The programme boundary is wider than the network

The Defence Acquisition Procedure 2020 provides that where a classified Request for Proposal or document is issued as part of a procurement process, all the relevant precautions and procedures for handling the RFP, document, or information that apply to the relevant level of security classification have to be followed as per extant government orders, and that a Non-Disclosure Agreement in the format at Appendix Q has to be signed by all Bidders and forwarded along with the acknowledgement of receipt of the RFP.

The same procedure states that no party shall disclose any information to any third party concerning the matters under the RFP, that information identified as proprietary shall be kept strictly confidential and not disclosed without the prior written consent of the disclosing party, and that the clause applies to the sub-contractors, consultants, advisors, or the employees engaged by a party with equal force.

The Defence Acquisition Procedure 2020 records that 'Restricted Information' categories fall under 'Official Secrets' under Section 5 of the Official Secrets Act, 1923, and that any contravention of those provisions by any Bidder, sub-contractor, consultant, advisor, or employee of a contractor will make them liable for penal consequences under that legislation.

The procedure requires the broad details of projects and procurements to be hosted on the Ministry of Defence and Service Headquarters websites within one week of issue of minutes after the Acceptance of Necessity, less the Acceptance of Necessity for classified cases that shall not be uploaded on those websites, keeping security aspects in mind.

Section 8(5) of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to protect personal data in its possession or under its control by taking reasonable security safeguards. Section 17(2)(a) disapplies the Act to processing by such instrumentality of the State as the Central Government may notify in the interests of sovereignty and integrity of India or security of the State. That is a notified carve-out rather than a blanket exemption, and applicability should be assessed organisation by organisation.

Press Note No. 03 (2025 series) of the Department for Promotion of Industry and Internal Trade states that companies having Industrial Licenses issued by that Department will ensure compliance to all the provisions of the Security Manual for Licensed Defence Industries, 2025 before commencing production of the licensed items. The Manual itself records that the Defence Licence contains a footnote to the effect that the licensee company shall fully comply with the security conditions it contains, and applies to Defence PSUs as well as licensed private companies.

Chapter 5 of the Manual requires an ILDC authorised to store classified documents and equipment to establish and maintain a system to deter and detect unauthorized intrusion or removal, records that all categories of classified documents are regarded as under the personal charge of the individual to whom they are issued, limits disclosure to only those required to know, and requires proper handing and taking over of all documents whenever an individual is transferred or superannuating.

Chapter 7 of the Manual provides that information systems used to capture, create, store, process, or distribute classified information must be properly managed to protect against unauthorized disclosure and loss of data and integrity, requires strict compliance with the Information Technology Act, 2000 as amended, and requires a Cyber Information Security Officer to be appointed. For work inside a classified area it provides that all official work will be carried out on a system belonging to an air-gapped network isolated from the Internet at the physical layer, with removable media held in the custody of that officer and USB ports blocked.

Chapter 8 provides that where an ILDC outsources, releases, or discloses classified information or a project to a sub-contractor, all provisions of the Manual as applicable shall be followed, that any sharing of classified material shall be preceded by a Non-Disclosure Agreement, and that terms and conditions relating to retention, handling, and destruction of classified information received or generated under the subcontract shall be clearly indicated in the main contract. Chapter 7 requires the information security policy to take into account systems deployed by sub-contractors, and requires the cyber security requirements to carry forward equally to all contractors and sub-contractors.

The DRDO Policy for Transfer of Technology 2025 provides that a laboratory or establishment may share technology details for a firm's comprehensive understanding by entering into a Confidentiality and Non-Disclosure Agreement with the interested industry before exchanging any confidential information, and describes the Licensing Agreement for Transfer of Technology, which covers the licensing region, validity period, handholding support, and a licence revocation clause. Know-how reaches an industry partner as a Technology Transfer Document package.

By notification S.O. 18(E) of 16 January 2014, made under sub-section (1) of Section 70A of the Information Technology Act, 2000, the Central Government designated the National Critical Information Infrastructure Protection Centre as the national nodal agency in respect of Critical Information Infrastructure Protection.

The Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018 apply to organisations whose systems are notified under Section 70. They require the Chief Information Security Officer to share information security audit reports, post-audit compliance reports, and IT security service level agreements with NCIIPC, and to establish a process for sharing logs of the protected system.

The CERT-In Directions of 28 April 2022 name Government organisations alongside service providers, intermediaries, data centres, and body corporate, and require the cyber incidents listed in Annexure I to be reported within six hours of noticing them or being brought to notice about them.

The same Directions require the entities within their scope to enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days within the Indian jurisdiction, and to synchronise system clocks with the NTP servers of NIC or NPL, or servers traceable to them.

The Security Manual for Licensed Defence Industries provides that if the organisation also holds Critical Information Infrastructure, the information security policy must be made in consultation with NCIIPC, and must include implementation of security controls as released by NCIIPC or CERT-In, listing among others user and password management for all users handling critical or sensitive information including sub-contractors, revocation of privileges subsequent to termination of employees or contracts, and safe and verified backup and restoration mechanisms tested on a regular basis.