The NCRF, crafted by the National Critical Information Infrastructure Protection Centre (NCIIPC), has undergone consultation with companies and government departments since May of the preceding year
The Centre has proposed a directive urging enterprises within the banking, telecom, and energy sectors to exclusively utilise security products and services developed domestically in India. This move is in response to a series of cybersecurity incidents, the latest being an attack on the AIIMS systems in New Delhi in 2022.
As reported, the government has outlined a policy dubbed the “National Cybersecurity Reference Framework (NCRF),” aimed at offering guidelines regarding cybersecurity roles and responsibilities. The framework draws upon existing legislations, policies, and guidelines. It highlights the escalating threat posed by various actors, including nation-states and organised cyber-criminal groups, targeting critical information infrastructure (CII) of both government entities and enterprises.
The NCRF, crafted by the National Critical Information Infrastructure Protection Centre (NCIIPC), has undergone consultation with companies and government departments since May of the preceding year. Among its recommendations is a suggestion for enterprises to allocate a minimum of 10 per cent of their total IT budget toward cybersecurity. This allocation, according to the framework, should be distinctly separate from general IT resources and be closely monitored by top-level management or board of directors.
The NCRF states: “In recent years many threat actors backed by nation-states and organised cyber-criminal groups have attempted to target critical information infrastructure (CII) of the government and enterprises. In addition, the availability of “cyber-attacks-as-service” has reduced the entry threshold for new cyber criminals, thus increasing the exposure to individuals and organisations.”
Former national cyber security coordinator Lt General Rajesh Pant has emphasised the significance of the NCRF, describing it as a crucial document that supersedes the 2013 National Cybersecurity Policy. Pant highlighted the evolving cybersecurity landscape, necessitating updated strategies to address new threats and cyber organisations emerging between 2013 and 2023. He assured that the finalised NCRF would soon be made available to the public after undergoing a thorough review process to safeguard any confidential information.
Importantly, Pant clarified that while the NCRF provides guidelines, its recommendations are not binding. Additionally, the policy may suggest that regulators require access to sensitive data and deficiencies within critical sectors, necessitating the implementation of an effective Information Security Management System (ISMS) instance.