Critical Infrastructure Protection & Space Security — NCIIPC, ASAT & Emerging Threats

Overview

Critical infrastructure -- the systems and assets so vital that their incapacitation would have a debilitating impact on national security, economy, public health, or safety -- has become a primary target in modern security threats. Cyber attacks on power grids, ransomware on hospitals, and satellite jamming represent a new frontier where traditional kinetic warfare converges with digital and space-based threats.

India's critical infrastructure spans power, telecom, banking, transport, defence, space, and water systems. The National Critical Information Infrastructure Protection Centre (NCIIPC), established under Section 70A of the Information Technology Act, 2000, is the nodal agency for protecting these assets. The alleged RedEcho cyber intrusion targeting India's power grid infrastructure in 2020 demonstrated the severity of this threat.

Space security has emerged as a contested domain. India's successful ASAT test (Mission Shakti, 27 March 2019) demonstrated its capability to defend space assets, while the establishment of the Defence Space Agency in 2019 signals India's recognition of space as a warfighting domain. Simultaneously, undersea cable vulnerabilities, drone threats, and electromagnetic pulse (EMP) risks represent emerging security challenges that transcend traditional categories.

Critical Infrastructure -- Definition and Sectors

Definition

Critical Sectors in India

NCIIPC -- National Critical Information Infrastructure Protection Centre

NCIIPC Functions

Related Cyber Security Bodies

For Prelims: NCIIPC established 16 January 2014 under Section 70A of IT Act 2000; a unit of NTRO under PMO; nodal agency for CII protection. CERT-In is the nodal agency for general cyber security incident response under MeitY. CII defined as computer resources whose incapacitation would have debilitating impact on national security, economy, public health, or safety.

Threats to Critical Infrastructure

Cyber Attacks

Mumbai Power Grid Incident (2020)

Other Threats

Protection Framework

Space Security

Space as a Contested Domain

Mission Shakti -- India's ASAT Test (27 March 2019)

For Prelims: Mission Shakti -- 27 March 2019; target Microsat-R at 283 km altitude; weapon PDV Mk-II; India became 4th country with ASAT capability (after USA, Russia, China); launched from Abdul Kalam Island (ITR), Odisha.

Defence Space Agency (DSA)

Outer Space Treaty, 1967

Space Threats

India's Space Situational Awareness

International Space Governance and India's Position

Key International Frameworks

India's Position on Space Governance

Undersea Cable Vulnerability

Drone Threats to Critical Infrastructure

Cross-paper relevance

• GS3 — Internal Security (primary) — Critical infrastructure protection: NCIIPC, CIIEX 2024, power grid/banking/telecom/nuclear security, drone attack on Jammu AFB (2021)
• GS3 — Science-Technology — Space security: Mission Shakti ASAT test (2019), IN-SPACe, ISRO commercialisation, space debris ethics, space militarisation debate
• GS2 — Governance dimension: NCIIPC under NTRO, CERT-In 9,700 audits (2024-25), NCRF 2024, institutional framework for CII protection
• Essay — Recurring theme: "India in space — civilian and strategic dimensions" (2022); "Protecting the arteries of modern civilisation" (2021)

Recent Developments (2024–2026)

NCIIPC CIIEX 2024 and CERT-In Audits Scale-Up

In April 2024, NCIIPC organised the Critical Information Infrastructure Security Exercise (CIIEX 2024) for Chief Information Security Officers (CISOs), Chief Technology Officers (CTOs), and Chief Risk Officers (CROs) of all CII-designated entities — a hands-on cyber defence exercise simulating coordinated attacks on critical infrastructure. NCIIPC also released the National Cyber Security Reference Framework (NCRF 2024) — shared with over 100 critical sector entities — as an interim governance framework while India's comprehensive National Cyber Security Strategy remains under finalisation. Separately, CERT-In conducted over 9,700 cybersecurity audits across critical sectors in 2024-25, through 200 empanelled cybersecurity organisations, as stated by the Union Minister of State for Electronics and IT in July 2025. These audits represent a significant scaling-up of India's critical infrastructure audit regime.

UPSC angle: NCIIPC CIIEX 2024, NCRF 2024, and CERT-In's 9,700+ audits (2024-25) — are specific verified figures connecting institutional framework with operational capability for GS-III.

Undersea Cable Damage — Red Sea Crisis Impact on India (2024)

The Red Sea crisis (2024), driven by Houthi attacks on commercial shipping, caused damage to multiple submarine cables in the region, disrupting internet and data connectivity between Asia, Europe, and Africa. Several cables routing through the Red Sea were either damaged or rerouted, affecting India's data bandwidth, cloud connectivity, and financial transaction latency. This incident underscored the vulnerability of India's internet infrastructure to geopolitical crises in distant regions. India's three major cable landing stations (Mumbai, Chennai, Kochi) handle over 95% of India's international internet traffic, and their disruption would have cascading effects on banking, telecom, and e-governance systems. NCIIPC and CERT-In issued advisories to affected entities to activate backup routes and alternative capacity.

UPSC angle: Red Sea crisis undersea cable damage — submarine cable vulnerability, India's cable landing stations (Mumbai, Chennai, Kochi), NCIIPC response — directly tests the "undersea cable as critical infrastructure" dimension for GS-III.

ISRO Space Cybersecurity Training Initiative (2024–2025)

In a recognition of the growing cyber-physical threat to space infrastructure, India's National Security Council Secretariat (NSCS), ISRO, and Rashtriya Raksha University (RRU) jointly organised cybersecurity training for ISRO personnel in 2024. This initiative reflects growing awareness that ground stations, satellite control networks, and launch facilities face cyber threats from state-sponsored actors. India's NETRA (Network for Space Objects Tracking and Analysis) system continues to evolve for space situational awareness. In 2024, ISRO launched INSAT-3DS (February 2024, geostationary meteorological satellite) and advanced preparations for Gaganyaan (human spaceflight). The Defence Space Agency (DSA) has been working on Space Situational Awareness protocols for India's growing constellation of defence satellites.

India achieved a landmark capability milestone: PSLV-C60 / SpaDeX mission (Space Docking Experiment) successfully demonstrated in-orbit docking on 16 January 2025, making India the 4th country after USA, Russia, and China to achieve rendezvous and docking in space. This capability is essential for future space station operations, satellite servicing, and crew transfer missions — all with direct defence-space security implications.

UPSC angle: NSCS-ISRO-RRU cybersecurity training, space as a critical infrastructure domain, DSA Space Situational Awareness, and India's defence satellite protection measures — link space security with cybersecurity for GS-III.

India-Pakistan Drone Warfare and Critical Infrastructure Risk (May 2025)

The May 2025 India-Pakistan crisis (Operation Sindoor) demonstrated the real threat of drone attacks on critical infrastructure. Pakistan's response included drone and missile strikes targeting Amritsar, Jalandhar, Ludhiana, and Chandigarh — cities hosting key power, telecom, and military infrastructure. India deployed counter-drone systems (radar, jamming, directed energy) in a concerted counter-UAS (Unmanned Aerial System) response. The crisis exposed: (1) the need for hardened critical infrastructure against drone swarms; (2) the importance of air-gapped SCADA systems for power grids near border areas; (3) CISF and CRPF rapid-reaction protocols for protecting industrial installations under air threat. Post-crisis reviews have led to accelerated deployment of counter-drone systems at airports, power plants, and defence installations.

UPSC angle: Drone attacks on critical infrastructure during Operation Sindoor — counter-UAS systems, SCADA air-gapping, CISF rapid reaction — are cutting-edge security developments linking space/tech security with internal security for GS-III.

Key Terms for Quick Revision

Exam Strategy

For Mains Answer Writing: Critical infrastructure and space security questions require you to demonstrate understanding of the convergence of cyber and physical threats. For CII protection, discuss the NCIIPC framework, the Mumbai 2020 power grid incident as a case study, and the need for public-private partnership (most critical infrastructure is privately operated). For space security, trace India's journey: Mission Shakti (2019) to DSA (2019) to the broader space threat landscape. Discuss the gap in the Outer Space Treaty (no ban on conventional weapons/ASAT) and the need for a new space governance framework. Connect emerging threats -- drones, undersea cables, EMP -- to the evolving nature of warfare.

For Prelims: NCIIPC (Section 70A IT Act, under NTRO/PMO, established 2014); CERT-In (under MeitY); Mission Shakti (27 March 2019, Microsat-R, 283 km, PDV Mk-II, 4th ASAT nation); DSA (1 June 2019, Bengaluru, tri-service); Outer Space Treaty 1967 (prohibits WMDs in space, India ratified 1982); NavIC (7 satellites, Indian GPS alternative); CII definition (IT Act Section 70); Jammu Air Force drone attack (June 2021).

Vocabulary

Key Terms

Kinetic Kill Vehicle

• Definition: A Kinetic Kill Vehicle (KKV) is a guided "hit-to-kill" interceptor that destroys a target — a ballistic missile warhead, re-entry vehicle or satellite — purely through the energy of a high-speed physical collision, carrying no explosive warhead. It homes onto and rams the target using onboard seekers and small thrusters, relying on kinetic energy alone for destruction.
• Context: KKVs are the lethal payload of modern exo-atmospheric (above-atmosphere) missile defence and anti-satellite (ASAT) systems, where closing speeds run to several kilometres per second so that impact alone shatters the target. They are central to systems such as the US Exoatmospheric Kill Vehicle (EKV) and India's PDV Mk-II interceptor. India demonstrated indigenous KKV technology on 27 March 2019 in Mission Shakti, when a DRDO PDV Mk-II struck the Microsat-R satellite at roughly 300 km altitude, making India the fourth nation after the US, Russia and China to demonstrate an ASAT capability.
• UPSC Relevance: For GS Paper 3 (Science & Technology, Defence and Internal Security), KKVs link the themes of missile defence, ASAT weapons, space security and indigenous defence R&D (DRDO). This is a foundational concept that underpins questions on India's Ballistic Missile Defence programme, Mission Shakti, and the militarisation of space. Prelims can test the "hit-to-kill" principle (no warhead, kinetic destruction) and Mains can probe the strategic, debris and arms-control implications of India's 2019 ASAT test. No verified UPSC PYQ exists for this exact term, so candidates should treat it as supporting knowledge for the wider space-and-defence question family.

Critical Infrastructure

• Definition: Critical infrastructure refers to those assets, systems and networks — physical or virtual — so vital to a nation that their incapacitation or destruction would have a debilitating impact on national security, the economy, public health or safety. In India, its digital subset, Critical Information Infrastructure (CII), is defined in the Explanation to Section 70 of the IT Act, 2000 as a "computer resource, the incapacitation or destruction of which shall have debilitating impact on national security, economy, public health or safety".
• Context: As economies digitise, sectors such as power grids, banking, telecom, transport and healthcare have become prime targets for cyberattacks, including state-sponsored ones. India responded by inserting Sections 70A and 70B into the IT Act (2008 amendment), creating the NCIIPC (notified 16 January 2014, under NTRO) as the nodal agency for protecting Critical Information Infrastructure, with CERT-In handling broader cyber-incident response. Incidents like the Kudankulam nuclear plant malware infection (2019) and the AIIMS Delhi ransomware attack (November 2022) have made critical infrastructure protection a core national security concern.
• UPSC Relevance: This is a foundational GS3 concept under internal security ("basics of cyber security") and underpins questions on cyber security architecture, NCIIPC/CERT-In, the IT Act, and security challenges to India's digital economy. In Prelims, UPSC tests institutional facts — which body protects CII, its parent organisation (NTRO), and the critical sectors identified. In Mains, it appears through questions on cyber threats to critical infrastructure, India's preparedness, and the cyber-security framework; the AIIMS and Kudankulam attacks serve as ready case studies.

Critical Information Infrastructure

• Definition: Critical Information Infrastructure (CII) is defined in the Information Technology Act, 2000 (Explanation to Section 70) as a computer resource the incapacitation or destruction of which shall have a debilitating impact on national security, economy, public health or safety.
• Context: CII covers the digital backbone of essential services such as power grids, banking and financial systems, telecom, transport and government networks, where a cyberattack could cascade into national-level disruption. India's framework rests on Section 70 of the IT Act, 2000 (which lets the appropriate Government declare CII-linked computer resources as "protected systems") and Section 70A (inserted by the 2008 amendment), which mandates a national nodal agency. That agency is the National Critical Information Infrastructure Protection Centre (NCIIPC), set up by gazette notification on 16 January 2014 as a unit of the National Technical Research Organisation (NTRO).
• UPSC Relevance: This is a foundational GS3 (internal security / cyber security) concept that underpins questions on cyber threats to national security, protection of critical infrastructure, and the institutional architecture of Indian cybersecurity (NCIIPC, CERT-In, NTRO). For Prelims, aspirants should know the defining statute (IT Act, 2000), the relevant sections (70 and 70A), the nodal agency (NCIIPC) and its parent body (NTRO). For Mains, it links to debates on cyber resilience, public-private cooperation in security, and gaps in India's cyber defence — and pairs naturally with CERT-In, the National Cyber Security Policy and data-protection law. No verified UPSC PYQ exists for this exact term; treat it as a high-yield concept rather than citing a specific past question.