Distinguish between safety-critical and non-critical (balance-of-plant) systems in nuclear facilities. Why is this distinction important for national security policy?

Q. Distinguish between safety-critical and non-critical (balance-of-plant) systems in nuclear facilities. Why is this distinction important for national security policy? (15 marks, 250-350 words)

A nuclear station is not one uniform network. International practice grades its digital and physical systems into security zones by safety significance [1]. The reported Kudankulam data leak — which NPCIL said involved only "conventional balance of plant" drawings — has made this classification a live national security question.

Safety-critical systems - Systems that directly perform a reactor safety function: reactor protection and shutdown, control-rod drives, emergency core cooling, containment and radiation monitoring, and the core instrumentation & control of the VVER-1000 units at Kudankulam [2]. - Failure or manipulation carries a radiological consequence; hence the highest zone of defence-in-depth — air-gapping from corporate, vendor and internet networks, with strict media and access controls [1]. - Every stage of their erection and commissioning requires AERB consent, as with the recent permission for major equipment erection at KKNPP Units 5 & 6 [3].

Non-critical / balance-of-plant (BoP) systems - Conventional service facilities — raw-water and cooling circuits, ventilation, pipelines, roads, switchyard and turbine-side auxiliaries — supporting generation but performing no safety function. - Largely executed through EPC contractors and OEM vendors, whose engineering data sits on commercial servers outside the operator's protected network — the reported breach vector. - Compromise means outage and economic loss, not radioactivity release.

Why the distinction matters for policy - It enables proportionate response: neither public panic nor complacency, since BoP loss remains strategically significant. - Aggregation risk — layouts, vendor lists and service routes let an adversary map physical dependencies and sabotage entry points without touching the core [1]. - It shifts protection from the plant boundary to the supply chain: CII designation and audits by NCIIPC [4], mandatory incident reporting to CERT-In [5], and "restricted information" duties under the Atomic Energy Act, 1962 [6] must flow contractually to third parties.

Classification is therefore the foundation of graded, affordable protection rather than a way to downplay breaches. India should extend cyber-security obligations into every vendor contract and audit them independently, so that the expansion toward 100 GW nuclear capacity by 2047 rests on trust that is engineered, not merely asserted.

(~325 words)

Sources: 1. IAEA Nuclear Security Series No. 17-T (Rev. 1), Computer Security Techniques for Nuclear Facilities — security zoning, defence-in-depth, isolation of safety systems, aggregation of information risk 2. NPCIL — Kudankulam Site — VVER-1000 units, site capacity and plant systems 3. PIB — AERB issues Permission for Major Equipment Erection at Units 5&6 of Kudankulam Nuclear Power Project — AERB's stage-wise regulatory consent 4. National Critical Information Infrastructure Protection Centre (NCIIPC) — CII identification, audits and protection mandate under Section 70A, IT Act 2000 5. Indian Computer Emergency Response Team (CERT-In) — national nodal agency for cyber incident reporting and response 6. The Atomic Energy Act, 1962 — restricted information and control provisions governing atomic energy activities