The National Critical Information Infrastructure Protection Centre (NCIIPC) is India's national nodal agency responsible for protecting the country's Critical Information Infrastructure (CII) from cyber threats. It works to identify critical digital systems, assess vulnerabilities, share threat intelligence and coordinate security measures with organisations that operate essential infrastructure.
Power networks, banking systems, telecommunications, transportation and other essential services depend on digital infrastructure. A serious cyberattack or disruption affecting certain systems in these sectors can have consequences for national security, the economy, public safety and the delivery of essential services.
NCIIPC helps reduce these risks through national-level coordination, security guidance, threat intelligence, vulnerability assessments and other protective measures. However, the organisations operating critical systems remain responsible for implementing appropriate security controls and protecting their own infrastructure.
NCIIPC operates under the National Technical Research Organisation (NTRO) and has its legal foundation in Section 70A of the Information Technology Act, 2000.
What Is NCIIPC?
NCIIPC stands for National Critical Information Infrastructure Protection Centre. The Central Government designated it as India's national nodal agency for Critical Information Infrastructure protection under Section 70A of the Information Technology Act, 2000.
The Government notified the Information Technology (National Critical Information Infrastructure Protection Centre and Manner of Performing Functions and Duties) Rules, 2013 on 16 January 2014. These rules establish NCIIPC's institutional framework, define its functions and place it under the administrative control of NTRO.
NCIIPC works with relevant Government bodies, sector nodal officers and organisations operating critical infrastructure. Its central objective is to reduce cyber vulnerabilities and strengthen the security of systems whose disruption could seriously affect the country.
What Is Critical Information Infrastructure (CII)?
Critical Information Infrastructure (CII) means a computer resource whose incapacitation or destruction could have a debilitating impact on national security, the economy, public health or safety.
This definition comes from the Explanation to Section 70(1) of the Information Technology Act, 2000.
In simple terms, CII includes digital systems that support functions so important that their serious disruption could affect more than the organisation operating them.
Examples of sectors where critical information infrastructure may exist include:
- Power and energy: Digital systems used to manage electricity generation, transmission and distribution.
- Banking and financial services: Systems supporting important banking and financial operations.
- Telecommunications: Networks and systems that support essential communication services.
- Transportation: Digital infrastructure supporting important transport and operational functions.
- Government services: Computer resources supporting functions that may have significant national or public consequences.
These are examples of important sectors, not a declaration that every organisation, website, application or computer system within them automatically qualifies as CII. The potential consequences of incapacitation or destruction determine whether a particular computer resource falls within the legal definition.
The Government has also explained the importance of protecting CII in its official statement on national cybersecurity preparedness.
What Is a Protected System Under the IT Act?
A Protected System is a computer resource that the appropriate Government declares through a notification in the Official Gazette under Section 70 of the Information Technology Act, 2000.
Section 70 allows the appropriate Government to declare a computer resource that directly or indirectly affects the facility of Critical Information Infrastructure as a Protected System. The provision also regulates who may access such systems.
It is important to understand the difference between CII and a Protected System:
- Critical Information Infrastructure: A legal category defined by the potential impact of a computer resource's incapacitation or destruction.
- Protected System: A computer resource formally declared as protected through a Government Gazette notification under Section 70.
Therefore, CII and Protected System are closely connected, but they are not interchangeable terms. A Protected System declaration establishes specific legal safeguards and access restrictions. It does not mean that the system is immune to cyberattacks or technical failures.
You can read Section 70 and the related provisions in the Information Technology Act, 2000.
What Are the Main Functions and Responsibilities of NCIIPC?
NCIIPC performs several functions to strengthen the protection of India's critical information infrastructure. The Information Technology (NCIIPC and Manner of Performing Functions and Duties) Rules, 2013 provide the foundation for these responsibilities.
1. Identifying Critical Information Infrastructure
Identifying critical systems is an important part of infrastructure protection. NCIIPC identifies elements of critical information infrastructure for consideration and approval by the appropriate Government for notification.
This process helps the Government and relevant organisations determine which computer resources require special protection because their disruption could have serious national consequences.
2. Providing Threat Intelligence and Security Advisories
NCIIPC helps critical infrastructure organisations understand cyber threats that could affect their systems. It provides threat intelligence, situational awareness, alerts and advisories to relevant CII and Protected System entities.
These warnings help organisations identify potential risks and take preventive measures. For example, an organisation may use a relevant advisory to review its network security, examine exposed systems or strengthen protection against a known threat.
In an official Government statement published in 2026, the Ministry of Electronics and Information Technology confirmed that NCIIPC provides near real-time threat intelligence and situational awareness and periodically undertakes vulnerability and risk assessments of CII and Protected Systems.
Read the Government's explanation of NCIIPC's threat intelligence and assessment functions.
3. Developing Security Strategies, Standards and Guidelines
NCIIPC works to reduce vulnerabilities in critical information infrastructure by developing and supporting appropriate protection strategies, security practices and guidance.
Its responsibilities include advising relevant organisations on measures to protect critical systems against cyber terrorism, cyber warfare and other threats.
Security guidance helps organisations understand the protective measures they should consider while designing, operating, maintaining and upgrading critical systems. It also supports a more consistent approach to cybersecurity across important infrastructure sectors.
4. Conducting Vulnerability and Risk Assessments
Critical infrastructure systems require regular security assessments because their risk exposure can change over time. New software, system upgrades, third-party connections and emerging cyber threats can introduce weaknesses.
NCIIPC periodically undertakes vulnerability and risk assessments of critical information infrastructure and Protected Systems. It also provides feedback to the concerned organisations so they can address identified security gaps.
These assessments help infrastructure operators understand their security posture and decide which corrective measures require attention.
5. Supporting Cybersecurity Audits
Cybersecurity audits help organisations examine whether their systems follow appropriate information security practices and procedures. They can identify weaknesses in networks, applications, access controls and other parts of the technology environment.
NCIIPC and CERT-In both undertake cybersecurity audits in accordance with the Information Technology Act and applicable rules. Their work covers important infrastructure sectors, including power, transport and banking.
For example, the Government reported that NCIIPC conducted 90 audits during the financial year 2024–25 across the power and energy, transport, and banking, financial services and insurance sectors.
The figures were part of the Ministry of Electronics and Information Technology's official cybersecurity audit report for critical sectors.
Audits are useful when organisations act on their findings and implement appropriate corrective measures. Completing an audit alone does not guarantee that a system is secure.
6. Coordinating With Critical Infrastructure Organisations
Critical infrastructure protection requires cooperation between NCIIPC and the organisations responsible for operating important systems.
NCIIPC works with designated nodal officers, technical centres, Government agencies and relevant organisations to support information sharing and coordinated protective action.
The NCIIPC Rules, 2013 provide for nodal officers nominated by the appropriate Governments, their agencies, companies and other entities in designated critical sectors. These officers help communicate and coordinate matters related to CII protection.
7. Strengthening Cybersecurity Preparedness and Resilience
Protecting critical infrastructure is not limited to preventing cyberattacks. Organisations must also prepare to manage incidents, maintain essential operations and recover from disruptions.
NCIIPC contributes to this effort through security guidance, risk assessments, coordination and support for protective measures. Its work forms part of the broader national approach to strengthening cybersecurity preparedness.
The National Cyber Security Policy, 2013 also highlights the importance of protecting information infrastructure, reducing vulnerabilities and building the capacity to prevent and respond to cyber threats.
8. Promoting Research, Training and Awareness
Cybersecurity threats and technologies continue to evolve. Organisations therefore need updated knowledge, skilled personnel and better security practices to protect important digital systems.
NCIIPC's functions include research and development, training, awareness and cooperation with relevant stakeholders. These activities help strengthen technical capabilities and improve understanding of critical infrastructure security.
Its Rules also provide for cooperation with industry, academia and other national and international organisations on matters related to CII protection.
How Does NCIIPC Work With Organisations Operating Critical Infrastructure?
NCIIPC provides national-level coordination and protection guidance, but the organisation operating a critical system remains responsible for its security. This means infrastructure operators must establish appropriate internal security arrangements and follow the applicable Government requirements.
The Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018 prescribe security practices and procedures for organisations having Protected Systems.
These rules establish important organisational requirements, including:
- Information Security Steering Committee: The organisation must constitute a committee under the chairmanship of its Chief Executive Officer, Managing Director or Secretary to oversee the security of the Protected System.
- Chief Information Security Officer (CISO): The organisation must designate a CISO responsible for coordinating its information security efforts and initiatives.
- Security policies and controls: The organisation must develop, maintain, implement and review appropriate information security policies and controls.
- Risk assessment and audits: Security assessments and audits help identify weaknesses and support corrective action.
- Cyber incident coordination: The organisation must establish procedures for communicating relevant cyber incidents to NCIIPC and following applicable response procedures.
- Cyber crisis preparedness: Organisational arrangements should support coordinated action when a cyber incident affects a Protected System.
These requirements show that critical infrastructure protection is not the responsibility of a single national agency. NCIIPC provides coordination and specialised support, while the organisation operating the Protected System must maintain its own security arrangements.
What Is the Difference Between NCIIPC and CERT-In?
NCIIPC and CERT-In both contribute to India's cybersecurity framework, but they have different legal mandates and primary responsibilities.
NCIIPC is the national nodal agency for protecting Critical Information Infrastructure under Section 70A of the Information Technology Act, 2000. CERT-In is the national agency responsible for responding to cybersecurity incidents under Section 70B of the same Act.
| Basis | NCIIPC | CERT-In |
|---|---|---|
| Full name | National Critical Information Infrastructure Protection Centre | Indian Computer Emergency Response Team |
| Legal provision | Section 70A of the IT Act, 2000 | Section 70B of the IT Act, 2000 |
| Primary responsibility | Protection of critical information infrastructure | National cybersecurity incident response |
| Key activities | CII identification support, threat intelligence, risk assessments, advisories and coordination | Incident response, cybersecurity alerts, advisories and coordination with affected organisations |
| Administrative organisation | National Technical Research Organisation (NTRO) | Ministry of Electronics and Information Technology (MeitY) |
The distinction does not mean that CERT-In has no role in critical sectors. CERT-In also issues cybersecurity alerts, supports incident response and conducts audits involving Government organisations and critical infrastructure.
For a more detailed explanation, read our article on CERT-In and its role in India's cybersecurity framework.
How Is NCIIPC Different From I4C and Cybercrime Police?
India has several institutions that deal with different aspects of cybersecurity and cybercrime. NCIIPC focuses on critical infrastructure protection, while other agencies handle cybercrime coordination and law enforcement.
| Agency or organisation | Main responsibility |
|---|---|
| NCIIPC | Protecting India's critical information infrastructure and coordinating related security measures. |
| CERT-In | Responding to cybersecurity incidents and coordinating technical incident-response activities. |
| I4C | Supporting coordinated action by law enforcement agencies against cybercrime. |
| Cybercrime police and cyber cells | Receiving complaints and investigating cybercrime offences under applicable laws. |
| Infrastructure operators | Operating and securing their own systems and fulfilling applicable security obligations. |
The Indian Cybercrime Coordination Centre (I4C) works under the Ministry of Home Affairs and supports law enforcement agencies in dealing with cybercrime. It does not replace NCIIPC's specialised CII protection role.
Similarly, cybercrime police investigate criminal offences, while NCIIPC focuses on protecting critical infrastructure. A cyber incident affecting critical infrastructure may require coordination between multiple agencies, depending on its nature and consequences.
Read our detailed guides to understand these institutions:
- What Is I4C? Understand the Indian Cybercrime Coordination Centre
- Cyber Crime Police in India: Roles of Cyber Cells and Police Stations
Why Is NCIIPC Important for India's Cybersecurity?
India increasingly depends on interconnected digital systems to deliver essential services and support economic activity. A serious disruption to certain critical systems can affect several organisations and services at the same time.
For example, a cyber incident involving an important power-sector system could affect electricity operations. Similarly, a disruption involving a critical financial or telecommunications system could create wider operational difficulties.
NCIIPC helps address these risks by supporting a coordinated approach to critical infrastructure security. Its work is important for several reasons:
- Protecting essential services: It supports the security of digital systems that help deliver important services.
- Reducing cyber vulnerabilities: Risk assessments and security guidance help organisations identify and address weaknesses.
- Improving threat awareness: Alerts and threat intelligence help relevant organisations understand emerging risks.
- Strengthening national security: Protecting critical systems helps reduce the potential impact of cyber threats on national interests.
- Encouraging coordination: It connects relevant Government bodies, technical teams and infrastructure operators.
- Supporting operational resilience: Better preparedness helps organisations manage disruptions and strengthen recovery arrangements.
What Are the Limits of NCIIPC's Role?
NCIIPC has a specialised legal mandate. It is important to understand what its responsibilities cover and what falls outside its primary role.
- It is not a general cybercrime complaint portal: NCIIPC focuses on critical information infrastructure protection, not individual complaints about online fraud, phishing or social media offences.
- It does not replace law enforcement: Criminal investigations are handled by the appropriate police and law enforcement agencies.
- It does not take over system operations: Organisations remain responsible for operating and securing their own infrastructure.
- It does not guarantee complete protection: Security assessments, advisories and coordination reduce risks but cannot eliminate every possible cyber threat.
- Its constituency has a defined scope: The NCIIPC Rules, 2013 define its constituency as Indian critical information infrastructure notified by the Government from time to time, excluding infrastructure notified under the Ministry of Defence.
The Government has also explained that disclosing detailed information about cybersecurity breaches involving critical infrastructure may not be in the interest of national security. This is one reason why public information about certain incidents may remain limited.
Read the Ministry of Electronics and Information Technology's official explanation for further context.
Frequently Asked Questions About NCIIPC
Q. What is the full form of NCIIPC?
Ans. NCIIPC stands for National Critical Information Infrastructure Protection Centre. It is India's national nodal agency for protecting Critical Information Infrastructure under Section 70A of the Information Technology Act, 2000.
Q. Under which section of the IT Act was NCIIPC established?
Ans. The Central Government designated NCIIPC as the national nodal agency for Critical Information Infrastructure protection under Section 70A of the Information Technology Act, 2000.
Q. Which organisation controls NCIIPC?
Ans. NCIIPC functions under the administrative control of the National Technical Research Organisation (NTRO), as provided in the Information Technology (NCIIPC and Manner of Performing Functions and Duties) Rules, 2013.
Q. What is Critical Information Infrastructure in India?
Ans. Critical Information Infrastructure refers to a computer resource whose incapacitation or destruction could have a debilitating impact on national security, the economy, public health or safety. Section 70 of the Information Technology Act, 2000 provides this definition.
Q. What is the difference between CII and a Protected System?
Ans. CII is a legal category based on the potential consequences of a computer resource's incapacitation or destruction. A Protected System is a computer resource formally declared by the appropriate Government through a Gazette notification under Section 70 of the IT Act.
Q. What are the main functions of NCIIPC?
Ans. NCIIPC supports the identification of critical information infrastructure, provides threat intelligence and security advisories, undertakes vulnerability and risk assessments, develops protection guidance, supports cybersecurity audits and coordinates with relevant infrastructure organisations.
Q. Is NCIIPC the same as CERT-In?
Ans. No. NCIIPC focuses on protecting critical information infrastructure under Section 70A of the IT Act. CERT-In is the national agency responsible for responding to cybersecurity incidents under Section 70B. Both agencies contribute to India's cybersecurity framework and coordinate where their responsibilities overlap.
Q. Does NCIIPC investigate individual cybercrime complaints?
Ans. No. NCIIPC's primary mandate is critical information infrastructure protection. Individuals who experience cybercrime should use the National Cyber Crime Reporting Portal or approach the appropriate cybercrime police unit.
Q. Does NCIIPC protect power, banking and telecom infrastructure?
Ans. NCIIPC works with relevant stakeholders in important sectors, including power, banking, telecommunications and transportation, to strengthen critical information infrastructure protection. However, not every computer system in these sectors automatically qualifies as CII.
Q. Which rules govern the security of Protected Systems?
Ans. The Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018 prescribe security practices and organisational requirements for systems formally declared as Protected Systems under Section 70 of the IT Act.
Conclusion
NCIIPC plays an important role in protecting India's critical information infrastructure from cyber threats. Established under Section 70A of the Information Technology Act, 2000, it supports the identification of critical systems, provides threat intelligence, conducts vulnerability and risk assessments, and coordinates with organisations responsible for essential infrastructure.
Its work complements the responsibilities of CERT-In, law enforcement agencies and infrastructure operators. Together, these institutions and organisations contribute to a stronger cybersecurity framework for protecting the digital systems on which India's essential services and national interests depend.