Declaration of computer resources relating identified CII elements of LIC as protected system under sub section 1 of Section 70 of IT act 2000

## Report on Declaration of Critical Information Infrastructure for Life Insurance Corporation of India **1. Executive Summary:** This report analyzes a notification issued by the Ministry of Electronics and Information Technology (MeitY), Government of India, declaring specific computer resources of the Life Insurance Corporation of India (LIC) as Critical Information Infrastructure (CII) under Section 70 of the Information Technology Act, 2000. The notification designates the Electronic Front End Application Program, Business Application, Enterprise Document Management System, and Digitisation of Documents Application, along with their associated dependencies, as protected systems. It also authorizes specific personnel to access these protected systems. The primary purpose is to safeguard LIC's vital IT assets from unauthorized access and potential cyber threats, thereby ensuring the continuity of its services. **2. Introduction:** This report aims to provide a comprehensive overview of a notification published in the Gazette of India on September 7, 2022, by the Ministry of Electronics and Information Technology (MeitY). The notification pertains to the declaration of specific computer resources of the Life Insurance Corporation of India (LIC) as Critical Information Infrastructure (CII) under the Information Technology Act, 2000. The analysis is based solely on the information contained within the provided text. **3. Policy Overview:** * This is a *new* policy declaration. * **Core Objective(s):** Based on the text, the primary objective is to protect the computer resources relating to the Electronic Front End Application Program, Business Application and Enterprise Document Management System Digitisation of Documents Application of the Life Insurance Corporation of India (LIC), including associated dependencies, by designating them as Critical Information Infrastructure (CII) under Section 70 of the Information Technology Act, 2000. The policy also aims to control access to these protected systems by authorizing specific individuals and groups. **4. Background and Rationale:** The policy likely addresses the growing threat of cyberattacks targeting critical infrastructure, including financial institutions. By declaring specific LIC computer resources as CII, the government aims to enhance their security posture and prevent disruptions to essential services provided by LIC. The designation reflects a proactive approach to cybersecurity in the face of increasing digital threats to the insurance sector. **5. Key Provisions / Changes:** * The notification declares the computer resources related to the following LIC systems as protected systems: * Electronic Front End Application Program * Business Application * Enterprise Document Management System * Digitisation of Documents Application * Associated dependencies of the above. * The notification authorizes the following personnel to access the protected systems: * Any designated employee of LIC authorized in writing by LIC. * Any team member of contractual managed service providers or third-party vendors authorized in writing by LIC for need-based access. * Any consultant, regulator, Government official, auditor, and stakeholder authorized in writing by LIC on a case-to-case basis. **6. Target Audience and Stakeholders:** The primary target audience and stakeholders are: * The Life Insurance Corporation of India (LIC) and its employees. * Contractual managed service providers and third-party vendors working with LIC. * Consultants, regulators, government officials, auditors, and other stakeholders who require access to LIC's computer systems. * The Ministry of Electronics and Information Technology (MeitY). **7. Implementation Aspects (Inferred):** * **Responsible agency/bodies:** The Ministry of Electronics and Information Technology (MeitY) is the issuing authority. LIC is responsible for implementing the access control measures outlined in the notification. * **Timelines or procedures:** The notification is effective from the date of its publication in the Gazette of India (September 7, 2022). The procedures for authorizing access to the protected systems are to be determined and implemented by LIC. * The phrase "authorised in writing by the Life Insurance Corporation of India" suggests that LIC will need to create internal procedures for authorizing access to the protected systems. This likely involves documenting the authorization process and maintaining records of authorized personnel. **8. Expected Outcomes / Impact of Changes:** The expected outcomes and impact of this policy are: * Enhanced security of LIC's critical computer resources. * Reduced risk of cyberattacks and data breaches. * Improved business continuity for LIC's operations. * Increased confidence among policyholders and stakeholders in LIC's ability to protect sensitive information. * Greater regulatory oversight and accountability for LIC's cybersecurity practices. **9. Conclusion:** The declaration of specific LIC computer resources as Critical Information Infrastructure is a significant step towards strengthening the cybersecurity posture of a vital financial institution. By implementing the access control measures outlined in the notification, LIC can better protect its systems from unauthorized access and potential disruptions. This policy underscores the government's commitment to safeguarding critical infrastructure and ensuring the stability of the Indian financial sector.

Key Entities Referenced