INDIA Law and Practice Contributed by: Alina Arora, Samarth Gupta and Parth Singh, Shardul Amarchand Mangaldas & Co
Foreign Nationals The Security Manual treats foreign nationals sepa - rately. Visits to areas where manufacturing for MoD projects is underway require prior clearance from the MoD; visits to non-sensitive areas may be approved by the chief executive or head of the Indian licensed defence company but must be reported; and entry to vital installations on tourist or e-tourist visas is pro - hibited. Grant, Revocation and Review Clearances are administrative in nature. The MHA and the DDP grant, condition and withdraw clearances under broad published parameters (applications to the MHA are made through its e-Sahaj portal). Reasons are typically withheld on security grounds. 5.3 Classified Information and Official Secrets Classification of information is administrative rather than statutory. Documents and equipment are graded (“top secret”, “secret”, “confidential”, and “restrict - ed”) under departmental security instructions that are themselves classified. The Security Manual applies these grades to licensed defence companies and prescribes handling, marking and storage requirements for each. The OSA penalis - es spying and unauthorised communication of secret official information, with enhanced imprisonment where the offence relates to defence works, estab - lishments or military affairs (see 5.4 Critical National Infrastructure and Defence Assets ). The government may resist production of unpublished classified records in court, but the court decides the claim, and the marking of a document as secret does not by itself exclude it from judicial proceedings (see 7.5 Legal Professional Privilege and Confidentiality ). 5.4 Critical National Infrastructure and Defence Assets Although the OSA designates all defence establish - ments (including private-sector defence industrial and R&D establishments) as prohibited places – spying on which would attract imprisonment up to 14 years – defence assets are not designated as critical national infrastructure under a defence-specific regime.
Under the IT Act, the appropriate government may declare computer resources affecting critical infor - mation infrastructure to be protected systems, with access controls and imprisonment for unauthorised access. 5.5 Cybersecurity Requirements for Defence Contractors India does not have a Cybersecurity Maturity Model Certification (CMMC)-type certification scheme for defence contractors. The baseline requirements arise under general law – ie, the IT Act and directions issued by the Indian Computer Emergency Response Team (CERT-In) that require reporting of specified cyber- incidents within six hours and retention of logs for 180 days, which apply to all entities including defence contractors. Additionally, MoD tenders and the Security Manual impose information security requirements. The Secu - rity Manual mandates: • ISO 27001 compliance; • appointment of a positively vetted CISO; • internal cybersecurity audits every six months and annual external audits by CERT-In empanelled auditors; and • integration with the Defence Cybersecurity Opera - tions Centre for centralised log monitoring. MoD tenders typically expect the CERT-In certifica - tion. 5.6 Supply Chain Security Supply chain security is addressed through eligibil - ity and sourcing conditions rather than a dedicated statute, as follows: • the IC requirements and positive indigenisation lists (see 2.7 Offsets, Industrial Participation and Sovereign Capability Requirements ), and the pref - erence for the Buy (Indian-IDDM) category; • the FDI condition that the investee company be self-sufficient in product design and develop - ment, with maintenance and life cycle support in India (see 2.8 Security of Supply and Resilience Requirements ); and
95 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook