Critical Infrastructure Protection — Scientific Principles

Scientific Principles

Identify the essential service first, then map its digital dependencies. A power, health or transport function may rely on communications, control systems, suppliers and shared services. A resource becomes critical through the consequences of its loss or compromise, not merely through a large user count. Dependency mapping also reveals how an incident in one organisation can affect others.

Confidentiality, integrity and availability remain relevant, but their operational consequences differ. Incorrect control data can produce harmful decisions even when a network remains available. Loss of availability can interrupt a service without a public data leak. An assessment should therefore connect technical failure to the affected function rather than rank incidents only by the number of records disclosed.

India's institutional distinction is NCIIPC under IT Act section 70A for critical information infrastructure and CERT-In under section 70B for incident response. Their roles are related but not interchangeable. NIST CSF 2.0, published in 2024, supplies a broader governance-and-risk framework; it does not replace Indian statutory responsibilities.

Resilience includes segmentation, appropriate access, monitored events, coordinated response and tested restoration. Operational technology may have safety and continuity constraints that require careful change management. Redundancy must be assessed for shared dependencies: two systems relying on the same vulnerable power or network source may fail together. A fallback plan needs exercises and clear authority to move between degraded and normal operation.