India’s new cyber security rules for the power sector aim to close gaps in digital resilience as grids become increasingly interconnected, demanding higher governance standards, stricter controls, and enhanced oversight to prevent cyber attacks impacting physical assets.
India’s new cyber security rules for the power sector are designed to close a gap that has become more urgent as electricity grids grow more digital and more exposed. The Central Electricity Authority notified the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026 on 31 July 2026, setting a staged start date of 1 April 2027 for most provisions. The move reflects a broader shift in the sector: the boundary between information technology and operational technology is increasingly blurred, and a cyber attack can now affect not just data systems but physical generation, transmission and distribution assets.
The regulations cast a wide net. They cover entities that own, run or manage operational technology linked to the interconnected power system, along with the associated IT environment. They also apply to power exchanges and over-the-counter platforms, as well as vendors such as original equipment manufacturers, suppliers, contractors and cloud service providers. For generation, the rules catch generating companies, captive plants and energy storage systems with installed capacity of 50 megawatts or more. Smaller facilities are being steered towards the Indian Computer Emergency Response Team’s 15 Elemental Cyber Defence Controls for micro, small and medium enterprises.
A core feature of the framework is the elevation of cyber governance inside each organisation. The rules require a chief information security officer and an alternate, with the CISO reporting directly to the head of the entity and operating as a ring-fenced function. A dedicated information security division is also expected to run around the clock once the relevant requirement is separately notified. Entities must maintain a board-approved cyber security policy, a cyber crisis management plan, an asset register and a risk assessment and mitigation plan, with the assessment reviewed at least every six months and examined annually. According to industry summaries of the notification, the CISO and alternate CISO are expected to serve a minimum three-year tenure, underscoring the intention to make the function durable rather than ad hoc.
The technical controls are equally demanding. The regulations call for strict separation between operational technology and IT systems, with physical isolation from the internet preferred and hardened logical segregation allowed only where physical separation is not practicable and after risk assessment, approval and continuous monitoring. Sensitive data, including information hosted on cloud platforms, must be stored in India. Critical systems need separate online and offline back-ups, while new critical systems must undergo cyber security audit, vulnerability assessment and penetration testing before they are commissioned or replaced. The rules also require continuous monitoring and rapid reporting: incidents must be notified to CSIRT-Power and CERT-In within six hours. Some summaries of the notification add that incidents involving cyber sabotage of critical systems should be reported within 24 hours. Vulnerabilities assessed as critical or high risk must be fixed within one month, while medium and low-risk issues must be closed within three months.
Procurement and vendor oversight are also being tightened. Purchases are to come from trusted sources and are expected to include authenticated security patches, restoration procedures, vulnerability disclosure processes and software or hardware bills of materials. That may improve traceability across a supply chain that has become a major source of risk, but it will also raise costs. The article by Sarthak Advocates & Solicitors notes that the regulations create no specific recovery mechanism for those expenses, although generators with existing power purchase agreements may be able to argue for tariff pass-through if their contracts treat the new obligations as a change in law. Whether such costs are recoverable will depend on the wording of the contract, the relevant cut-off date and the ability to show measurable financial impact.
The question of enforcement remains open to some extent. Entities must carry out a self-audit every financial year, and responsibility for that exercise can be assigned to a board member or senior manager. Yet, as Sarthak Advocates & Solicitors points out, the self-audit stays with the entity and there is no fixed filing format or routine regulatory submission. Third-party verification may be used where needed, but independent scrutiny is not built into every cycle. For infrastructure of this scale, outside review could provide stronger assurance, especially given the potentially wide consequences of a failure. Non-compliance may trigger proceedings under the Information Technology Act, 2000, or action under section 142 of the Electricity Act, 2003, which carries a penalty of up to INR100,000 and additional daily fines for continuing breaches. On major projects, that may prove a modest deterrent. The new rules therefore mark an important step, but their long-term effectiveness will depend on implementation, audit quality and whether enforcement keeps pace with the risks they are meant to address.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
