Critical Infrastructure Protection — Tech Evolutions

Entry	Year	Description	Impact
IT Amendment 2008	2008	Sections 35 and 36 of the Information Technology (Amendment) Act, 2008 (Act 10 of 2009) changed the statutory architecture for critical information infrastructure. The revised section 70 permits the appropriate Government to notify computer resources affecting critical information infrastructure as protected systems. Its definition turns on the debilitating consequences of incapacitation or destruction for national security, the economy, public health or safety. New section 70A provides for a notified national nodal agency responsible for measures including research and development for protection.	Criticality concerns the consequence of failure, while protected-system status involves a legal notification. A hospital network can be operationally crucial without the student being entitled to assume that every one of its devices has been notified under section 70. Map the essential service, its digital dependencies and the relevant statutory designation separately. The amendment establishes the framework; identifying a particular nodal organisation or protected system requires its separate notification.