CEA notifies Cyber Security in Power Sector Regulations, 2026 (effective from April 1, 2027)
Security · Monday, 17 August 2026
The Central Electricity Authority notified the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026 under the Electricity Act, 2003, to come into force from April 1, 2027. The framework sets binding cyber defence standards for power-sector entities across IT/OT systems, including CISO requirements, incident reporting timelines, audits, network isolation, data localisation, and supply-chain safeguards.
Quick highlights
- Notified by CEA under Electricity Act, 2003; effective date: April 1, 2027.
- Framed under Section 177 read with Section 73(c) of the Electricity Act, 2003, with concurrence from MeitY (as stated).
- Applies across power sector; for generating companies/captive plants/ESS: threshold 50 MW and above.
- Mandates senior-level CISO and Alternate CISO (minimum 3-year tenure) and a 24/7 Information Security Division within India.
- Incident reporting: to CSIRT-Power and CERT-In within 6 hours; cyber sabotage incidents in critical systems within 24 hours.
- Requires IT–OT network isolation, VAPT audits, vulnerability closure timelines, data localisation within India, and trusted procurement with BoM.
Context
CEA notified the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026 under the Electricity Act, 2003, coming into force from April 1, 2027.
Key Facts
Legal basis (as per source): CEA framework under Section 177 read with Section 73(c) of the Electricity Act, 2003, with concurrence from MeitY. Scope: • Applies to transmission utilities, distribution licensees, load dispatch centres, power exchanges, and OTC platforms. • For generating companies, captive plants, and Energy Storage Systems (ESS): applies to installations of 50 MW and above. Institutional requirements: • Regular senior-level CISO + Alternate CISO, minimum 3-year tenure. • Dedicated 24/7 operational Information Security Division within India. Core controls: • Physical and logical isolation of OT/CII from public internet and general IT networks. • Incident reporting to CSIRT-Power and CERT-In within 6 hours; cyber sabotage incidents within 24 hours. • Audits: mandatory VAPT pre-commissioning for new critical systems; annual audits with 9–15 month gap. • Vulnerability closure: critical/high risk within 1 month; medium/low within 3 months. • Data localisation: sensitive operational/historical grid data (including cloud-hosted) must be encrypted and stored exclusively within India. • Supply chain: trusted sources, Software/Hardware Bill of Materials (BoM); encrypted communications and local hosting for prosumer distributed generation vendors.
Significance
The regulations aim to protect Critical Information Infrastructure and Industrial Control Systems, reduce blackout risks, and improve trusted procurement and testing to guard against backdoors in systems such as SCADA (as framed in the source).
Challenges / Way Forward
The source does not enumerate implementation challenges. Key requirements include capacity-building for CISO teams, compliance across distributed stakeholders, and consistent audit and patch management to meet strict timelines.
Exam Angle
GS3 (Security/Cyber): critical infrastructure protection, cyber incident reporting, OT/ICS security. Prelims: effective date (Apr 1, 2027), reporting deadlines (6 hours/24 hours), 50 MW threshold, data localisation requirement, BoM requirement.
Remember this
- CEA (Cyber Security in Power Sector) Regulations, 2026 effective from April 1, 2027.
- Framed under Electricity Act, 2003: Section 177 read with Section 73(c) (as stated).
- MeitY concurrence is mentioned in the source.
- Coverage includes transmission, distribution, load dispatch, power exchanges and OTC platforms.
- Generation/captive/ESS threshold: 50 MW and above.
- Incident reporting: CSIRT-Power and CERT-In within 6 hours; sabotage incidents within 24 hours.
- Vulnerability closure: critical/high within 1 month; medium/low within 3 months.
- Sensitive grid data must be stored exclusively within India (data localisation).
More from Monday, 17 August 2026
- India’s Lunar Future: NASA invites ISRO to participate in Artemis ‘Moon Base’ programme
- ‘Reform Utsav’: proposed citizen-driven governance reform campaign from October 2, 2026
- National Anubhav Awards 2026: preserving institutional memory via Anubhav Portal
- AI Agents: autonomy, tool-use capabilities and control risks
- VIHAAN: indigenous broadband networking chip achieves first-pass silicon success
- Dahi Handi Festival
- Mahadayi (Mandovi) River