Office Memorandum - Delegation of power to Additional secretary on behalf of Hon'ble Minister of Electronics and IT to approve notification for declaring any computer resource which directly or indirectly affects the facility of Critical Information Infrastructure

## Report on Delegation of Power Regarding Protection of Critical Information Infrastructure **1. Executive Summary:** This report analyzes a Government of India Office Memorandum (O.M.) dated March 22, 2023, concerning the delegation of power to the Additional Secretary of the Ministry of Electronics and Information Technology (MeitY) to approve notifications for declaring computer resources affecting Critical Information Infrastructure (CII) as protected systems. The memorandum aims to streamline the process of designating and protecting CII by delegating approval authority. The key finding is that this amendment empowers the Additional Secretary, based on recommendations from relevant ministries/departments and evaluation by the National Critical Information Infrastructure Protection Centre (NCIIPC), to expedite the protection of vital digital assets. **2. Introduction:** The purpose of this report is to provide an informative overview of the Office Memorandum No. 252022CL, issued by the Ministry of Electronics and Information Technology on March 22, 2023. This report analyzes the policy as written, focusing on its objectives, key changes, affected stakeholders, and anticipated outcomes based solely on the provided text. This amendment focuses on delegation of power within the MeitY. **3. Policy Overview:** * **Core Objective(s) (Inferred):** The core objective is to delegate authority for approving notifications related to the protection of Critical Information Infrastructure (CII) to the Additional Secretary within MeitY. This is likely intended to improve the efficiency and responsiveness of the process for safeguarding vital computer resources. **4. Background and Rationale:** * **Rationale for Amendment (Inferred):** The amendment suggests a need to expedite the process of declaring computer resources affecting CII as protected systems. Delegating the approval authority to the Additional Secretary likely aims to reduce bureaucratic delays and ensure a more timely response to potential threats or vulnerabilities affecting CII. This delegation of power should streamline and accelerate the process **5. Key Provisions / Changes:** * **Specific Part of Original Policy Being Changed (Inferred):** The original policy likely involved a more cumbersome approval process for declaring computer resources as protected systems, potentially requiring approval from the Minister of Electronics and Information Technology directly. * **New Rule/Provision:** The primary change is the delegation of approval authority to the Additional Secretary in MeitY dealing with Cyber Laws, allowing them to approve notifications for declaring computer resources affecting CII as protected systems. This approval is contingent on recommendations from Central Ministries/Departments and evaluation by the NCIIPC. * **Difference/Effect of Change:** This delegation shifts the approval responsibility from the Minister to the Additional Secretary. This change is expected to reduce the time required to issue notifications, leading to faster protection of CII. The Additional Secretary is now the key decision-maker in this process, provided the recommendations and evaluations are positive. **6. Target Audience and Stakeholders:** The direct target audience and stakeholders include: * **Additional Secretary, MeitY (Cyber Laws):** The primary individual directly impacted by this delegation of power. * **Central Ministries/Departments:** These entities are responsible for providing recommendations for computer resources to be declared as protected systems. * **National Critical Information Infrastructure Protection Centre (NCIIPC):** The NCIIPC plays a crucial role in evaluating the computer resources and providing recommendations to the Additional Secretary. * **The Ministry of Electronics and Information Technology (MeitY) as a whole** benefits from the increased efficiency. * **Indirectly:** Organizations relying on Critical Information Infrastructure (e.g., financial institutions, energy providers, healthcare providers) are affected, as their systems will potentially receive enhanced protection more quickly. **7. Implementation Aspects (Inferred):** * **Responsible Agency/Bodies:** * Ministry of Electronics and Information Technology (MeitY). * National Critical Information Infrastructure Protection Centre (NCIIPC). * Relevant Central Ministries/Departments. * **Timelines/Procedures:** While the exact timelines are not specified, the amendment implies a faster approval process due to the delegation of authority. The procedure involves recommendations from Central Ministries/Departments, evaluation by the NCIIPC, and finally, approval and notification by the Additional Secretary. * **Implementation of Changes:** The change primarily affects the internal workflow within MeitY. The Additional Secretary, along with their office, will need to adapt to the new approval responsibilities. NCIIPC and Central Ministries/Departments must continue to provide timely and thorough assessments. **8. Expected Outcomes / Impact of Changes:** * **Likely Intended Outcome of Changes:** The primary intended outcome is a more efficient and timely process for declaring and protecting computer resources affecting CII. This should lead to enhanced security and resilience of critical infrastructure against cyber threats. This in turn improves protection for organizations using such resources. This delegation of power is expected to reduce bureaucratic bottlenecks and improve responsiveness to emerging threats. **9. Conclusion:** The delegation of power to the Additional Secretary within MeitY for approving notifications regarding the protection of Critical Information Infrastructure represents a strategic administrative adjustment. By streamlining the approval process, the amendment aims to improve the government's ability to safeguard vital computer resources against potential cyber threats. This change is significant for all stakeholders involved in the operation and protection of CII, as it promises a more agile and responsive approach to cybersecurity. This is expected to be an efficiency improvement.

Key Entities Referenced