Critical Information Infrastructure — Ecological Framework

Ecological Framework

Three layers of the problem

1. Essential function and consequences. Identify the service and the harm that could follow loss of its supporting computer resources. The statutory concept concerns debilitating impact on national security, the economy, public health or safety. A popular website is not automatically critical infrastructure merely because it has many visitors.

2. Legal and institutional framework. Section 70 supports notification of protected systems. NCIIPC is the nodal agency for CII protection under section 70A; CERT-In is the incident-response agency under section 70B. Distinct roles can require coordination rather than isolation.

3. Operational capability. Map assets to services and dependencies. Maintain appropriate access controls, system upkeep, separation of functions, incident arrangements and recovery capability. The 2023 CERT-In guidance for government entities provides a defensive framework.

Three properties to assess

Confidentiality: information is not disclosed without authority.
Integrity: information and operations remain trustworthy and authorised.
Availability: the service is accessible when needed.

An outage or corrupted record can harm an essential service without a public data leak. This is why confidentiality alone is not a complete assessment.

A recovery check

Two computers sharing one indispensable connection are not independent against failure of that connection. A stored backup is also not proof that restoration works. Test the recovery process and its dependencies against the service's needs.

Separate asset inventories, legal designations and demonstrated resilience. Each is useful, but none can stand in for all the others. Avoid invented breach totals or sensitive operational details when making the policy argument.