India Notifies New Cybersecurity Rules for Power Sector

India's Ministry of Power notified new cybersecurity regulations for the country's power sector on July 31, 2026. These rules, known as the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026, are set to come into full effect on April 1, 2027.

The regulations establish a Computer Security Incident Response Team for the Power Sector (CSIRT-Power) under the Ministry of Power. This body will coordinate the reporting and response to cybersecurity incidents across the sector. CSIRT-Power is empowered to request network architecture details, asset information, and logs, with its directives being legally binding for all entities and vendors.

A key requirement is the mandatory appointment of a Chief Information Security Officer (CISO) and an alternate CISO by all power sector entities owning or managing operational technology (OT) or connected information technology (IT) systems. These positions must be filled promptly. The CISO must be an Indian citizen and resident, hold an engineering degree, possess at least 15 years of relevant experience, and report directly to the head of the organization.

Further obligations include continuous monitoring of IT and OT systems, encryption and storage of sensitive data and backups exclusively within India, and isolation of Critical Information Infrastructure (CII) networks from the internet. Entities must report cybersecurity incidents within six hours, or 24 hours for critical sabotage, and adhere to guidelines on supply chain security and procurement of trusted IT equipment.