Declaration of Census, NPR and CRS web portal, mobile applications, databases and computer resources of the Office of the Registrar General and Census Commissioner, India as Protected Systems under Information Technology Act, 2000 being Critical Information Infrastructure (CII)

## Report on Declaration of Critical Information Infrastructure for Census and Related Systems **1. Executive Summary:** This report analyzes a notification from the Ministry of Home Affairs, Government of India, declaring specific computer resources related to Census, Civil Registration, and Population Register systems as Critical Information Infrastructure (CII). This declaration, made under the Information Technology Act, 2000, aims to protect these systems from unauthorized access, modification, use, disclosure, disruption, destruction, or denial of service, ensuring the integrity and availability of vital citizen data. The key finding is that the government is prioritizing the security and reliability of these essential data collection and management systems. **2. Introduction:** This report provides an overview and analysis of a notification (S.O. 5168E) issued by the Ministry of Home Affairs, Office of the Registrar General and Census Commissioner, India, concerning the designation of computer resources as Critical Information Infrastructure (CII). The analysis is based solely on the content of the provided notification text. **3. Policy Overview:** * This is a *new* policy declaration. * **Core Objective(s):** The primary objective is to declare specific computer resources as Critical Information Infrastructure (CII) under Section 70 of the Information Technology Act, 2000. This implies an objective to enhance the security and protection of these systems. The inferred objective is to safeguard sensitive citizen data and ensure the continuous operation of census, registration, and population management processes. **4. Background and Rationale:** As a new policy declaration, this likely addresses the growing threat landscape and the increasing reliance on digital infrastructure for critical government functions. The policy likely addresses the need to safeguard essential systems and data from cyberattacks or other disruptions, given that Census, Civil Registration, and Population Register systems hold highly sensitive citizen information and their disruption could have severe consequences. This is further supported by the mention of a Disaster Recovery Site (DRS), indicating a concern for business continuity and data resilience. **5. Key Provisions / Changes:** This is a new policy declaration, and therefore the following are the key provisions based on the text: * **Designation of CII:** The notification explicitly declares the following computer resources as Critical Information Infrastructure (CII): * Census Monitoring Management System (CMMS) Web Portal * Self Enumeration (SE) Web Portal * Civil Registration System (CRS) Web Portal * Mobile applications for House Listing (HL), Population Enumeration (PE) and National Population Register (NPR) Updation * Linked Databases (NPR Database, Census Database, and CRS Database) * Computer resources setup/installed at National Data Centre (NDC), ORGI, Delhi and Disaster Recovery Site (DRS) Data Centre (DC) at Bengaluru and Lucknow * **Protected Systems Status:** The computer resources and associated dependencies are declared to be Protected Systems for the purposes of the Information Technology Act, 2000. This gives the government legal authority to take measures to protect these systems. * **Enforcement Date:** The notification comes into force on the date of its publication in the Official Gazette (November 7, 2022). **6. Target Audience and Stakeholders:** The primary target audience includes: * **Office of the Registrar General and Census Commissioner, India (ORGI):** As the owner and operator of the declared CII, the ORGI is directly responsible for implementing and adhering to the security provisions related to protected systems. * **National Data Centre (NDC), ORGI, Delhi and Disaster Recovery Site (DRS) Data Centre (DC) at Bengaluru and Lucknow:** The operators and administrators of these data centers are responsible for implementing and maintaining the security measures required for CII protection. * **Information Security Professionals:** Those responsible for securing the Census, Civil Registration and NPR infrastructure. Indirectly, all citizens are stakeholders as the policy aims to protect their data and ensure the continuity of essential government services. **7. Implementation Aspects (Inferred):** * **Responsible Agency/Bodies:** The Office of the Registrar General and Census Commissioner, India (ORGI), and the National Critical Information Infrastructure Protection Centre (NCIIPC) are likely responsible for implementing and overseeing the protection of the declared CII. The Joint Secretary (ASHISH KUMAR) is the signing authority, indicating high-level oversight. * **Timelines or Procedures:** The notification takes effect immediately upon publication in the Official Gazette. No specific procedures are outlined in the text, but it can be inferred that the ORGI and NCIIPC will need to develop and implement security protocols and measures to comply with the IT Act, 2000. **8. Expected Outcomes / Impact of Changes:** The intended outcomes of this policy declaration include: * **Enhanced Security:** Increased protection against cyber threats and unauthorized access to sensitive citizen data. * **Improved Resilience:** Ensuring the continuous operation of Census, Civil Registration, and Population Register systems, even in the face of disruptions. * **Legal Framework:** Establishing a clear legal framework for protecting these critical systems, enabling the government to take necessary actions to mitigate risks. * **Increased confidence:** Increased citizen confidence in the protection and integrity of their data held by the government. **9. Conclusion:** The notification declaring specific computer resources related to Census, Civil Registration, and Population Register systems as Critical Information Infrastructure represents a significant step towards enhancing the security and resilience of vital citizen data and government services. By designating these systems as protected under the Information Technology Act, 2000, the government aims to safeguard against cyber threats and ensure the continued availability of these essential services. This policy underscores the importance of data protection and cybersecurity in the digital age, particularly for systems that manage sensitive citizen information. The ORGI and related stakeholders must prioritize implementing robust security measures to effectively protect these critical assets.

Key Entities Referenced