Notification issued under Section 70 of IT ACT

## Report on Notification Regarding Critical Information Infrastructure Protection for HDFC Bank **1. Executive Summary:** This report analyzes a notification issued by the Ministry of Electronics and Information Technology, Government of India, dated June 16, 2022. The notification declares specific computer resources of HDFC Bank, relating to Core Banking Solution, Real Time Gross Settlement, and National Electronic Fund Transfer, as Critical Information Infrastructure. It also authorizes specific personnel to access these protected systems. The core purpose is to enhance the security and resilience of critical banking infrastructure. Key findings include the designation of specific systems as protected and the authorization of access to these systems under controlled conditions. **2. Introduction:** This report provides an overview and analysis of the Ministry of Electronics and Information Technology notification, dated June 16, 2022, concerning the protection of critical information infrastructure related to HDFC Bank. The analysis is based solely on the content of the provided text. **3. Policy Overview:** * This is a new policy declaration, not an amendment. * **Core Objective(s):** Based on the text, the core objective is to protect the computer resources related to HDFC Bank's Core Banking Solution, Real Time Gross Settlement (RTGS), and National Electronic Fund Transfer (NEFT) systems, including the Structured Financial Messaging Server, by designating them as Critical Information Infrastructure. This implies a focus on ensuring the security and uninterrupted operation of these systems. **4. Background and Rationale:** The policy addresses the potential vulnerability of critical banking systems to cyber threats or other disruptions. By designating these systems as Critical Information Infrastructure, the government aims to enhance their protection against potential attacks that could destabilize the financial system. The Information Technology Act, 2000, provides the legal framework for this action, suggesting a pre-existing concern about the security of such infrastructure. **5. Key Provisions / Changes:** As this is a new policy declaration, the key provisions are as follows: * **Designation of Critical Information Infrastructure:** The computer resources pertaining to HDFC Bank's Core Banking Solution, Real Time Gross Settlement, and National Electronic Fund Transfer, including the Structured Financial Messaging Server, are officially declared as Critical Information Infrastructure. * **Protected Systems:** These designated computer resources and their associated dependencies are classified as "protected systems" under the Information Technology Act, 2000. * **Authorized Personnel:** The notification authorizes specific categories of personnel to access these protected systems: * Any designated employee authorized by HDFC Bank. * Authorized team members of contractual managed service providers or third-party vendors who have been authorized by HDFC Bank for need-based access. * Consultants, regulators, government officials, auditors, and stakeholders authorized by HDFC Bank on a case-by-case basis. **6. Target Audience and Stakeholders:** The directly affected stakeholders include: * **HDFC Bank:** As the owner of the critical infrastructure, HDFC Bank is directly responsible for implementing the security measures and managing access to the protected systems. * **Employees of HDFC Bank:** Designated employees require authorization protocols to access the protected systems. * **Managed Service Providers and Third-Party Vendors:** These entities, if contractually involved with HDFC Bank, will need authorization processes for their team members to access the protected systems. * **Regulators, Government Officials, Auditors:** These individuals require authorization by HDFC bank on a case-by-case basis for access. **7. Implementation Aspects (Inferred):** * **Responsible Agency:** The Ministry of Electronics and Information Technology (MeitY) is the responsible agency, as indicated by the notification's origin. HDFC Bank is responsible for implementing the policy's provisions within its organization. * **Timelines:** The notification came into force on the date of its publication in the Official Gazette (June 16, 2022). * **Procedures:** HDFC Bank is expected to establish procedures for authorizing personnel (employees, vendors, consultants, etc.) to access the protected systems. The degree to which this authorization is auditable by the government can not be determined from the text. **8. Expected Outcomes / Impact of Changes:** The likely intended outcomes include: * **Enhanced Security:** Strengthening the security of HDFC Bank's critical banking infrastructure against cyber threats and disruptions. * **Improved Resilience:** Ensuring the continued operation of essential banking services (Core Banking, RTGS, NEFT) even in the face of potential attacks. * **Increased Oversight:** Facilitating regulatory oversight of the bank's security measures by providing a framework for access by regulators and auditors. * **Controlled Access:** Regulating and limiting access to critical systems to only authorized personnel, thereby reducing the risk of insider threats or unauthorized modifications. **9. Conclusion:** The Ministry of Electronics and Information Technology notification designates HDFC Bank's critical banking infrastructure as "protected systems," aiming to enhance its security and resilience. This action underscores the government's commitment to safeguarding the nation's financial infrastructure. The implementation of this policy will require HDFC Bank to establish robust access control mechanisms and adhere to security best practices, contributing to the overall stability of the banking sector.

Key Entities Referenced