From Doctrine to Statute: A Legislative Review of the Bharat National Resilience Index (BNRI)

1. Introduction

Most books on national security ask to be read. This one asks to be enacted. The Bharat National Resilience Index (BNRI) by Dr. Padmalochan Dash describes itself as a doctrinal framework and guideline template for covered operators, auditors, Ministries, States, policy makers and legislators. That last audience sets the test for this review. The question here is not whether the framework is well argued, but whether a government could take it as the reference for legislation, and what a drafting office would have to fix, add or drop before a Bill reached Parliament.

2. The Book and Its Legislative Claim

The Second Edition (Bharat Assets Publication, 2026; ISBN 978-81-904062-1-5) runs to 211 pages. Its central proposal is that BNRI should be the measurement pillar, "Pillar-II", of a proposed Critical Infrastructure Protection Act (CIPA). Every covered operator would be scored on four weighted pillars: Safety and Security Integrity (30 per cent), Operational Continuity and Redundancy (25), Compliance and Governance Assurance (25), and Systemic Interdependency and Adaptability (20). Scores fall into Classes I to V, operators into Tiers A, B and C by systemic significance, and the Class an operator earns would decide its audit cadence, sanctions and incentives.

The book is candid that none of this exists yet. Its disclaimer states that CIPA and every body it names are proposals and do not denote existing statutory entities or legal obligations. An appendix offers an indicative arrangement of clauses for CIPA, but calls it a structural skeleton, "not a draft Bill". A government using the book should take it at its word: it is a drafting brief, not a draft.

3. What a Drafting Office Can Take From It

Chapter VI is the most useful part for legislators. It understands how Indian law is actually made. The body of CIPA would fix the essential legislative policy (purposes, coverage criteria, categories and maximum amounts of penalty, procedural safeguards), while five Schedules would carry coverage, metrics, sanctions, recalibration and reciprocity. The variable detail would sit in rules and regulations, each published in draft with a regulatory impact assessment and laid before both Houses, and the Act would require an independent review of its own operation every five years.

That design respects the rule against excessive delegation, which many sectoral frameworks ignore. It also lets the indicators change without amending the Act, which matters for a regime built on technical metrics. The book's treatment of existing law is equally practical: protected systems under section 70 of the IT Act, CERT-In directions, the telecom and data protection regimes and the cyber frameworks of RBI, SEBI, IRDAI and the power sector are to be recognised as evidence rather than audited twice.

4. Constitutional Competence

The book maps CIPA against the Seventh Schedule and, to its credit, does not pretend the Union can do everything. It accepts that the residuary power under Article 248 cannot reach State List subjects such as police, water and public health. For those it relies on Article 252 adoption by State resolution, entrustment under Articles 258 and 258A, Union directions under Article 257 and coordination through the Inter-State Council. It also commits the Union to meet the States' added costs on the principle of Article 258(3).

The weakness is practical, not doctrinal. Article 252 depends on State Legislatures passing resolutions, and adoption is voluntary. A national resilience score that is mandatory for Union-List lifelines but optional for State water utilities and urban services will leave the most locally fragile systems outside the net for years. The book names the instruments; it does not show how consent would be won.

5. Institutional Design Under Scrutiny

The framework separates the body that sets standards (BIPCARD), the regulator that enforces (NCIA), the technical authority that accredits auditors and governs methodology (BNRI-AAC), the bureau that scores (RAS) and the auditors who collect evidence (RABs). Appeals go to a board chaired by a person qualified to be a High Court judge. As a design for independence it is sound.

As a request to Parliament it is heavy. It asks for several new statutory bodies, an operational force in Prahari, State Resilience Cells and a national data grid, alongside NCIIPC, CERT-In, NDMA and the sector regulators that already exist. The book admits that the public cost of NCIA, RAS and the State Cells is not estimated and would have to appear in the financial memorandum. No Finance Ministry will clear a Bill on that basis. A leaner first version, with fewer bodies and one regulator carrying several of these functions until volume justifies separation, would be easier to pass.

6. Measurement as Law

Tying sanctions, procurement and incentives to a composite score raises the stakes of every decimal point. The book recognises this. It states that the pillar weights "are normative choices, not empirical estimates", proposes Monte Carlo sensitivity testing and empirical triangulation once scoring data exist, and routes cases that straddle a Class boundary to an evidence check before any decision. It also grounds evidentiary integrity in section 63 of the Bharatiya Sakshya Adhiniyam, 2023, and tests its sanctions against Articles 14 and 19(1)(g) on the proportionality standard.

Even so, a law that penalises an operator for falling from Class III to Class IV on weights its own authors call normative will be litigated. Until the pilot has calibrated the weights, the score should inform supervision rather than trigger penalties by itself. The book's own roadmap points the same way, with shadow scoring in the pilot and sanctions for Class V alone in the first roll-out, and legislators should write that restraint into the Act rather than leave it to administrative goodwill.

Capacity is the other constraint. The book's own illustrative estimate puts the audit workforce at roughly 730 full-time auditors as a floor, before regulator, bureau and State staff, and notes that operational-technology and industrial-control auditors are scarce. A statute that mandates audits faster than the country can accredit auditors will produce paper compliance. Accredited capacity, which the book makes an exit criterion for each phase, should become a statutory condition for extending coverage.

7. What Government Should Ask For Before Drafting

Four things are missing that any Cabinet note would need. First, a cost estimate for the new bodies and for operator compliance, by Tier. Second, results from at least one pilot, because the book's sixty-month roadmap is a plan, not evidence. Third, a firm rule on disclosure: the book proposes public scores and an annual report card with confidential technical annexures for sensitive assets, but the Act itself should state which findings may never be published, so that transparency does not hand adversaries a map of weak points. Fourth, a separate legal basis for Prahari, which the book places on the CISF model only in outline; a new armed force of the Union needs its own enabling Act or an amendment to an existing one.

8. Verdict

As a reference for legislation, the BNRI book is the most complete Indian blueprint available for a statutory critical infrastructure regime. It is unusually careful about delegation, competence, due process and proportionality, and it is honest about what it has not yet proven. It is not a Bill, and it should not be treated as one. A government minded to act should use Chapter VI and the clause skeleton as the brief for a drafting committee, fund the two-cluster pilot the book proposes, cut the institutional design to what the first phase needs, and enact the score as a supervisory tool first and a sanctioning tool only after calibration.

Disclosure: The book is written by the Director of the Bharat Assets Protection Institute™ and published by Bharat Assets Publication, the Institute's imprint. This review is published by the Bharat Assets Publication Editorial Desk.