MNRE tightens cybersecurity norms for wind turbine makers

The Ministry of New and Renewable Energy (MNRE) has directed all wind turbine manufacturers on the Approved List of Models and Manufacturers (ALMM) to submit compliance details on cybersecurity protocols by the end of August. The order requires that data centres, servers, and operational control facilities be located within India, and prohibits the transfer of real-time operational data outside the country.

Manufacturers must also set up research and development centres in India within one year from July 31, 2025, when the ALMM rules were updated. The directive follows a Niti Aayog report from March 2024 that flagged cybersecurity risks from Power Plant Controllers (PPCs) used to connect wind farms to the grid, especially those from foreign original equipment manufacturers (OEMs) in neighbouring countries.

Niti Aayog has recommended that the Grid Controller of India obtain all relevant certificates and intellectual property rights from foreign OEMs for certification by the Central Electricity Authority, the Ministry of Electronics and Information Technology, and the Standardization Testing and Quality Certification directorate. It also suggested deploying next-generation firewalls and AI-based threat detection to secure the power infrastructure.