India Mandates New Cybersecurity Regulations for Power Sector
The Central Electricity Authority (CEA) has officially introduced the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026, marking a significant step towards bolstering the cybersecurity posture of India's vital energy infrastructure. These regulations, which are set to come into force from April 1, 2027, transition the power sector from a system of voluntary advisories to mandatory, legally enforceable cyber defense standards. The move comes amidst growing concerns over sophisticated cyber threats targeting critical infrastructure, as highlighted by reports of numerous thwarted attacks on the sector in the past year.
The new framework applies broadly to all transmission utilities, distribution licensees, load dispatch centers, power exchanges, and generating companies with an installed capacity of 50 MW or more, including captive plants and energy storage systems. Key provisions mandate the physical and logical segregation of operational technology (OT) systems from the public internet and general information technology (IT) networks. Entities must also ensure that sensitive operational and historical data, including that hosted on cloud platforms, is securely encrypted and stored exclusively within India.
Furthermore, the regulations introduce strict governance and operational requirements. Each covered entity must appoint a senior-level Chief Information Security Officer (CISO) for a minimum three-year tenure, supported by a dedicated, 24/7 Information Security Division based in India. Power sector organizations are now obligated to report all cybersecurity incidents to the Computer Security Incident Response Team – Power (CSIRT-Power) and the Indian Computer Emergency Response Team (CERT-In) within six hours of detection, with a 24-hour deadline for incidents classified as cyber sabotage. Annual cybersecurity audits, including vulnerability assessments and penetration testing, are also mandatory, with critical vulnerabilities requiring resolution within one month. This comprehensive approach aims to create a more resilient and secure digital ecosystem for India's power sector.
