CEA notifies new cybersecurity regulations for power sector

The Central Electricity Authority (CEA) has notified the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026, which will take effect from April 1, 2027, according to Medianama, or April 1, 2026, according to Times of India. The rules mandate power sector entities to store sensitive data, including cloud-hosted information and historical records, in an encrypted and secure environment within India.

Entities must appoint a chief information security officer (CISO) who is an Indian citizen and resident, and an alternate CISO. Cybersecurity incidents must be reported to CSIRT-Power and CERT-In within six hours, while cyber sabotage involving critical systems must be reported within 24 hours. The regulations apply to entities that own or manage operational technology (OT) infrastructure linked to the interconnected power system, including generating companies with installations of 50 MW and above.