Section 3(3)(a) in The Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018
(a)nominate an officer as Chief Information Security Officer (CISO) with roles and responsibilities as per latest "Guidelines for Protection of Critical Information Infrastructure" and "Roles and Responsibilities of Chief Information Security Officers (CISOs) of Critical Sectors in India" released by NCIIPC;