Declares the computer resources relating to the Network Elements specified under column 2 of the table below of the Licensed Telecom service providers network specified in the corresponding entry under column3 of the said table, being Critical Information Infrastructure, along with the computer resources of its associated dependencies to be a Protected System for the purpose of the said Act

## Policy Analysis Report: Declaration of Critical Information Infrastructure for Licensed Telecom Service Providers **1. Executive Summary:** This report analyzes a notification issued by the Ministry of Electronics and Information Technology, Government of India, declaring specific computer resources related to the network elements of Licensed Telecom Service Providers (LTSPs) as Critical Information Infrastructure (CII) and Protected Systems under the Information Technology Act, 2000. The core purpose is to enhance the security and protection of vital telecom infrastructure. The key finding is that the policy outlines a comprehensive list of network elements, spanning from international gateways to internal systems, to be treated as CII, imposing stricter security requirements on LTSPs. **2. Introduction:** This report provides an overview and analysis of the Ministry of Electronics and Information Technology’s notification regarding the declaration of specific computer resources of Licensed Telecom Service Providers (LTSPs) as Critical Information Infrastructure (CII). The analysis is based solely on the provided text of the notification. **3. Policy Overview:** This is a new policy declaration, not an amendment. * **Core Objective(s):** The primary objective, inferred from the text, is to protect critical telecom infrastructure by designating specific network elements as Critical Information Infrastructure (CII) and Protected Systems. This aims to enhance the cybersecurity posture of LTSPs and safeguard essential communication networks. The notification leverages the powers conferred by subsection 1 of section 70 of the Information Technology Act, 2000 to enact this protection. **4. Background and Rationale:** As a new policy declaration, this likely addresses the increasing need to protect essential telecommunication infrastructure from cyber threats. The text implicitly acknowledges the vulnerability of telecom networks and the potential impact of disruptions on national security and economic stability. Designating specific network elements as CII suggests a targeted approach to prioritize and fortify the most critical components of the telecom ecosystem. **5. Key Provisions / Changes:** The core provision of this notification is the declaration of specific computer resources associated with various network elements of LTSPs as Critical Information Infrastructure (CII) and Protected Systems. The key components established by this policy are: * **Designation of CII:** The policy explicitly identifies and lists specific network elements within the telecom infrastructure that are deemed critical. These elements include: * International Border Gateway Router * Element Management System * Network Management System (Specific to BSNL & MTNL) * Security Operation Centre (Specific to BSNL & MTNL) * Network Operations Centre (Specific to BSNL & MTNL) * Home Subscriber Server or Home Location Register (Specific to BSNL & MTNL) * Short Message Service Centre (Specific to BSNL & MTNL) * Serving Gateway (Specific to BSNL & MTNL) * Billing Server and Call Detail Record Server (Specific to BSNL & MTNL) * Serving General Packet Radio Service Support Node or Gateway General Packet Radio Service Support Node (Specific to BSNL & MTNL) * Packet Data Network Gateway (Specific to BSNL & MTNL) * Route Reflector (Specific to BSNL & MTNL) * Authentication, Authorisation and Accounting (Specific to BSNL & MTNL) * Active Directory (Specific to BSNL & MTNL) * Domain Name Service (Specific to BSNL & MTNL) * Cable Landing Station (Specific to BSNL & MTNL) * **Scope of Protection:** The designation extends to the "computer resources of its associated dependencies," indicating a comprehensive approach to protecting not only the core elements but also related systems. * **Legal Basis:** The action is taken under the authority of Section 70(1) of the Information Technology Act, 2000, providing a legal framework for the declaration and subsequent enforcement. **6. Target Audience and Stakeholders:** The primary target audience and stakeholders are: * **Licensed Telecom Service Providers (LTSPs):** The policy directly affects all licensed telecom operators in India, as it mandates stricter security measures for their designated network elements. Some provisions only affect Ms Bharat Sanchar Nigam Limited and Ms Mahanagar Telephone Nigam Limited. * **Ministry of Electronics and Information Technology (MeitY):** As the issuing authority, MeitY is responsible for overseeing the implementation and enforcement of this policy. * **Government of India:** The government benefits from enhanced security of critical communication infrastructure. **7. Implementation Aspects (Inferred):** * **Responsible Agency/Bodies:** The Ministry of Electronics and Information Technology (MeitY) is the responsible agency. * **Timelines/Procedures:** The notification itself does not specify timelines or procedures for implementation. These details would likely be outlined in subsequent guidelines or directives issued by MeitY. * It can be inferred that LTSPs are responsible for implementing necessary security measures to protect the designated network elements. **8. Expected Outcomes / Impact of Changes:** The likely intended outcomes of this policy declaration include: * **Enhanced Cybersecurity Posture:** Increased security measures and monitoring of critical network elements. * **Reduced Vulnerability:** Mitigation of potential cyber threats and disruptions to essential telecom services. * **Improved Resilience:** Strengthening the overall resilience of the telecom infrastructure against cyberattacks. * **Compliance Requirements:** LTSPs are now subject to greater compliance requirements and scrutiny regarding the security of their CII. **9. Conclusion:** The Ministry of Electronics and Information Technology's notification declaring specific computer resources of LTSPs as Critical Information Infrastructure is a significant step towards strengthening the cybersecurity of India's telecommunications sector. By designating key network elements as CII and Protected Systems under the IT Act, the policy aims to enhance the protection of vital communication networks against evolving cyber threats. While the notification provides a clear framework for CII designation, the specific implementation details and enforcement mechanisms will be crucial in determining its overall effectiveness. The policy is significant due to the reliance of modern infrastructure on telecommunications.

Key Entities Referenced