Full Report
Following the July move by India’s Central Electricity Authority (CEA) that notified the Central Electricity Authority (Cyber Security... The post Nozomi outlines IT and OT security priorities ahead of India’s April 2027 CEA power sector cybersecurity deadline appeared first on Industrial Cyber.
Analysis Summary
# Regulation/Compliance: India CEA Cyber Security in Power Sector Regulations, 2026
## Overview
The Central Electricity Authority (CEA) notified the Cyber Security in Power Sector Regulations, 2026 in July 2026. They are described as India's first comprehensive, legally binding cybersecurity framework for the power sector. They replace the CEA Guidelines, 2021, and cover both IT and OT environments across the power value chain. The regulations also extend specific obligations to vendors and service providers.
## Key Details
- **Issuing Authority:** Central Electricity Authority (CEA), India
- **Effective Date:** April 1, 2027
- **Jurisdiction:** Indian power sector. Covered entities include generation, transmission, distribution, load dispatch, energy storage, power exchanges, and other covered power sector entities. Vendors and service providers have specific obligations.
- **Status:** Final (notified July 2026). Not yet in effect; compliance is required from April 1, 2027.
## Requirements
### Mandatory Requirements
1. **Governance:** Appoint a Chief Information Security Officer (CISO) and an alternate CISO.
2. **Organizational structure:** Establish a dedicated Information Security Division operating within India.
3. **Policy:** Develop a Cyber Security Policy and review it annually.
4. **Crisis management:** Create a Cyber Crisis Management Plan.
5. **Audits:** Conduct annual cybersecurity audits that cover critical systems.
6. **Asset management:** Maintain comprehensive cyber asset registers covering IT and OT.
7. **Risk assessment:** Carry out cybersecurity risk assessments.
8. **Monitoring:** Continuously monitor IT and OT environments, supporting the regulations' visibility and monitoring requirements.
9. **Incident response and reporting:** Maintain structured incident response and reporting processes.
10. **Supply chain and vendors:** Apply security requirements to vendors and supply chains. Procure equipment and services from approved or trusted sources.
11. **OT security:** Meet the dedicated OT requirements introduced by the regulations. The article's text on these was truncated, so the specific controls need to be confirmed against the regulation text.
### Recommended Practices
1. Treat the 18-month window before the deadline as a strategic period to build long-term resilience, not just a compliance exercise (per Nozomi's guidance).
2. Modernize monitoring capabilities and improve asset visibility across OT, not only document it.
3. Convert historically inconsistent practices into standardized, repeatable operational processes.
4. Embed cybersecurity into operations across generation, transmission, and distribution.
## Affected Organizations
- **Industries:** Power sector entities, including generation, transmission, distribution, load dispatch, energy storage, and power exchanges. Vendors and service providers are also covered.
- **Organization Size:** Not specified in the article.
- **Geographic Scope:** India. The Information Security Division must operate within India.
## Compliance Timeline
- **July 2026:** CEA notifies the Cyber Security in Power Sector Regulations, 2026.
- **October 19, 2026:** Nozomi publishes guidance on priorities ahead of the deadline.
- **April 1, 2027:** Regulations take effect and replace the CEA Guidelines, 2021. Full compliance is expected from this date.
- **Recurring:** Annual policy review and annual cybersecurity audits.
## Implementation Guidance
### Assessment Phase
- Map all entities and systems against the covered categories (generation, transmission, distribution, load dispatch, storage, exchanges).
- Build or update a complete IT and OT asset inventory. This is a mandatory cyber asset register.
- Review existing policies, incident response plans, and vendor contracts against the mandated elements.
- Identify gaps in OT visibility, monitoring coverage, and vendor security obligations.
### Implementation Phase
- Appoint a CISO and alternate CISO, and establish the Information Security Division in India.
- Draft the Cyber Security Policy, with a process for annual review.
- Develop the Cyber Crisis Management Plan and integrate it with incident response and reporting procedures.
- Deploy continuous monitoring across IT and OT, and conduct risk assessments.
- Update vendor and procurement processes to require approved or trusted sources and contractual security obligations.
- Plan the first annual audit so it covers critical systems.
### Validation Phase
- Conduct internal assessments against each mandatory requirement before the deadline.
- Schedule and complete annual cybersecurity audits covering critical systems.
- Test the incident response and crisis management plans through exercises.
- Verify that asset registers, policies, and vendor requirements are current and reviewed annually.
## Technical Requirements
The article identifies these areas, with specifics to be confirmed in the regulation text:
- Visibility across IT and OT assets
- Continuous monitoring of IT and OT environments
- Asset management and cyber asset registers
- Risk assessment
- Incident response and reporting
- Supply chain controls and approved or trusted sourcing for equipment and services
- Dedicated OT security requirements (details not included in the available article text)
## Penalties & Enforcement
The article does not specify fines, penalties, or enforcement mechanisms. Review the full regulation text on the CEA website for these details.
## Related Standards
The article does not reference specific standards such as NIST or ISO. Organizations may find it useful to map their programs to recognized frameworks (for example, IEC 62443 for industrial automation security, or NIST CSF) to support the regulations' requirements. This mapping is a practical suggestion, not a regulatory requirement stated in the article.
## Resources
- **Official Documentation:** hxxps://cea[.]nic[.]in/notification/cyber-security-regulations/?lang=en
- **Guidance Documents:** Nozomi Networks blog, "India's new CEA cybersecurity regulations: What power sector leaders need to know before April 2027." hxxps://www[.]nozominetworks[.]com/blog/indias-new-cea-cybersecurity-regulations-what-power-sector-leaders-need-to-know-before-april-2027
- **Tools:** Not specified in the article.
## Practical Recommendations
- Obtain and review the full text of the CEA regulations, particularly the OT-specific requirements and penalty provisions that the article did not cover.
- Appoint or confirm the CISO and alternate CISO now, and plan the Information Security Division's in-country setup.
- Build a complete IT and OT cyber asset register as the foundation for risk assessment and monitoring.
- Prioritize OT visibility and continuous monitoring, since these are core to the framework.
- Review vendor and service provider contracts to add security obligations and confirm approved-source procurement.
- Draft the Cyber Security Policy and Cyber Crisis Management Plan, and schedule annual reviews and audits.
- Run tabletop exercises before April 1, 2027 to test incident response and reporting workflows.