Critical Infrastructure Protection — Prelims Strategy

Prelims Strategy

Read criticality as a consequence test. A resource's loss must have the specified debilitating impact; traffic volume or commercial prominence alone does not establish it. Then separate statutory roles: NCIIPC corresponds to section 70A and critical information infrastructure, while CERT-In corresponds to section 70B and incident response. The two can be relevant to the same event without becoming the same institution.

In resilience scenarios, inspect common dependencies. Two servers do not supply independent protection if both depend on the same failed power source. A backup is useful for restoration, but untested restoration leaves timing and completeness uncertain. Distinguish prevention of an incident from reducing its consequences after prevention fails.

For operational systems, examine whether a proposed change preserves safe operation and continuity. An immediate update may appear prudent but still require assessment and testing in the relevant setting. The correct answer should match the stated circumstances, not assert that either delaying updates or applying them instantly is a universal policy.