Examine whether India's legal and institutional framework for protecting critical information infrastructure is enough to deal with third-party and contractor risks.

The IT Act, 2000 defines Critical Information Infrastructure (CII) as a computer resource whose loss would have a "debilitating impact" on national security, the economy or public safety [1]. In 2026, files linked to the Kudankulam nuclear project were reportedly leaked from a contractor's data-centre server, not from the plant itself. The framework protects the plant well but is weak in the supply chain.

Existing framework: real strengths

• Legal base: Section 70 allows protected systems to be declared, and NCIIPC under Section 70A follows up on compliance with the Protected System Rules, 2018 [1].
• Audit capacity: CERT-In uses empanelled auditors, with 1,579 audits in the power and energy sector in 2024-25 [2].
• Sector-level checks: CSIRT-Power (2023) and the CEA's 2021 guidelines require third-party audits [3] and buying from "trusted sources" [4]. Since 2018, imported power equipment must be tested in India for embedded malware [5].
• Nuclear-specific: CERT-In and CISAG-DAE handled the 2019 KKNPP malware case, and the control systems are isolated from outside networks [6]. AERB and other government agencies carry out periodic security assessments [7].

Gaps in covering third parties

• Protection depends on notification: a contractor's rented server holding reactor drawings is protected only if it is formally declared [1].
• Thin specialist oversight: NCIIPC carried out only 46 audits in the whole energy sector [2], so vendors and their data hosts come last.
• Checks only on what comes in: supply-chain rules test the hardware arriving, not the design data going out to EPC firms [5].
• The 2019 lessons stayed inside the fence: the fixes were internet hardening and limits on removable media within the plant [6].
• Split accountability: nuclear plants sit outside CSIRT-Power. Audits cover plant sites, not vendors' IT systems [7].
• Old policy: the National Cyber Security Policy, 2013 predates today's level of outsourcing to cloud services and data centres [8].

Way forward

• Use Section 70's "indirectly affects" scope to declare contractor data stores as protected systems.
• Write data-handling, deletion and immediate breach-reporting clauses into EPC contracts.
• Require yearly CERT-In-empanelled audits of every vendor that holds plant data.

The framework is strong inside the plant but stops at its fence. A new National Cyber Security Strategy should extend accountability across the whole supply chain. That would protect India's nuclear and energy build-out as part of the national-security mandate under Article 355 and SDG 9 (resilient infrastructure).