Distinguish between safety-critical and non-critical (balance-of-plant) systems in nuclear facilities. Why is this distinction important for national security policy?

A nuclear station is not one uniform network. International practice grades its digital and physical systems into security zones by safety significance [1]. The reported Kudankulam data leak — which NPCIL said involved only "conventional balance of plant" drawings — has made this classification a live national security question.

Safety-critical systems

• Systems that directly perform a reactor safety function: reactor protection and shutdown, control-rod drives, emergency core cooling, containment and radiation monitoring, and the core instrumentation & control of the VVER-1000 units at Kudankulam [2].
• Failure or manipulation carries a radiological consequence; hence the highest zone of defence-in-depth — air-gapping from corporate, vendor and internet networks, with strict media and access controls [1].
• Every stage of their erection and commissioning requires AERB consent, as with the recent permission for major equipment erection at KKNPP Units 5 & 6 [3].

Non-critical / balance-of-plant (BoP) systems

• Conventional service facilities — raw-water and cooling circuits, ventilation, pipelines, roads, switchyard and turbine-side auxiliaries — supporting generation but performing no safety function.
• Largely executed through EPC contractors and OEM vendors, whose engineering data sits on commercial servers outside the operator's protected network — the reported breach vector.
• Compromise means outage and economic loss, not radioactivity release.

Why the distinction matters for policy

• It enables proportionate response: neither public panic nor complacency, since BoP loss remains strategically significant.
• Aggregation risk — layouts, vendor lists and service routes let an adversary map physical dependencies and sabotage entry points without touching the core [1].
• It shifts protection from the plant boundary to the supply chain: CII designation and audits by NCIIPC [4], mandatory incident reporting to CERT-In [5], and "restricted information" duties under the Atomic Energy Act, 1962 [6] must flow contractually to third parties.

Classification is therefore the foundation of graded, affordable protection rather than a way to downplay breaches. India should extend cyber-security obligations into every vendor contract and audit them independently, so that the expansion toward 100 GW nuclear capacity by 2047 rests on trust that is engineered, not merely asserted.