India CEA Power Sector Cyber Security Regulations: duties for utilities

India's power sector now has legally binding cyber security regulations, and generators, grid operators and the vendors that serve them have until 1 April 2027 to be ready. The Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026 were notified on 31 July 2026 (PwC India, TeamLease RegTech). This guide explains who the regulations reach, the governance, OT segregation, incident reporting, audit and supply chain duties reported so far, and a practical readiness plan for utilities. It is written for CISOs, OT security leads and compliance teams at Indian power sector entities and their suppliers.

Source note: this page is based on secondary sources because the official text on the CEA website could not be accessed when we checked in November 2026. We used summaries by PwC India, KPMG India, TeamLease RegTech, Powerline and Energetica India. Each obligation below is attributed to its source, and dates and figures appear only where two independent sources agree. Confirm against the official text before relying on it.

Key takeaways

• Binding, not guidance. PwC India describes the regulations as India's first comprehensive and legally binding cyber security framework for the power sector. Notification is dated 31 July 2026 (PwC India, TeamLease RegTech); most provisions apply from 1 April 2027 (PwC India, TeamLease RegTech, Powerline, Energetica India).
• Thresholds bring in generators. Generating companies, captive plants and energy storage systems of 50 MW and above are covered (Powerline, Energetica India, KPMG India), alongside transmission, distribution, load despatch and power exchanges.
• Reporting clocks are short. Cyber security incidents must be reported within six hours, and cyber sabotage of critical systems within 24 hours (Powerline, Energetica India).
• OT must be separated from IT and the internet. Powerline and Energetica India report a general requirement to isolate OT from IT and the internet.
• Vendors are in scope. KPMG India and Energetica India report supply chain duties including bills of materials and patch support, and both report data localisation duties.

Status and timeline

Check the official notification for any provisions with a different commencement date, as some duties may already be due.

Who is covered

• Entities: generation, transmission, distribution, load despatch, power exchanges and other covered enterprises (PwC India); TeamLease RegTech uses the term "Responsible Entities" and also lists renewable energy operators.
• Assets: OT infrastructure linked to the interconnected power system, and IT physically or logically connected to that OT (Powerline).
• Thresholds: 50 MW and above for generating companies, captive generating plants and energy storage systems (Powerline, Energetica India, KPMG India).
• Supply chain: Powerline and KPMG India both report that vendors face cyber security requirements.

If you are a vendor or integrator, expect your customers to pass these duties to you through contracts before April 2027.

Obligations reported so far

The six-hour clock matches the CERT-In reporting window for many incident types; see the CERT-In Directions 2022 Guide. Plan one internal escalation path that can meet both.

Where identity fits

OT isolation and remote access duties are where identity matters most. Engineering workstations, historians, SCADA service accounts, vendor remote access accounts and shared HMI logins are the credentials an attacker uses to cross from IT into OT. NHI Mgmt Group recommends an inventory of every account and credential that can reach the OT zone, named accounts for vendors with time-bound access, and vaulted shared credentials with rotation after each vendor session. See the Critical Infrastructure Identity Security Guide.

Readiness plan to April 2027

This sequence is NHI Mgmt Group's recommendation, built on the obligations reported above.

1. Obtain and read the official text. Confirm scope, thresholds, any provisions with different dates, and audit, certification and data localisation detail.
2. Appoint the CISO. Record authority and reporting line, and decide how incidents will be detected and escalated around the clock.
3. Map OT and connected IT. Build asset and identity inventories for every site in scope, including connections to cloud and vendor networks.
4. Segregate. Close direct IT to OT paths and internet exposure; where data must leave OT, use unidirectional gateways. See the Data Diodes and Unidirectional Gateways Guide.
5. Rehearse the six-hour report. Run a tabletop that ends with a report to CSIRT-Power and CERT-In, timed from detection.
6. Update contracts. Add SBOM delivery, patch support, data localisation and incident notification to vendor and cloud contracts. See the SBOM Guide.
7. Run a pre-audit. Assess against the official text by late 2026, leaving time to fix findings.

Decision guidance

• Large utilities versus small generators: state utilities with many sites need a programme office and phased site rollout; a single 50 MW plant can meet most duties with one CISO, an outsourced monitoring service and a vendor access gateway.
• Existing ISMS: where an ISO/IEC 27001 management system already exists, consider extending its scope to OT rather than building a parallel system. Confirm any certification requirement in the official text first.
• Air gap versus controlled exchange: isolation is the reported default; where data must leave OT, consider unidirectional gateways, and only where the business case for data export is documented.

Detection and measurement

• Time from detection to report, measured in exercises and real incidents, against the six-hour clock.
• Number of IT to OT and internet to OT paths found and closed.
• Share of OT accounts that are named, vaulted or time-bound.
• Share of critical OT suppliers who have delivered an SBOM and patch support commitment.
• Open audit findings by severity and age.

Framework mapping

Mappings are ours and indicative. See the IEC 62443 Guide.

Common failure patterns

• Waiting for April 2027: segregation and contract changes take longer than a year at multi-site utilities.
• Vendor remote access left out: isolation projects close IT paths but leave persistent vendor connections.
• Reporting chain untested: nobody on night shift knows who files the six-hour report.
• Data held offshore: cloud or historian copies sit outside India without checking the reported localisation duty.
• Relying on summaries: compliance plans built from news coverage miss provision-level detail.

Practitioner checklist

• Obtain the official notification and confirm scope and dates.
• Appoint a CISO and set out round-the-clock escalation.
• Inventory OT assets, connected IT and every OT credential.
• Remove direct IT and internet paths into OT.
• Exercise the six-hour and 24-hour reports end to end.
• Add SBOM, patch, localisation and notification clauses to vendor contracts.
• Confirm data localisation scope in the official text and map where OT data is held.
• Run a pre-audit before the end of 2026.

Standards and references

• Central Electricity Authority: Draft regulations listing (Cyber Security in Electricity Sector)
• PwC India: CEA notifies India's first comprehensive and legally binding cyber security regulatory framework for the power sector
• TeamLease RegTech: Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026
• KPMG India: What the CEA's 2026 cyber security regulations mean for the power sector
• Powerline: CEA notifies CEA (Cyber Security in Power Sector) Regulations, 2026
• Energetica India: CEA notifies cybersecurity norms for power plants and ESS of over 50 MW

This guide summarises the CEA (Cyber Security in Power Sector) Regulations, 2026 from secondary sources and is not legal advice. Related NHI Mgmt Group resources: Critical Infrastructure Regulation Map · Electric Utility Cybersecurity Programme Guide · India Telecommunications (Telecom Cyber Security) Rules 2024 · OT Security Guide