Cybersecurity is now a national-security priority as critical infrastructure goes digital. Examine the institutional architecture under CERT-In and the gaps in CII protection.

Introduction:

CERT-In's Annual Report records 16.05 lakh cybersecurity incidents handled in 2024; the AIIMS Delhi ransomware attack of 23 November 2022 compromised five servers and paralysed critical hospital systems for two weeks; the National Cyber Security Policy 2013 still awaits an overdue update.

Institutional architecture:

The Indian Computer Emergency Response Team (CERT-In) under MeitY handles civilian incidents and issued the 6-hour reporting direction of 28 April 2022. The National Critical Information Infrastructure Protection Centre (NCIIPC) under NTRO operates under Section 70A of the IT Act 2000 to protect designated CII sectors — power, finance, transport, telecom, and government. The Indian Cyber Crime Coordination Centre (I4C) under MHA handles cyber-enabled crime; the Defence Cyber Agency under the Chief of Defence Staff (2019) handles military cyber-space.

CII protection framework and gaps:

Section 70 IT Act permits designation of CII, but the empanelment is patchy, and many state-level utilities and hospitals are not covered. The Mumbai grid outage of October 2020 — attributed to suspected cyber activity — exposed power-sector vulnerability. The AIIMS attack revealed that even apex national institutions run inadequate backup, segmentation, and incident-response drills.

Structural gaps:

India has no overarching Cybersecurity Act; breach notification is fragmented; SME hygiene remains weak; supply-chain attack risk (Solarwinds-style) is under-modelled. The draft National Cyber Security Strategy of 2020 remains pending finalisation.

Way forward / Conclusion:

Pass a Cybersecurity Act with a national strategy, mandate breach disclosure under DPDP Rules, harmonise CERT-In reporting timelines, and institutionalise bug-bounty programmes for CII operators under MeitY by 2027.