to Step Forward And Protect Our Critical Infrastructures from Cyber Attacks|publisher=}}</ref> It is a unit of the [[National Technical Research Organisation]] (NTRO) and therefore comes under the Prime Minister's Office (PMO).<ref>https://www.nciipc.gov.in/documents/Guidelines_for_Identification_of_CII.pdf</ref>

==Critical Information Infrastructure==
The Information Technology Act, 2000 defines Critical Information Infrastructure (CII) as “… those computer resource, the incapacitation or destruction of which, shall have debilitating impact on national security, economy, public health or safety".<ref name="tifrh.res.in"/>

NCIIPC has broadly identified the following as ‘Critical Sectors’ :-

* Power & Energy
* Banking, Financial Services & Insurance
* Telecom
* Transport
* Government
* Strategic & Public Enterprises

Information Security Practices and Procedures for Protected System Rules, 2018 <ref>http://nciipc.gov.in/documents/Rules_procedures_new2018.pdf</ref><ref>{{cite web|url=http://www.digitalpolicy.org/nciipc-evolving-framework/|title=The NCIIPC & Its Evolving Framework - Digital Policy Portal|website=www.digitalpolicy.org}}</ref>

==Vision==
"To facilitate safe, secure and resilient Information Infrastructure for Critical Sectors of the Nation."<ref name="nciipc.gov.in">{{cite web|author=NCIIPC |url=https://nciipc.gov.in |title=National Critical Information Infrastructure Protection Centre |publisher=Nciipc.gov.in |date= |accessdate=2018-07-19}}</ref>

==Mission==
"To take all necessary measures to facilitate protection of Critical Information Infrastructure, from unauthorized access, modification, use, disclosure, disruption, incapacitation or distraction through coherent coordination, synergy and raising information security awareness among all stakeholders. " <ref name="nciipc.gov.in"/>

== Functions and Duties ==
* National nodal agency for all measures to protect nation's critical information infrastructure.
* Protect and deliver advice that aims to reduce the vulnerabilities of critical information infrastructure, against cyber terrorism, cyber warfare and other threats.
* Identification of all critical information infrastructure elements for approval by the appropriate Government for notifying the same.
* Provide strategic leadership and coherence across Government to respond to cyber security threats against the identified critical information infrastructure.
* Coordinate, share, monitor, collect, analyze and forecast, national level threat to CII for policy guidance, expertise sharing and situational awareness for early warning or alerts. The basic responsibility for protecting CII system shall lie with the agency running that CII.
* Assisting in the development of appropriate plans, adoption of standards, sharing of best practices and refinement of procurement processes in respect of protection of Critical Information Infrastructure.
* Evolving protection strategies, policies, vulnerability assessment and auditing methodologies and plans for their dissemination and implementation for protection of Critical Information Infrastructure.
* Undertaking research and development and allied activities, providing funding (including grants-in-aid) for creating, collaborating and development of innovative future technology for developing and enabling the growth of skills, working closely with wider public sector industries, academia et al. and with international partners for protection of Critical Information Infrastructure.
* Developing or organising training and awareness programs as also nurturing and development of audit and certification agencies for protection of Critical Information Infrastructure.
* Developing and executing national and international cooperation strategies for protection of Critical Information Infrastructure.
* Issuing guidelines, advisories and vulnerability or audit notes etc. relating to protection of critical information infrastructure and practices, procedures, prevention and response in consultation with the stake holders, in close coordination with Indian Computer Emergency Response Team and other organisations working in the field or related fields.
* Exchanging cyber incidents and other information relating to attacks and vulnerabilities with Indian Computer Emergency Response Team and other concerned organisations in the field.
* In the event of any threat to critical information infrastructure the National Critical Information Infrastructure Protection Centre may call for information and give directions to the critical sectors or persons serving or having a critical impact on Critical Information Infrastructure.

==Operations==
* Issues advisories or alerts and provide guidance and expertise-sharing in addressing the threats/vulnerabilities for protection of CII.
* In the event of a likely/actual national-level threat, it plays a pivotal role to coordinate the response of the various CII stake-holders in close cooperation with CERT-India.

== Programs ==
NCIIPC runs a number of programs to engage with its Stakeholders. Some of them are as follows:
* Responsible Vulnerability Disclosure Program (RVDP)
* Incident Response (IR)
* Malware Reporting
* Internship Courses
* Research Scholars, etc.

== Initiatives ==
Some of the major NCIIPC initiatives are as follows:

* Incident Response and Responsible Vulnerability Disclosure program- NCIIPC runs these programs for reporting any Vulnerability in Critical Information Infrastructures.
* PPP for Training- Identification of PPP entities for partnership and formulation of training requirements and guidelines for conducting training for all stakeholders.
* CII Range to simulate real world threat– IT and OT simulations for critical sectors to test the defense of CII.
* Cyber Security Preparedness Survey, Risk Assessment, Audit, review and Compliance.
* Interns, Research Scholars & Cyber Security professionals- NCIIPC Internship program (both Full-time and Part-time) is available throughout the year.

== NCIIPC Newsletter ==
NCIIPC releases its quarterly newsletter encompassing latest developments in the field of Critical Information Infrastructure(CII) and its protection along with various initiatives taken by NCIIPC to spread awareness and best practices and much more.

* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Jul21.pdf July 2021]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Apr21.pdf April 2021]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Jan21.pdf January 2021]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Oct20.pdf October 2020]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Jul20.pdf July 2020]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Apr20.pdf April 2020]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Jan20.pdf January 2020]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Oct19.pdf October 2019]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_July19.pdf July 2019]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Apr19.pdf April 2019]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Jan19.pdf January 2019]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Oct18.pdf October 2018]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_July18.pdf July 2018]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Apr18.pdf April 2018]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Jan18.pdf January 2018]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Oct17.pdf October 2017]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Jul17.pdf July 2017]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Apr17.pdf April 2017]
* [https://nciipc.gov.in/documents/NCIIPC_Newsletter_Jan17.pdf January 2017]

== NCIIPC Guidelines ==
NCIIPC releases SOPs and Guidelines for CISOs, CII Organisations and others to enhance the cybersecurity defence posture. Below are the copies:

* [https://nciipc.gov.in/documents/NCIIPC_COVID19_Guidelines.pdf NCIIPC COVID-19 Guidelines]
* [https://nciipc.gov.in/documents/SOP-PPP.pdf SOP : Public-Private-Partnership]
* [https://nciipc.gov.in/documents/Guidelines_for_Identification_of_CII.pdf Guidelines for Identification of CII]
* [https://nciipc.gov.in/documents/Rules_procedures_new2018.pdf Rules for the Information Security Practices and Procedures for Protected System]
* [https://nciipc.gov.in/documents/National_Cyber_Security_Policy-2013.pdf National Cyber Security Policy, 2013]
* [https://nciipc.gov.in/documents/Roles_Responsibilities-CISO.pdf Roles and Responsibilities of CISOs]
* [https://nciipc.gov.in/documents/NCIIPC_Guidelines_V2.pdf Guidelines for Protection of CII]
* [https://nciipc.gov.in/documents/Evaluating_Cyber_Security_Framework.pdf Evaluating Cyber Security in CII]
* [https://nciipc.gov.in/documents/SOP-Incident_Response.pdf SOP : Incident Response]
* [https://nciipc.gov.in/documents/SOP-CII_Audit.pdf SOP : Audit of CII/Protected Systems]

==References==
{{Reflist}}

==External links==
*{{official website|http://www.nciipc.gov.in}}

[[Category:Government of India]]
[[Category:Information technology organisations based in India]]
[[Category:Cyberwarfare]]
[[Category:Cyber Security in India]]