ABC Ltd. is a steel manufacturing company having multiple production units and branch offices across the country. The company has Oracle's Enterprise Resource Planning (ERP) system implemented and fully operational. The

The Rules lay down certain responsibilities for the organizations having a Protected System (as mentioned under Rule 3(3)): Nominate an officer as CISO whose roles and responsibilities shall be as per the latest Guidelines for Protection of Critical Information Infrastructure ('Guidelines') and 'Role and Responsibilities of CISOs of Critical Sectors in India' released by the NCIIPC; Plan, establish, implement, operate, monitor, review, maintain and continually improve Information Security Management System (ISMS) of its system as per the latest Guidelines released by the NCIIPC or an industry accepted standard duly approved by the said NCIIPC; Ensure that the network architecture of Protected System shall be documented; The same shall be reviewed at least once a year, or whenever required, or according to ISMS; Plan, develop, maintain and review the documents of inventory of hardware and software related to Protected System; Ensure that the vulnerability/threat/risk (V/T/R) analysis for the cyber security architecture of Protected System shall be carried out at least once a year. Further the (V/T/R) analysis shall be initiated whenever there is significant change or upgrade in the system, by intimation of the same to ISSC; Plan, establish, implement, operate, monitor, review, and continually improve Cyber Crisis Management Plan (CCMP) in close coordination with NCIIPC; Ensure conduct of internal and external Information Security audits periodically. Establish a Cyber Security Operation Center (C-SOC) using such tools and technologies to implement preventive, detective and corrective controls to secure against advanced and emerging cyber threats. The records of unauthorised access, unusual and malicious activity, if any, shall be documented; Establish a Network Operation Center (NOC) using tools and techniques to manage control and monitor the network (s) of Protected System. Plan, develop, maintain and review the process of taking regular backup of logs of networking devices, perimeter devices, etc. and services supporting 'Protected System' and the logs shall be handled as suggested by ISMS.