India’s power-sector cyber rules push OT governance to centre stage

At a glance

What this is: India's new CEA cyber regulations turn power-sector cybersecurity into a regulatory operating model spanning governance, asset visibility, OT monitoring and supply-chain control.

Why it matters: For IAM and security teams, the article matters because it shows how compliance now depends on provable control over identities, access paths, vendors and operational environments, not just policy language.

Context

India's power sector is moving from informal security practice to regulated cyber governance, with controls now expected across generation, transmission, distribution, load dispatch and storage. The core problem is not the absence of policy language, but the absence of repeatable evidence that operational technology, vendor access and incident reporting are under control.

That shift matters because OT environments rarely fit enterprise security assumptions. Legacy assets, segmented trust zones, external service providers and remote operations create a governance problem that blends resilience, access control and supply-chain assurance. Where organisations lack complete inventories or clear approval chains, the regulations force them to close those gaps rather than merely document them.

Key questions

Q: What breaks when power-sector OT is not isolated from corporate networks?

A: When OT shares trust paths with corporate IT or external parties, the operator loses the ability to contain compromise to a narrow segment. That creates operational blast radius, weakens safety boundaries and makes incident response slower because the network no longer reflects the real control structure of the plant.

Q: When should power operators prioritise asset visibility over new security tooling?

A: They should prioritise visibility first when they cannot confidently answer what assets exist, how they communicate or which systems are externally reachable. New tooling cannot compensate for missing inventory, because segmentation, vulnerability management and incident response all depend on accurate operational context.

Q: What do security teams get wrong about vendor risk in critical infrastructure?

A: They often treat vendor assurance as a procurement step instead of an ongoing control. In critical infrastructure, supplier patching, recovery evidence, disclosure processes and remote access boundaries all need lifecycle governance, or the organisation inherits third-party risk without the evidence needed to manage it.

Q: Who is accountable when compliance evidence is incomplete?

A: Accountability should sit with the control owner, the system owner, and the governance function that defined the evidence standard. If those roles are unclear, compliance becomes a reporting problem instead of a control problem, and audit findings become harder to resolve.

Technical breakdown

Why OT isolation and segmented trust zones are now regulatory controls

The regulations effectively codify defence-in-depth for industrial environments. Physical isolation is the default expectation, but where business requirements create connectivity, operators must use hardened logical separation, risk assessment, approval processes and continuous monitoring. That combination matters because OT traffic is often deterministic and operationally sensitive, so a flat trust model can turn ordinary remote access into an enterprise-wide control failure. Segmentation into different trust levels is therefore not just network hygiene; it is a governance mechanism that constrains operational blast radius and preserves safety and availability. See the Water and Wastewater Cybersecurity Guide.

Practical implication: Treat OT segmentation and remote access as regulated control surfaces, not architecture preferences.

How cyber asset registers become the evidence base for compliance

The regulations make visibility a formal obligation by requiring detailed cyber asset registers, network architectures, protocol documentation and ongoing risk assessment. In practice, this means operators need a living inventory of devices, firmware, communication paths and externally connected systems. Without that evidence, vulnerability prioritisation, segmentation validation and incident investigation all become speculative. The governance issue is familiar to identity teams as well: if you cannot inventory what exists, you cannot govern what can connect, authenticate or be trusted. See the Security Exceptions and Risk Acceptance Guide.

Practical implication: Build a continuously maintained asset and communication inventory before attempting audit readiness.

Why vendor and service-provider requirements now affect operational resilience

The regulations extend responsibility beyond the asset owner to vendors and service providers, requiring security updates, recovery procedures, bills of materials, lifecycle information and disclosure processes. That makes procurement a security control, not a commercial afterthought. The technical point is that third-party access and software supply chains are now part of the operational attack surface, so a compromised supplier can become a route into control systems. For identity practitioners, this is the same structural problem seen in third-party privileged access: lifecycle governance matters as much as initial trust. See the Identity Provider and SSO Security Guide.

Practical implication: Fold supplier access, patching obligations and recovery evidence into contract and access reviews.

Threat narrative

Attacker objective: The objective is to disrupt power operations or gain durable access to critical operational networks while exploiting weak separation and poor asset visibility.

1. Entry occurs through remote connectivity, vendor access or exposed operational systems when OT environments are not fully isolated from corporate or external networks.
2. Escalation follows when an attacker or unsafe connection reaches a trusted operational segment without sufficient approval, monitoring or trust-level separation.
3. Impact is achieved through disruption of generation, transmission or distribution operations, or through loss of visibility needed to respond safely and prove compliance.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Governance is now an operational control, not a policy artefact: the CEA framework makes power-sector cybersecurity measurable through registers, approvals, monitoring and reporting. That matters because many security programmes still treat governance as documentation, while operational environments require evidence that trust boundaries, remote access and vendor exposure are actively controlled. The organisations that struggle will be the ones that cannot turn policy into repeatable enforcement.

India's power rules expose the asset-visibility gap as a compliance failure mode: if an operator cannot inventory devices, protocols and external connections, it cannot meaningfully assess risk or validate segmentation. That is why visibility is not a supporting control here, but the mechanism that makes every other requirement auditable. The article's central lesson is that incomplete industrial telemetry becomes a governance defect, not just an operational blind spot.

Third-party access has become a regulated attack path: by pushing security duties into vendor contracts, updates and recovery evidence, the regulations recognise that supplier trust is part of the operational perimeter. Identity Provider and SSO Security Guide is relevant here because the same lifecycle problem appears whenever access is granted to external parties and then not continuously reviewed. Practitioners should treat supplier governance as a permanent access-management process, not a one-time procurement checkbox.

OT security is increasingly converging with identity governance: access approvals, trust levels, service-provider boundaries and remote operation controls now determine whether a plant can remain safe under scrutiny. The important shift is not simply more monitoring, but more disciplined decisions about who and what is allowed to connect, change state or observe critical systems. Practitioners should align OT resilience work with identity and access governance rather than keeping them separate.

Read next: Water and Wastewater Cybersecurity Guide

What this signals

Regulated OT visibility will become the new baseline: operators will increasingly be judged on whether they can prove what is connected, how it communicates and where trust boundaries exist. That shifts the programme from reactive hardening to continuous evidence collection, which is the only reliable way to support audits and incident response in legacy industrial estates.

Supply-chain governance is now part of operational resilience: the new model treats updates, recovery artefacts and disclosure obligations as prerequisites for safe deployment. For practitioners, that means procurement, vendor access and configuration assurance now sit inside the same control loop as network segmentation and monitoring.

Identity governance is moving deeper into OT: approvals, service-provider access and remote-operation boundaries are becoming as material as device security. Security teams should expect more pressure to prove not just that access exists, but that it is bounded, approved and continuously reviewable.

For practitioners

• Build a live OT asset register Capture devices, firmware, protocols, communication paths and external connections in a continuously updated inventory that can stand up to audit and incident review.
• Separate remote access from default trust Require hardened logical separation, approval workflows and continuous monitoring for any connectivity between corporate IT, vendors and OT networks.
• Embed supplier controls into contracts Require patches, recovery procedures, bills of materials, lifecycle information and vulnerability disclosure obligations in every critical service agreement.
• Document incident reporting ownership Assign clear responsibility for CSIRT-Power and CERT-In reporting so escalation, evidence collection and regulatory notifications do not depend on ad hoc decision-making.

Key takeaways

• India's power-sector regulations turn cybersecurity into an operational and governance obligation across IT, OT, vendors and reporting chains.
• The hardest implementation gap is not policy writing but proving asset visibility, trust boundaries and escalation ownership in live environments.
• Operators that treat procurement, remote access and incident reporting as regulated controls will be better placed to meet the April 2027 deadline.

Related NHI Mgmt Group resources: Water and Wastewater Cybersecurity Guide · Identity Provider and SSO Security Guide · Security Exceptions and Risk Acceptance Guide · Global Cybersecurity Regulatory Map

Key terms

• Operational Technology Asset Visibility: Operational Technology Asset Visibility is the ability to identify and track industrial assets, their roles, and their connections across an OT environment. It is the foundation for risk management because organisations need accurate asset context before they can assess vulnerabilities, prioritise protections, or demonstrate compliance with critical infrastructure obligations.
• Cyber Asset Register: A cyber asset register is a maintained inventory of systems, devices, firmware and connections that matter to security and operations. In regulated environments, it becomes the source of truth for what exists, what communicates and what requires risk treatment or monitoring.
• Defence in Depth for OT: Defence in depth for OT is the use of layered physical, logical and procedural controls to protect industrial systems without sacrificing availability or safety. It relies on segmentation, monitoring, approvals and network design rather than assuming any single control will hold.
• Supplier Security Governance: Supplier security governance is the discipline of controlling how third parties access, handle, and support sensitive information and systems. In defence and other regulated supply chains, it links onboarding, access review, data handling, and offboarding to business trust and resilience.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps identity, security and platform teams align access control with the broader programmes their organisations depend on.