Notification issued under Section 70 of IT ACT

## Policy Analysis Report: Declaration of Protected Systems for ICICI Bank's Critical Information Infrastructure **1. Executive Summary:** This report analyzes a notification issued by the Ministry of Electronics and Information Technology (MeitY), Government of India, declaring specific computer resources of ICICI Bank as "protected systems" under the Information Technology Act, 2000. The core purpose is to protect the Core Banking Solution, Real Time Gross Settlement, and National Electronic Fund Transfer systems (including the Structured Financial Messaging Server) from unauthorized access, considering them critical information infrastructure. Key findings include the designation of specific personnel authorized to access these protected systems. **2. Introduction:** This report provides an overview and analysis of Notification S.O. 2808(E), issued by the Ministry of Electronics and Information Technology on June 16, 2022. The report aims to inform stakeholders about the policy's objectives, key provisions, and potential implications, based solely on the provided text. **3. Policy Overview:** * This is a new policy declaration, not an amendment. * **Core Objective(s):** The core objective, inferred from the text, is to safeguard critical information infrastructure related to core banking and payment systems of ICICI Bank. This is achieved by declaring specific computer resources as "protected systems" under the Information Technology Act, 2000. **4. Background and Rationale:** As a new policy, this declaration likely addresses the growing need to protect critical banking infrastructure from cyber threats and unauthorized access. The designation of ICICI Bank's Core Banking Solution, Real Time Gross Settlement, and National Electronic Fund Transfer systems suggests a recognition of their importance to the financial stability and economic security of the nation. **5. Key Provisions:** The notification establishes the following key provisions: * **Designation of Protected Systems:** Declares the computer resources relating to the Core Banking Solution, Real Time Gross Settlement, and National Electronic Fund Transfer (including the Structured Financial Messaging Server) of ICICI Bank as "protected systems." It also includes the computer resources of its associated dependencies. * **Authorization of Access:** Authorizes specific categories of personnel to access the protected systems: * Any designated employee authorized by ICICI Bank. * Authorized team members of contractual managed service providers or third-party vendors authorized by ICICI Bank for need-based access. * Consultants, regulators, government officials, auditors, and stakeholders authorized by ICICI Bank on a case-by-case basis. * **Effective Date:** The notification comes into force on the date of its publication in the Official Gazette (June 17, 2022). **6. Target Audience and Stakeholders:** The primary target audience and stakeholders directly affected by this policy include: * ICICI Bank and its employees. * ICICI Bank's contractual managed service providers and third-party vendors. * Consultants, regulators, government officials, auditors, and other stakeholders who may require access to the designated protected systems. * The Reserve Bank of India (RBI) as the regulator of banking systems. **7. Implementation Aspects (Inferred):** * **Responsible Agency/Bodies:** The Ministry of Electronics and Information Technology (MeitY) is the responsible agency for issuing the notification. ICICI Bank is responsible for implementing the authorization controls regarding access to the protected systems. * **Timelines or Procedures:** The notification states that it comes into force on the date of publication in the Official Gazette. It does not specify detailed timelines or procedures for implementation beyond the need for ICICI Bank to authorize access based on the categories outlined in the notification. **8. Expected Outcomes / Impact:** The likely intended outcomes of this policy are: * Enhanced security and protection of ICICI Bank's critical information infrastructure. * Reduced risk of unauthorized access, cyberattacks, and data breaches affecting core banking and payment systems. * Increased confidence in the stability and reliability of ICICI Bank's services. * Compliance with the Information Technology Act, 2000. **9. Conclusion:** The notification declaring ICICI Bank's core banking and payment system infrastructure as "protected systems" is a significant step towards safeguarding critical financial infrastructure. By clearly defining the scope of protection and authorizing specific personnel for access, the policy aims to enhance the security and resilience of ICICI Bank's essential services. This declaration underscores the government's commitment to protecting critical information infrastructure and ensuring the stability of the financial sector.

Key Entities Referenced