# CEA notifies new cybersecurity regulations for power sector

2026-08-16T14:27:11+00:00 | Governance | Indian Opinion Desk

Corroboration: 2 independent outlets

The Central Electricity Authority (CEA) has notified the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026, which will take effect from April 1, 2027, according to Medianama, or April 1, 2026, according to Times of India. The rules mandate power sector entities to store sensitive data, including cloud-hosted information and historical records, in an encrypted and secure environment within India. Entities must appoint a chief information security officer (CISO) who is an Indian citizen and resident, and an alternate CISO. Cybersecurity incidents must be reported to CSIRT-Power and CERT-In within six hours, while cyber sabotage involving critical systems must be reported within 24 hours. The regulations apply to entities that own or manage operational technology (OT) infrastructure linked to the interconnected power system, including generating companies with installations of 50 MW and above.

## Coverage

- timesofindia.indiatimes.com <https://timesofindia.indiatimes.com/india/cea-notifies-new-regulations-to-protect-power-sector-from-cyber-attack/articleshow/133275496.cms>
- medianama.com <https://www.medianama.com/2026/08/223-ministry-power-cybersecurity-rules/>

This story was synthesised by AI from the 2 sources linked above.
Updated: this story now draws on 2 sources. Last updated 2026-08-17T22:55:37+00:00.

Tags: CEA, CERT-In, CSIRT-Power, cyber security, power sector
Canonical: https://indianopinion.org/cea-notifies-new-cyber-security-rules-for-power-sector/
License: Summary and commentary (c) Indian Opinion, reusable with attribution. Facts belong to the linked sources.
Cite: https://indianopinion.org/cea-notifies-new-cyber-security-rules-for-power-sector/#story-in-brief

How this brief was made: an AI model read the reports linked above and wrote this summary and analysis, which were published automatically. Published briefs are sampled every hour by an automated quality check; the editor verifies its findings and approves corrections, and corrected briefs carry a dated correction line. Stance labels are editorial classifications of how each outlet framed this story, assigned by the same model, not ratings of the outlets. We do no original reporting. Methodology: https://indianopinion.org/ai-use-policy/