Section 3(1)(a) in The Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018
(a)The organisation having "Protected System" shall constitute an Information Security Steering Committee under the chairmanship of Chief Executive Officer/Managing Director/Secretary of the organisation.