email policy of GoI 2024

REGD. No. D. L.-33004/99 The Gazette of India CG-DL-E-30102024-258369 EXTRAORDINARY PART I-Section 1 PUBLISHED BY AUTHORITY No. 304] NEW DELHI, TUESDAY, OCTOBER 29, 2024/KARTIKA 7, 1946 MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY NOTIFICATION New Delhi, the 25th October, 2024 F.No: 1(3)/2024-EG-II.— Email Policy of Government of India, 2024 Part I: Introduction 1. Objective and scope 1.1 Email is the primary means of communication for official purposes used by government for the performance of public duties in public interest, as well as by certain other organisations entrusted with performance of such duties. To enable secure use of email in government and such organisations, email services are provided by the National Informatics Centre (NIC). 1.2 This policy applies to use and use-related security aspects governing such email services. 1.2.1 It complements the following framework that applies to the security of the email solution utilised to provide the services: (a) Applicable laws, such as the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (once the same is brought into force), and rules made or directions or guidelines issued under the same; (b) Policies, procedures and guidelines relating to cybersecurity or information security, or both, which are issued or adopted from time to time by the Central Government, its nodal agency for incident response and cybersecurity related functions (the Indian Computer Emergency Response Team) or the protection of Critical Information Infrastructure (the National Critical Information Infrastructure Protection Centre), or NIC; and (c) The standards relating to management systems for information security, business continuity, information technology service, etc., issued by technical standard organisations and adopted by NIC, from time to time, in relation to the email solution. 2. Definitions 2.1 In this policy, unless the context otherwise requires,— (a) "Central Government Department", "Court”, “Constitutional Body", "Legislative Body", "Other Authorised Entity”, “Other Government-controlled Entity", "Public Educational or Research Institution”, “Public Healthcare Institution”, “Public Sector Enterprise", "State Government Department" and "Statutory Body" shall have the meanings respectively assigned to them in the Annex; (b) "Central Government Organisation" means an Organisation that— (i) is a Central Government Department; or (ii) is under the administrative purview of a Central Government Department and is— (1) a Public Educational or Research Institution; (2) a Public Healthcare Institution; (3) a Public Sector Enterprise; (4) a Statutory Body; (5) an Other Government-controlled Entity; or (6) an Other Authorised Entity. (c) "Competent Authority" means the Secretary to the Government of India in the Ministry of Electronics and Information Technology; (d) "Core Use Organisation” means an Organisation as referred to in paragraph 3.1.1; (e) “DA", in relation to a User Organisation, means a public servant other than an employee of NIC, who is designated as a Delegated Administrator by such User Organisation under clause (a) of paragraph 8.1; (f) "Email Access and Use Instructions” means the instructions so named, given by NIC from time to time under this Policy, — (i) for adherence by a DA and its corresponding User Organisation, as published in the user account assigned to such DA on the online platform made available by NIC for User Organisations to designate DAs, specifying the duties and responsibilities of User Organisations and DAs; and (ii) for adherence by a User, as published in the NICeMail user account assigned to such User, specifying the duties and responsibilities of such Users; (g) "Email Policy" means this policy; (h) "Ministry of Electronics and Information Technology” or “MeitY” means the department to which the subject of policy matters relating to information technology is allocated by the Government of India (Allocation of Business) Rules, 1961; (j) "NICeMail" means the email service made available using the email solution provided by NIC; "NICeMail Services" means and includes— (i) NICeMail; and (ii) Other NICeMail Services; (k) "Organisation" means a body, court, department, enterprise, entity, institution, ministry, office or secretariat that is included in any of the organisation types described in the Annex; (1) "Other NICeMail Service” means such service other than NICeMail as may, from time to time, be— (i) made accessible to all or any class of Users through the email solution provided by NIC, which may include the use of applications such as a calendar application, office productivity tools integrated with such solution and external storage application provided by NIC; and (ii) specified in the Email Access and Use Instructions; (m) "State Government Organisation" means an Organisation that— (i) is a State Government Department; or (ii) is under the administrative purview of a State Government Department and is— (1) a Public Educational or Research Institution; (2) a Public Healthcare Institution; (3) a Public Sector Enterprise; (4) a Statutory Body; (5) an Other Government-controlled Entity; or (6) an Other Authorised Entity; (n) “User" means an individual authorised to use NICeMail Services and to whom a NICeMail user account is assigned for this purpose; and (o) "User Organisation" means an Organisation that uses NICeMail Services. Part II: Terms of Use 3. User Organisations 3.1 User Organisations, in terms of whether or not they are required by this Email Policy to use only NICeMail for email communication for official purposes, are classified into the following two classes, namely:- (a) Core Use Organisations; and (b) other Organisations. 3.1.1 Core Use Organisations consist of Central Government Departments and such Other Government- controlled Entities as are under the overall control of such a Department and do not provide goods or services on commercial terms. Save as otherwise provided, a Core Use Organisation and its Users shall use only NICeMail for email communication for official purposes. However, where the Core Use Organisation has an office or establishment outside India, for ensuring availability of local communication channels under exigent circumstances (such as disruption of Internet services that may result in inability to access NICeMail), such Organisation may, with the approval of such authority other than the head of such office or establishment as may be competent in this regard in that Organisation, authorise such office or establishment to maintain alternative email services hosted outside India. 3.1.2 Any Organisation other than a Core Use Organisation may adopt the use of NICeMail. 3.2 A Core Use Organisation, including those dealing with national security, that currently have their own independent email servers may continue to operate the same, provided such servers are hosted in India. Further, in the interest of security and uniform policy enforcement, these Organisations should consider migrating their email services to NICeMail Services. 4. Charges for use of NICeMail Services 4.1 Save where the Central Government decides otherwise in respect of any Organisation or class thereof, NICeMail Services shall be provided free of charge to the following classes of Organisations, namely:- (a) Core Use Organisations; (b) Legislative Bodies; (c) Courts; (d) Constitutional Bodies; (e) State Government Departments, and such Other Government-controlled Entities as are under the overall control of such a Department and do not provide goods or services on commercial terms; and (f) Statutory Bodies and Other Authorised Entities, for which such free-of-charge provision is authorised by general or special directions of Competent Authority. 4.2 Other Organisations may avail of NICeMail Services through National Informatics Centre Services Incorporated (NICSI), or such other agency as NIC may appoint in this behalf, on payment of such charges as may be determined from time to time. 5. User account creation 5.1 On receipt of a request made in this behalf by a User on the online portal made available by NIC for accessing NICeMail, the DA for the User Organisation concerned shall create and assign to such User an NICeMail user account. 5.2 In respect of a User Organisation provided NICeMail Services free of charge (see paragraph 4.1), the NICeMail email addresses assigned to a User may be of the following two types, namely:— (a) Organisation-linked email address; and (b) Service-linked email address. 5.2.1 The policy in respect of organisation-linked email addresses is laid down in paragraphs 5.3.2(a) and 5.4 to 5.6.3. The policy in respect of service-linked email addresses is laid down in paragraphs 5.3.2(b) and 5.7 to 5.7.2. 5.3 Most Core Use Organisations currently use common mail domains, namely, “@gov.in" and "@nic.in", and only a few use organisation-specific mail domains such as "@xyz.gov.in" and "@xyz.nic.in" (where “xyz” represents any string of alphanumeric characters). With Users continuing to use NICeMail user accounts with common email domains across tenures, organisation-specific information stored in such accounts becomes inaccessible to the organisation concerned. Further, lack of domain segmentation and mapping of Users to their current Organisations results in delayed incident response and non-implementation of organisation-specific security policies, monitoring and visibility on User behaviour. 5.3.1 Aside from these concerns related to common mail domains, the use of the domain names "@nic.in" and "@xyz.nic.in" requires change as all such Organisations, including NIC, are Government Organisations. 5.3.2 Therefore, User Organisations that currently use the mail domains "@gov.in”, “@nic.in” or "@xyz.nic.in", save as specified in paragraph 5.3.5, shall give NICeMail user accounts having the said mail domains new email addresses having the mail domain “@xyz.gov.in”. To ensure continued delivery of emails sent at the existing email addresses, the old email addresses shall be mapped to the new email addresses. Further, to ensure that the user accounts assigned for official communications remain accessible to the Organisation concerned and organisation-specific security measures may be taken, the initial “xyz" part of the new mail domain shall be registered by the Organisation concerned with NIC on the following lines, namely:— (a) In respect of organisation-linked email addresses that may be used only for official communications, such initial part of the mail domain shall reflect the name of the concerned Organisation or group of Organisations which are either related or have chosen to share a mail domain. For example, MeitY has registered the mail domain “@meity.gov.in" and for various gram panchayats across India, the mail domain“@panchayat.gov.in" has been registered. (b) In respect of service-linked email addresses that may be used only for service-related matters, such initial part may reflect,- (i) where the User is eligible for such an email address (see paragraph 5.7.1) and is a member of an organised service other than the General Central Service, the name of such service. For example, for service-related communication with members of the Indian Police Service, the Ministry of Home Affairs has registered the mail domain “@ips.gov.in”; and (ii)where the User is eligible but not a member of such a service, the Organisation that has appointed such a User on regular basis to a service or post in connection with its affairs (hereinafter referred to as "Appointing User Organisation"), the name of such Appointing User Organisation, with the word “cadre” suffixed to it. For example, for service-related communication with officers of NIC, NIC may register the domain name "@niccadre.gov.in". 5.3.3 Accordingly, the mail domains "@gov.in", "@nic.in" and "@xyz.nic.in" shall cease to be used, although the emails available in the account shall continue to be accessible through the new email addresses and emails sent to the existing email addresses with the said mail domains shall continue to be delivered to the user account of the User concerned. 5.3.4 The mail domain "@xyz.gov.in" may be assigned to a Central Government Department, Court, Constitutional Body, Legislative Body, Other Government-controlled Entity, State Government Department or Statutory Body. In addition, it may be assigned to an Other Authorised Entity or a Public Healthcare Institution for which such assignment is authorised by general or special directions of Competent Authority. 5.3.5 An email address created by a User Organisation using the mail domain “@xyz.gov.in" for a User who is an employee or consultant of or an outsourced human resource provided by an entity contracted by such User Organisation, or is an individual consultant directly engaged by it, shall register with NIC a mail domain that appropriately distinguishes such a User from Users who are employees of or other office- holders in that User Organisation or are serviced by it. Accordingly, in an email address registered for- (a) an employee or consultant of or an outsourced human resource provided by a contracted entity, the mail domain shall be“@xyz-contractor.gov.in"; and (b) a directly engaged individual consultant, the mail domain shall be“@xyz-consultant.gov.in". 5.3.6 In respect of a User Organisation other than one that currently uses “@xyz.gov.in" or "@xyz.nic.in" as the mail domain for its Users (for example, "@org.in" or "@ac.in"), the User Organisation may register an appropriate mail domain on similar lines as outlined in clauses (a) and (b) of paragraph 5.3.5, to similarly distinguish Users who are employees or consultants of or outsourced human resource provided by contracted entities or individual consultants directly engaged by such User Organisation from Users who are employees or other office-holders of that User Organisations or serviced by it. Organisation-linked email address 5.4 A User Organisation which is a Core Use Organisation shall institute suitable arrangements for assigning to every individual who would require email for communication for official purposes of that Organisation, an organisation-linked email address at the time such User joins the Organisation, so that in the absence of a NICeMail user account, such individual and other Users in the Organisation do not resort to use of other email services or other less secure means of electronic communication. User Organisations which are other than a Core Use Organisation may also choose to create similar organisation-linked email addresses for communication for their official purposes. 5.5 A User Organisation which is provided NICeMail Services free of charge shall ensure deactivation of the organisation-linked email address assigned to a User upon such User ceasing to serve such User Organisation, or to hold office under or be serviced by it, or be engaged for the performance of any contractual, consulting or outsourced services that necessitate that User to have such email address. 5.6 A User Organisation which is provided NICeMail Services free of charge shall assign organisation- linked email addresses in a manner that would serve administrative efficiency while optimising cost to the public exchequer for the provision of such free services. 5.6.1 To so optimise, such User Organisation shall, while assigning email addresses, endeavour to maximise reusability of email addresses on a User ceasing to serve, hold office in or be engaged by that User Organisation, so that the individual assigned all or most of the duties of such User is able to access email correspondence previously exchanged, and the exchange of emails with others previously communicating with that User continues smoothly. 5.6.2 Where assignment of duties in such User Organisation follows an established pattern, this would involve assigning appropriate duty/work-linked usernames. For example, a Joint Secretary in charge of “xyz" Division in MeitY may be assigned the email address “[email protected]". In case she/he is holding charge of more than one division, distinct similar email addresses may be assigned for each division, to enable reusability across changes in work allocation. Similarly, in case an NIC Scientist is assigned the responsibilities of the Head of Division for the Personnel Division of NIC and is also designated as the Vigilance Officer of NIC, she/he may be assigned the email addresses "hod- [email protected]” and “[email protected]”. 5.6.3 Where assignment of duties in such User Organisation does not follow an established pattern, or the individual to be assigned the email address is performing duties that may have no foreseeable successor in terms of identifiable units of work, the email address may have other appropriate usernames. For example, an Officer on Special Duty (OSD) who is not in charge of any division, section or other such well-defined unit of work allocation but performs duties of a legal nature that are specifically entrusted to her/him from time to time in MeitY may be assigned the email address “[email protected]". In case there are multiple such OSDs, each OSD may be assigned distinct email addresses following any basis considered appropriate and reasonable, such as "[email protected]” and “osd- [email protected]”, or “[email protected]” and “[email protected]". Service-linked email address 5.7 An Appointing User Organisation that is provided NICeMail Services free of charge may, in addition to organisation-linked email addresses, assign service-linked email address to an eligible individual who is appointed by it on regular basis to a service or post in connection with its affairs. The individual User to whom such email address is assigned may use it only for communications relating to her/his service conditions, till the time such User continues to be appointed on regular basis to such service or post or holds a lien on the same. 5.7.1 The following categories of individuals appointed by such Appointing User Organisation shall be eligible for assignment of a service-linked email address, namely:- (a) An officer of the rank of Joint Secretary to the Government of India and above; and (b) Such other officer as Competent Authority may permit by general or special directions. 5.7.2 On or after the date 30 days preceding the date on which such an eligible individual is due to superannuate or retire voluntarily from service, her/his Appointing User Organisation may assign to her/him an email address for use after such superannuation or voluntary retirement and for enabling her/him to transfer from her/his service-linked email address only service condition related emails. The assignment of such new email address shall conform to the following, namely:— (a) Where the User is a member of an organised civil service, other than the General Central Service, the email address shall have a mail domain that includes “retired” as the prefix to the domain name. For example, the mail domain for an individual who is to or has retired as a member of the Indian Police Service may be "@retiredips.gov.in". (b) Where the User is a member of any force constituted under the Army Act, 1950, the Air Force Act, 1950 or the Navy Act, 1957, the email address shall have a mail domain that includes "veteran" as the prefix to the domain name. For example, the mail domain for an individual who is to or has retired as a member of such a force may be "@navyveteran.gov.in". (c) Where the User is not a member of a service as aforesaid, the email address shall have a mail domain that includes “retired" as the prefix to the domain name without the word "cadre". For example, the mail domain for an individual who is to or has retired as an officer of NIC may be "@retirednic.gov.in". (d) At the option of such User and on the recommendations of the Appointing User Organisation, conveyed to NIC by its DA with the approval of its competent authority, with effect from the date of such superannuation or voluntary retirement or such subsequent date as the User may specify, NIC may enable the sending of an automated response to an incoming email addressed to the service-linked email address of that User, intimating the new email address. (e) The email address shall be assigned subject to the individual making in advance such payment as NIC may determine from time to time, to meet the operational expenses incurred or likely to be incurred by NIC for the provision of such email address. 6. Use of services 6.1 Sharing of information using NICeMail Services shall be subject to the instructions contained in the Manual of Departmental Security Instructions and the National Information Security Policy and Guidelines issued by the Ministry of Home Affairs, and any other instructions and policy issued by it in this regard. 6.2 Email data and logs shall be preserved for such durations as may be specified by NIC from time to time in the Email Access and Use Instructions. However, on the request of the User Organisation concerned, conveyed to NIC by its DA with the approval of its competent authority, NIC may extend the duration of such preservation. 6.3 An NICeMail user account which is not accessed by the User for a period of 90 days shall stand deactivated. However, on the request of the User Organisation concerned, conveyed to NIC by its DA with the approval of its competent authority, NIC may extend such period, subject to the total period inclusive of extension not exceeding 180 days. 6.3.1 From the date on which the User has not accessed her/his NICeMail user account till the expiry of a period of 180 days, including any period of deactivation during such period of 180 days, the DA concerned may reactivate a deactivated user account. 6.4 In case the account of a User contains content which includes a communication link that connects to a malicious website, or which has an attachment containing malicious code or is intended to deceive a recipient, or is likely to otherwise endanger information security or cybersecurity, NIC may delete, or direct its email solution provider or system integrator to delete, such content from the User's account. 6.5 An organisation-linked email address assigned to a User shall not be mapped to the service-linked email address of such User, and emails received at such organisation-linked email address shall not be automatically forwarded to such User's service-linked email address. Part III: Functions, duties and responsibilities 7. Functions, duties and responsibilities of NIC 7.1 NIC shall perform the following functions and shall have the following duties and responsibilities, namely:- (a) To develop the procedure and systems for NICeMail Services; (b) To provide for such services, including through engagement of a suitable email solution provider and system integrator, and to formulate standard operating procedures and Email Access and Use Instructions for migration of email accounts of existing Users and requiring User Organisations, DAs and Users to ensure taking of steps in a timebound manner to secure timely migration; (c) To ensure reasonable security safeguards for information security and cybersecurity and the implementation of appropriate technical and organisational measures in the provision of such services for effective observance of the provisions of this Email Policy; and (d) To formulate and publish Email Access and Use Instructions, specifying the duties and responsibilities of User Organisations, DAs and Users. 7.2 Without prejudice to the generality of the functions, duties and responsibilities specified in paragraph 7.1, NIC shall perform functions and discharge duties and responsibilities as follows, namely:— (a) To determine the storage limit for NICeMail user accounts; (b) To determine Other NICeMail Services that may be made accessible to all or any class of Users through the email solution provided by NIC, including the use of applications integrated with such solution; (c) For ensuring cyber and information security and facilitating systematic and efficient management of emails,- (i) to put in place appropriate restrictions and conditions subject to which NICeMail Services and the features and functionalities available in the email solution provided by NIC and the applications integrated with such solution, may be used; (ii) to put in place reasonable security safeguards to detect and prevent delivery of malicious and suspicious emails; (iii) where external storage application provided by NIC is integrated with the email solution provided by it, to put in place appropriate policies regarding redirection of emails to such solution and interchange of emails between the user account and the external storage; (iv) to undertake forensic analysis on any email data that may be identified by it as containing malicious code, or intending to deceive recipient, or likely to otherwise endanger information or cyber security, and to take the assistance of third parties for this purpose; and (v) to put in place any other appropriate measures that NIC may consider necessary; (d) To determine the durations or the points in time till which logs shall be preserved; and (e) To determine the durations or the points in time till which email data shall be stored for a user account which is deactivated and, where external storage application provided by NIC is integrated with the email solution provided by it, for any email data stored in such external storage application. 8. Duties and responsibilities of User Organisations 8.1 Every User Organisation shall have the following duties and responsibilities, namely:— (a) To designate, with the approval of the competent authority of such User Organisation, on the online portal made available by NIC for User Organisations to designate DAs, one or more public servants, who shall be other than an employee of NIC, as Delegated Administrator, for the discharge of the duties and responsibilities of a DA under this Email Policy and the Email Access and Use Instructions; (b) To ensure reasonable security safeguards for information security and cybersecurity and the implementation of appropriate technical and organisational measures in the use of NICeMail Services by its Users and the due discharge of the duties and responsibilities of its DA(s), for the effective observance of the provisions of this Email Policy and the Email Access and Use Instructions; (c) Without prejudice to the generality of the duties and responsibilities specified in clause (b), to have in place mechanisms in the User Organisation to ensure effective observance of the provisions contained in section 5 of this Email Policy and to ensure User awareness regarding their duties and responsibilities; and (d) To discharge such other duties and responsibilities as may be specified in the Email Access and Use Instructions. 9. Duties and responsibilities of DAs 9.1 Every DA shall have the following duties and responsibilities, namely:— (a) On receipt of instructions from the competent authority in her/his User Organisation, to register herself/himself on the online platform made available by NIC for User Organisations to designate DAs, and to update her/his particulars on such platform on expiry of every subsequent period of one year; (b) On receipt of a request made in this behalf by a User on the online portal made available by NIC for accessing NICeMail, to create and assign to the User a NICeMail user account, in accordance with the provisions contained in section 5 of this Email Policy and the Email Access and Use Instructions; (c) On an ongoing basis, to update particulars of Users on the online portal made available by NIC for DAs to discharge their duties and responsibilities, to deactivate NICeMail user accounts as required and to discharge her/his duties and responsibilities under this Email Policy and the Email Access and Use Instructions; (d) To take all necessary steps for ensuring adherence by her/his User Organisation to its duties and responsibilities under this Email Policy and the Email Access and Use Instructions; and (e) To discharge such other duties and responsibilities as may be specified in the Email Access and Use Instructions. 10. Duties and responsibilities of Users 10.1 Every User shall have the following duties and responsibilities, namely:— (a) To ensure adherence to this Email Policy and the Email Access and Use Instructions; (b) Without prejudice to the generality of the duties and responsibilities specified in clause (a), — (i) if she/he belongs to a User Organisation which is a Core Use Organisation, to use only the organisation-linked email address assigned to her/him for the performance of her/his official duties; (ii) to not use such organisation-linked email address for any purpose other than the performance of her/his official duties; (iii) to not use the service-linked email address assigned to her/him for the performance of her/his organisation-linked official duties; (iv) to not use such service-linked email address for purposes other than those connected with service matters, save where such email address is assigned to her/him for use after retirement; (v) to not use her/his NICeMail address for registering on any social media or other websites or mobile applications, save for the performance of her/his official duties or with due authorisation from the authority competent in her/his User Organisation to so authorise; and (vi) to intimate forthwith to the DA concerned, any changes in her/his particulars as registered by her/him on the online portal made available by NIC for accessing NICeMail, including through such portal. 11. Provisions regarding email addresses previously assigned 11.1 The provisions contained in this Email Policy shall also apply, mutatis mutandis, to User Organisations and Users existing on, and email addresses assigned before, the date of its publication in the Official Gazette. 11.2 NIC shall coordinate with DAs and NICSI for securing adherence to this Email Policy by User Organisations in respect of such previously assigned email addresses, and DAs and their User Organisations shall ensure that necessary steps are taken to give effect to the Email Access and Use Instructions in this regard. 11.3 While the provisions contained in this Email Policy shall apply from the date of its publication in the Official Gazette, insofar as adherence to the provisions contained in section 5 of this Email Policy in respect of previously assigned email addresses is concerned, User Organisations shall ensure the same within a period of six months from the said date, or such longer period as Competent Authority may, by general or special directions, allow in respect of a User Organisation or class of User Organisations. 11.3.1 In the following categories of cases of user accounts that were previously assigned to a User and are not in conformity with the provisions contained in section 5, the email address of such an account may be mapped to another NICeMail user account of such User that conforms with the said provisions, for the purposes of the delivery of the incoming emails sent to such address, for such period as is specified below, namely:- (a) Where the mail domain of the User Organisation is changed, mapping as aforesaid may be done by NIC for an unrestricted period, save where NIC decides to restrict the same for any reason. (b) Where the user account is assigned by a User Organisation that is provided NICeMail Services free of charge and such account is not in conformity with the provisions contained in paragraphs 5.6.2, 5.6.3 and 5.7.1, mapping as aforesaid may be done by NIC for a period of one year from the date of such mapping, or such longer period as Competent Authority may, by general or special directions, allow in respect of a User Organisation, class of User Organisations or class of Users. (c) Where the user account is- (iii) assigned by a User Organisation that is provided NICeMail Services free of charge to a User who has ceased to serve such User Organisation, or to hold office under or be serviced by it, or to be engaged for the performance of any contractual, consulting or outsourced services that necessitate that User to have such email address, or to be appointed by it on regular basis to a service or post in connection with its affairs or hold a lien on the same; and (iv) not in conformity with the provisions contained in paragraph 5.7.2, mapping to her/his service-linked email address may be done by NIC only on the instructions of that User Organisation, conveyed by its DA with the approval of its competent authority, for a maximum period of three months from the date of such cessation. While issuing any such instruction, the User Organisation shall take into account- (1) any exigent circumstance or functional necessity; and (2) any information security risk that is likely to arise from the flow of information to and from such user account, which is assigned for official communications to such User who is no longer in the employment of or otherwise engaged by it. 12. Adherence to Email Policy 12.1 Every User Organisation shall exercise due diligence and take all necessary measures to ensure due adherence to the Email Policy and the Email Access and Use Instructions by such User Organisation, its DA(s) and its Users. 12.2 Every DA shall exercise due diligence and take all necessary steps to ensure due adherence to the Email Policy and the Email Access and Use Instructions by her/his User Organisation and its Users. 12.3 Every User shall adhere to the Email Policy and the Email Access and Use Instructions. 12.4 Every User Organisation, DA and User shall expeditiously report or cause to be reported to NIC in accordance with such manner as may be specified in the Email Access and Use Instructions, every cyber incident relating to NICeMail Services that comes to her/his knowledge. 12.5 NIC shall monitor and review the use of NICeMail Services and cyber incidents reported to it by User Organisations, DAs, Users and others and may require any User Organisation, DA or User to take such measures, including proactive and preventive measures, as it may specify for rectifying or remediating any non-adherence, or mitigating a cyber incident. 12.5.1 In case of non-adherence of a grave or repetitive nature, NIC may suspend the provision of all or any NICeMail Services to the User Organisation, DA or User concerned, while intimating to such Organisation, DA or User, as the case may be, in writing, of the reasons for such suspension and giving them a notice either specifying any measures that it/she/he may be required to take for the restoration of such Service(s) or giving them an opportunity to show cause why such Service(s) may not be withdrawn, for responding to the same within such period as the notice may specify. 12.5.2 Upon receipt of response to such notice or expiry of such period, NIC may proceed to take a decision regarding restoration or continuance of suspension or withdrawal of Service(s), keeping in view the response received, if any, and shall communicate such decision in writing to the Organisation, DA or User concerned. 12.6 Any person aggrieved by any intimation of suspension of any Service, or the continuance of such suspension, or the withdrawal of any Service, may prefer an appeal in writing to the Competent Authority, whose decision shall be final and binding. 12.7 Any suspension or withdrawal of Service(s) shall be without prejudice to the rights of NIC and the Government to take any other administrative or legal action. 13. Repeal 13.1 This Email Policy is in supersession of the E-mail Policy published in the Official Gazette, vide Ministry of Communication and Information Technology's Notification F. No. 2(22)/2013-EG-II, dated 18.2.2015. *** SANKET BHONDVE, Jt. Secy. Annex Organisation type (see paragraph 2) +-----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | S. No. | Organisation type | Description | | (1) | (2) | (3) | +=====+=========================+==========================================================================================================================================================================================================================================================================================================================================================================+ | 1. | Central Government | Means a ministry, department, secretariat or office specified in the First Schedule to | | | Department | the Government of India (Allocation of Business) Rules, 1961, and includes an attached office or subordinate office thereof. | +-----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 2. | Legislative Body | Means a body empowered by the Constitution to enact legislation, and includes the following bodies and the secretariats thereof, namely:- | | | | (a) Lok Sabha; | | | | (b) Rajya Sabha; | | | | (c) a Legislative Assembly or Legislative Council of a State; | | | | (d) the Legislative Assembly of the National Capital Territory of Delhi; and | | | | (e) a local Legislature of a Union territory. | +-----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3. | Court | Means- | | | | (a) a court of law; and | | | | (b) other adjudicatory body, established by or under the Constitution or any law for the time being in force in the whole or any part of India, | | | | and includes the registry, secretariat or office thereof. | +-----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4. | Constitutional Body | Means an office or a body established by or under the Constitution, and— | | | | (a) includes an authority, board, commission, committee or council by or under the Constitution; and | | | | (b) does not include any of the following, or any secretariat or office thereof, namely:- | | | | (i) the Central Government; | | | | (ii) a State Government; | | | | (iii) a UT Government/Administration; | | | | (iv) a Legislative Body; | | | | (v) a Court; and | | | | (vi) a local government. | +-----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 5. | State Government | A ministry, department, secretariat or office— | | | Department | (a) specified in the rules made by the Governor under clause (3) of article 166 of the Constitution, for the allocation of the business of the Government of the State; and | | | | (b) a department of a UT Government, | | | | and includes an attached office or subordinate office thereof. | +-----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 6. | Statutory Body | Means- | | | | (a) an office; and | | | | (b) a body, including an authority, board, commission, committee or council, established by or under the any law for the time being in force, and includes the secretariat or office thereof, but does not include a Constitutional Body, a Public Educational or Research Institution, a Public Healthcare Institution or a Public Sector Enterprise. | +-----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7. | Public Educational | Means- | | | or Research | (a) an institution of learning that imparts education, including vocational education, or engages in and which- | | | Institution | (i) is established, incorporated, owned, controlled or recognised- | | | | (1) by or under a Central Act; | | | | (2) by or under a Provincial Act or a State Act, but does not include a University whose Chancellor is other than the Governor of the State concerned; | | | | (3) by the Central Government, a State Government or a local government; or | | | | (4) by a body established by law for the co-ordination and determination of standards in institutions for higher education or research and scientific and technical institutions and is empowered to regulate such institutions; | | | | (ii) is declared as an institution deemed to be University under the Universities Grants Commission Act, 1956, or is affiliated to a University; or | | | | (b) an institution that engages in research, and includes a scientific or technical institution established by or under law for the time being in force in the whole or any part in India or by the Central Government, a State Government or a UT Government. | +-----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8. | Public Healthcare | Means an entity which is— | | | Institution | (a) a hospital, maternity home, nursing home, dispensary, clinic, sanatorium or institution that offers services, facilities requiring diagnosis, treatment or care in any recognised system of medicine, as referred to in sub-clause (i) of clause (c) of section 2 of the Clinical Establishments (Registration and Regulation) Act, 2010; or | | | | (b) a place connected with the diagnosis or treatment of diseases or investigative services with the aid of laboratory or other medical equipment, as referred to in sub-clause (ii) of the said clause, | | | | and which is owned, controlled or managed by- | | | | (i) a Central Government Department; | | | | (ii) a State Government Department; | | | | (iii) a body under the overall control of a Central Government Department or a State Government Department, and includes— | | | | (1) an Autonomous Body; and | | | | (2) a not-for-profit Government company; | | | | (iv) a local government; or | | | | (v) a force constituted under the Army Act, 1950, the Air Force Act, 1950 or the Navy Act, 1957, | | | | and which is not a Public Educational or Research Institution. | +-----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9. | Public Sector | Means a public sector enterprise of the Central Government, a State Government or a UT Government, but does not include a not-for-profit Government company. | | | Enterprise | | +-----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10. | Other Government- | Means a body, whether incorporated or not, which— | | | controlled Entity | (a) is under the overall control of a Central Government Department or a State Government Department, and includes- | | | | (i) an Autonomous Body; and | | | | (ii) a not-for-profit Government company; and | | | | (b) is not a Public Educational or Research Institution or a Public Healthcare Institution. | +-----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 11. | Other Authorised | Means a body, whether incorporated or not, which does not fall within any of the other categories of Organisations and which is— | | | Entity | (a) a User Organisation on the date of publication of this Email Policy in the Official Gazette; or | | | | (b) authorised the use of NICeMail Services by or under general or special directions of Competent Authority. | +-----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ Notes: 1. No project, scheme, programme or initiative, by whatever name called, or a team, administrative division, etc. in charge of such project etc., shall be considered as a body, court, department, enterprise, entity, institution, ministry, office or secretariat that is included in any of the organisation types listed in this Annex. 2. In this Annex, — (a) "Autonomous Body" means a body established by the Central Government, a State Government or a UT Government to discharge activities or functions related to execution or implementation of government policies and which are given autonomy for the discharge of their functions, and does not include a Constitutional Body or a Statutory Body; (b) "not-for-profit Government company” means a company that is— (i) registered under section 25 of the Companies Act, 1956 or section 8 of the Companies Act, 2013; and (ii) a Government company as defined in the Companies Act, 2013; (c) "University” means a university as defined in the Universities Grants Commission Act, 1956; and (d) “UT Government” means the— (i) the government of a Union territory with Legislature; and (ii) the administration of any other Union territory. Uploaded by Dte. of Printing at Government of India Press, Ring Road, Mayapuri, New Delhi-110064 and Published by the Controller of Publications, Delhi-110054. GORAKHA NATH Digitally signed by GORADIA NATH YADAVA YADAVA 530