Please click here to download the Prism as a PDF.
Central Electricity Authority notifies the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026
The Central Electricity Authority (“CEA”), on July 31, 2026, has notified the CEA (Cyber Security in Power Sector) Regulations, 2026 (“Regulations”), in terms of Section 177(1) read with Section 73(c) of the Electricity Act, 2003 (“Electricity Act”), to ensure safe and secure operation and maintenance of electrical plants and lines.
The Regulations will come into force with effect from April 1, 2027, except for Regulations 5(9), 5(24), 5(33), 5(39), 6(2) and 6(7), which will come into force on dates the CEA specifies through separate orders with the prior approval of the Central Government.
With this intervention, cyber security in India’s power sector moves from an Information Technology (“IT”) housekeeping matter to a board-level governance mandate. Entities across generation, transmission, distribution and grid operation, as well as power exchanges and vendors, will now have to demonstrate cyber resilience as part of how they are governed, and not merely how their systems are configured.
Key provisions of the Regulations
- In respect of generating companies, captive generating plants, and organisations having an energy storage system, the Regulations will apply only where such entities have an installed capacity of 50 (fifty) megawatts or more.
- The Computer Security Incident Response Team-Power (“CSIRT-Power”) will be the coordinating agency for reporting and responding to cyber security incidents associated with the power sector. CSIRT-Power will also be the nodal agency of the power sector for analysis, prediction and prevention of cyber security incidents and dissemination of information thereof.
- Each entity must designate regular employees of senior management level as Chief Information Security Officer (“CISO”) and alternate CISO for a minimum period of 3 (three) years.
- Each entity must establish a dedicated Information Security Division (“ISD”) headed by the CISO, within India, for dealing with all cyber security related matters, which must remain operational round the clock. The staff deployed in the ISD must have valid certificates of successful completion of domain-specific cyber security courses and must attend cyber security training courses associated with the power sector for at least 5 (five) man-days in each financial year. This requirement will come into force on a date to be separately specified by the CEA.
- Each entity must have a defined and documented cyber security policy, approved and reviewed annually by the head or board of the entity, and must prepare a cyber crisis management plan in consultation with the CSIRT-Power, which must be vetted by the Indian Computer Emergency Response Team and approved and reviewed annually.
- Each entity will ensure deployment of all required security devices, including firewalls at the electronic security perimeter, meeting requirements of, inter alia, packet filtering, deep packet inspection, content, user and application-based filtering, detection and inspection of encrypted traffic, intrusion detection and prevention, and geo-fencing.
- Each entity must store sensitive information and sensitive data, including such data and information hosted on cloud as well as historical data and information, in an encrypted, secured, and protected environment.
- Each entity will facilitate a comprehensive cyber security audit encompassing all critical systems at least once every financial year, with a minimum gap of 9 (nine) months and a maximum gap of 15 (fifteen) months between two consecutive audits. 3 (three) consecutive audits must not be carried out by the same auditing agency or personnel.
- Each entity will maintain a cyber asset register containing requisite details including ownership, hardware, firmware, software, and patch details, as well as details of all critical systems including configuration, network architecture depicting data flows, and communication protocols. Such register must be reviewed and updated at least once in every financial year or upon commissioning of any new cyber asset or critical system.
- The Cyber Security Policy must be aligned with the business continuity plan of the entity, covering Operational Technology as well as IT environment.
- The Cyber Crisis Management Plan must include detailed standard operating procedures to detect and identify all incidents, criteria to classify an incident as a crisis, a list of all possible crisis scenarios, identification of stakeholders with their roles and responsibilities, and mitigative measures to minimise impact and recover from crisis at the earliest.
- The vendors must provide documented and tested procedures as well as recovery plans for restoration of systems supplied by them from potential cyber crisis scenarios. They must ensure that digitally signed or validated security patches and updates are available to entities throughout the contract period or useful life of such systems, whichever is later.
- In the case of distributed generation resources of prosumers, vendors must store any application, monitoring and control servers, and real-time data, including any data or information hosted on cloud platforms, in an encrypted, secure, and protected environment located exclusively within India. Vendors must establish remote access, remote operation, and exchange of real-time data with distribution licensees through secure channels after mutual authentication and must encrypt such communication.
- Entities must conduct cyber security audits as per the scope detailed in cyber security audit guidelines and directions issued by CSIRT-Power and other cyber security agencies designated by the Central Government.
- Each entity must conduct a self-audit to assess its compliance with the Regulations every financial year and must address non-compliances in a time-bound manner, ensuring all non-compliances are addressed before the self-audit scheduled in the next financial year.
- In specific cases, after seeking written clarifications and conducting an examination, the CISO, Ministry of Power (“MoP”) may recommend that the Central Government initiate appropriate proceedings under the Information Technology Act, 2000, or may file a petition before the appropriate Commission for proceedings under Section 142 of the Electricity Act.
- The CEA may, by order and for reasons recorded in writing, relax any provision of the Regulations, on its own motion or on an application made by an interested person, to remove hardship arising out of the operation of these Regulations for a class of persons.
Conclusion
The Regulations represent a comprehensive and far-reaching regulatory intervention in the domain of cyber security for India’s power sector. By establishing a structured framework that covers entities engaged in generation, transmission, distribution, and grid operation as well as power exchanges and vendors, the Regulations significantly expand the cyber security measures at the aforesaid entities. The mandatory appointment of a CISO with a minimum tenure of 3 (three) years, establishment of a round-the-clock information security division, and the requirement for annual cyber security policy approval at the board level, signify the expectation that cyber security governance will be embedded in the management of these organisations. The same is inter alia required for:
- safeguarding national security and grid reliability;
- protecting power plants, transmission networks and distribution licensees from cyber-attacks; and
- standardising the steps necessary for preventing cyber-attacks.
The enforcement architecture under the Regulations is robust and includes the power of the CISO, MoP, to commission third-party audits at the entity’s cost, examine self-audit compliance reports, and recommend proceedings under the Information Technology Act, 2000 or Section 142 of the Electricity Act, and creates a deterrent against non-compliance with the Regulations by the aforesaid entities.
This Prism has been prepared by:
|
Akshat Jain |
Shikhar Verma |
|
For more details, please contact km@jsalaw.com.
