Cybersecurity Governance for Critical Infrastructure in India
Aspirants should be able to argue that India's cybersecurity governance for critical infrastructure needs a fundamental shift from perimeter-based security to a data-centric, supply-chain-aware, and zero-trust framework with clear accountability across all stakeholders.
Understand the issue · 1/2
Why now
01The recent data breach involving files related to the Kudankulam nuclear power project highlights persistent vulnerabilities in India's critical infrastructure cybersecurity, particularly concerning third-party vendors and supply chains. This incident underscores the urgent need to re-evaluate and strengthen the national cybersecurity policy and governance framework beyond traditional perimeters.
Core issue
02A recent data breach involving files related to the Kudankulam nuclear power project, stored on a contractor's server, has exposed critical vulnerabilities in India's cybersecurity framework for critical infrastructure. The incident highlights that security risks extend far beyond the physical perimeter of sensitive facilities to the entire supply chain, including contractors, subcontractors, and commercial data centers. The article argues that existing governance mechanisms, such as CERT-In and NCIIPC, and laws like the IT Act, are inadequate to ensure uniform protection and accountability for sensitive information once it leaves the operator's direct control. It calls for a fundamental shift in policy towards data-centric security, real data classification, third-party risk assessments, zero-trust principles, and a converged national framework to address these evolving threats, especially as India expands digital public infrastructure and private sector involvement in strategic sectors.
Swipe to study · 01
Build the answer
Dimensions that matter
Evolving nature of cyber threats to critical infrastructure (beyond physical perimeters).
Challenges of supply chain cybersecurity in a multi-stakeholder ecosystem.
Gaps in India's existing cybersecurity governance and regulatory framework.
Institutional roles and accountability mechanisms (CERT-In, NCIIPC, IT Act).
Policy reforms and strategic measures required for robust critical infrastructure protection.
Balancing economic liberalization (Atmanirbhar Bharat) with national security concerns.
Use in your answer
Answer assets
Kudankulam Breach (2026)
Example of supply chain vulnerability, where data stored on a contractor's server (Yotta) was compromised, not the main plant's operational systems.
Perimeter beyond the plant
Argument that security risks extend to contractors, subcontractors, data centers, and their employees, holding operationally relevant information.
CERT-In & NCIIPC
Existing national agencies for incident response and CII protection, but their rules may not ensure uniform protection across the entire supply chain.
Accountability Gap
Problem where operator, contractor, and host can all claim their systems weren't breached, yet sensitive data is exposed, lacking clear responsibility.
Policy Recommendations
Security obligations must follow data, real data classification, third-party risk assessment (including red-team exercises), zero-trust policy, and a converged national framework for supply-chain security.
Digital Personal Data Protection Act
Does not generally cover engineering drawings and technical information, highlighting a specific regulatory gap for non-personal critical data.
How UPSC has tested it
PYQ connections
e-governance as a critical tool of governance, has ushered in effectiveness, transparency and accountability in governments. What inadequacies hamper the enhancement of these features.
Connection: The PYQ asks about inadequacies hampering the effectiveness and accountability of e-governance, and the current issue provides a critical case study of such failures in cybersecurity for vital sectors.
Now apply it
Write one answer
The recent Kudankulam data breach has exposed critical vulnerabilities, highlighting that India's existing cybersecurity governance mechanisms are inadequate to ensure uniform protection and accountability for sensitive information once it leaves the operator's direct control. In light of this statement, critically discuss the limitations of India's current cybersecurity framework for critical infrastructure and suggest reforms to address supply chain vulnerabilities.
Introduce the Kudankulam incident, analyze the limitations of existing bodies/laws, and then propose specific policy and structural reforms.
Write this answerSecurity risks extend far beyond the physical perimeter of sensitive facilities to the entire supply chain, including contractors, subcontractors, and commercial data centers. Examine the implications of such extended cybersecurity vulnerabilities for India's national security and economic stability, especially in the context of expanding digital public infrastructure and private sector involvement in strategic sectors.
Define the 'extended perimeter' risk, discuss its impact on national security (espionage, sabotage) and economic stability (disruption, data theft), and suggest measures for resilience.
Write this answer