India's power-sector cyber rules: what OT leaders need to act on

TL;DR: India's Central Electricity Authority cyber regulations will force power-sector operators to treat cybersecurity as an operational discipline across IT and OT, with formal governance, asset visibility, monitoring, incident reporting and supply-chain controls required before the 1 April 2027 deadline, according to Nozomi Networks. Compliance now depends on proving control execution, not just documenting policy.

Editorial analysis by NHI Mgmt Group, based on content published by Nozomi Networks: “India's New CEA Cybersecurity Regulations: What Power Sector Leaders Need to Know Before April 2027”.

Key questions

Q: What breaks when power-sector OT is not isolated from corporate networks?

A: When OT shares trust paths with corporate IT or external parties, the operator loses the ability to contain compromise to a narrow segment.

Q: When should power operators prioritise asset visibility over new security tooling?

A: They should prioritise visibility first when they cannot confidently answer what assets exist, how they communicate or which systems are externally reachable.

Q: What do security teams get wrong about vendor risk in critical infrastructure?

A: They often treat vendor assurance as a procurement step instead of an ongoing control.

Practitioner guidance

• Build a live OT asset register Capture devices, firmware, protocols, communication paths and external connections in a continuously updated inventory that can stand up to audit and incident review.
• Separate remote access from default trust Require hardened logical separation, approval workflows and continuous monitoring for any connectivity between corporate IT, vendors and OT networks.
• Embed supplier controls into contracts Require patches, recovery procedures, bills of materials, lifecycle information and vulnerability disclosure obligations in every critical service agreement.

Bottom line: India's power-sector regulations turn cybersecurity into an operational and governance obligation across IT, OT, vendors and reporting chains.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →