Notification issued under Section 70 of IT ACT

## Policy Analysis Report: Declaration of Critical Information Infrastructure for National Payments Corporation of India **1. Executive Summary:** This report analyzes a notification issued by the Ministry of Electronics and Information Technology, Government of India, declaring specific computer resources related to the National Payments Corporation of India (NPCI) as Critical Information Infrastructure (CII) under the Information Technology Act, 2000. This includes Unified Payments Interface (UPI), Immediate Payment Service (IMPS), and National Financial Switch (NFS). The notification also outlines authorized personnel allowed access to these protected systems. The core purpose is to enhance the security and protection of these vital payment systems. **2. Introduction:** This report provides an overview and analysis of a recent notification concerning the protection of computer resources related to the National Payments Corporation of India (NPCI). The analysis is based solely on the provided government policy text. **3. Policy Overview:** * This is a new policy declaration. * **Core Objective(s):** The core objective, as inferred from the text, is to protect the computer resources relating to the Unified Payments Interface, Immediate Payment Service and National Financial Switch, being Critical Information Infrastructure of the National Payments Corporation of India, and the computer resources of its associated dependencies. This is to ensure the security and integrity of India's critical payment infrastructure by designating it as a "protected system" under the Information Technology Act, 2000. **4. Background and Rationale:** As this is a new policy declaration, the likely problem it addresses is the increasing vulnerability of critical digital infrastructure to cyber threats. Given the importance of UPI, IMPS, and NFS to the Indian economy, their disruption could have severe consequences. This policy aims to mitigate those risks by providing a legal framework for their protection and restricting access to authorized personnel. **5. Key Provisions / Changes:** As this is a new policy declaration, the key provision of the policy is the declaration of the computer resources related to UPI, IMPS, and NFS, managed by the NPCI, as Critical Information Infrastructure and designating them as protected systems under the Information Technology Act, 2000. Additionally, the policy defines who is authorized to access the protected systems: * Any designated employee of the National Payments Corporation of India authorized by the National Payments Corporation of India to access the protected system * Any team member of contractual managed service provider or thirdparty vendor who have been authorised by the National Payments Corporation of India for needbased access * Any consultant, regulator, government official, auditor and stakeholder authorized by the National Payments Corporation of India on case to case basis **6. Target Audience and Stakeholders:** The target audience and stakeholders directly affected by this policy include: * The National Payments Corporation of India (NPCI) * Employees of NPCI with designated access to the protected systems * Managed service providers and third-party vendors working with NPCI * Consultants, regulators, government officials, auditors, and stakeholders interacting with NPCI's payment systems * Financial institutions using UPI, IMPS, and NFS. * Ultimately, all users of these payment systems are indirectly affected. **7. Implementation Aspects (Inferred):** * **Responsible agency/bodies:** The Ministry of Electronics and Information Technology (MeitY) is responsible for issuing the notification. The NPCI is responsible for authorizing access to the protected systems and ensuring compliance. * **Timelines or procedures:** The notification comes into force on the date of its publication in the Official Gazette (June 17, 2022). The NPCI needs to establish internal procedures for designating employees and authorizing access for external parties. **8. Expected Outcomes / Impact of Changes:** The likely intended outcomes of this policy are: * Enhanced security and resilience of UPI, IMPS, and NFS against cyberattacks. * Clearer accountability and access control mechanisms for these critical systems. * Increased confidence in the stability and reliability of India's digital payments infrastructure. * Improved regulatory oversight of NPCI's security practices. **9. Conclusion:** The notification declaring computer resources related to UPI, IMPS, and NFS as Critical Information Infrastructure is a significant step towards strengthening the security and stability of India's digital payments ecosystem. By designating these systems as "protected systems" and defining authorized access, the government aims to reduce the risk of disruption and enhance the overall resilience of the financial infrastructure. This policy underscores the growing importance of cybersecurity in the digital age and its impact on the national economy.

Key Entities Referenced