Toward a human-centric view of NCIIPC guidelines for enabling its adoption in Indian critical information infrastructures

Purpose The Government of India has the National Critical Information Infrastructure Protection Centre (NCIIPC) guidelines for safeguarding its critical assets. This paper aims to highlight that the next phase of India’s cybersecurity maturity must focus on embedding and explicitly articulating the needs of the human dimension at the structural, operational and behavioral levels of the NCIIPC guidelines to aid in its ease of adoption. Design/methodology/approach This study adopts a conceptual and analytical research approach based on a systematic examination of the NCIIPC guidelines. It comprehends the guidelines in terms of human centricity using the following three analyses: Situational Deconstruction; People-Process-Technology Mapping; and Role-based (Point of Contact) Analysis. These analyses are conducted on the guidelines as strategic entry points to find the human-centric gaps that stall its adoption process. Findings The analysis reveals that while the guidelines are strategically comprehensive, their adoption is constrained by abstraction at the operational level, ambiguous role allocation, overreliance on technological controls and limited consideration of human performance and organizational diversity. Practical implications The paper recommends three pathways for improving guideline adoption: enhancing organizational accessibility and inclusivity, guideline redesign and reassessing cybersecurity as a national thrust. These recommendations aim to support policymakers, regulators, critical infrastructure organizations and auditors in operationalizing cybersecurity governance. Originality/value This study advances human-centric cybersecurity research by extending it to the analysis of a national-level cybersecurity guideline. It offers a novel, structured analysis for enhancing guideline adoptability and positions human centricity as a core dimension of cybersecurity maturity in India’s critical infrastructure ecosystem.