Cybersecurity Policy Report, Power Sector Cyber Rules Issued in India, (Aug 18, 2026)

By Tony Foley

The Central Electricity Authority, India’s power sector regulator, recently announced the publication of cybersecurity regulations for the sector, which take effect in April 2027.

The new rules, Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026, will apply to power sector entities that own or manage operational technology infrastructure associated with the interconnected power system, as well as information technology infrastructure that is physically or logically connected to such technology. They establish the Computer Security Incident Response Team for the Power Sector (CSIRT-Power), which will be responsible for the coordination of the sector’s cyber incident reporting and response.

The rules outline CSIRT-Power’s roles and responsibilities, including collecting and analyzing information on incidents, coordinating with the Indian Computer Emergency Response Team (CERT-In), National Critical Information Infrastructure Protection Centre, and other agencies designated by the government in the area of cybersecurity, issuing alerts, advisories, and guidelines and developing cybersecurity policies, controls, and best practices, among others.

Covered entities will be required to fulfill a variety of requirements under the new rules, including appointing a primary and alternate chief information security officer meeting specified residency and experience requirements. The rules also establish a variety of cybersecurity measures and procedures for covered entities, among them the following:

1. Reporting incidents to CSIRT-Power and CERT-In within six hours (24 hours for incidents of cyber sabotage in critical systems);

2. Implementation of control measures and consistent monitoring of information technology and operational technology systems;

3. Storing sensitive information and sensitive data, including data on the cloud, in an encrypted, secured, and protected environment only within India; and

4. Maintaining a cyber risk assessment and mitigation plan for all assets detailed in the entity’s cyber asset register.

Covered entities also must devise and implement a cyber crisis management plan that includes detailed standard operating procedures to detect and identify all incidents, criteria to classify an incident as a crisis, and a list of all crisis scenarios.

News: InternationalLegislation DataSecurity