A Rule With a Real Threat Behind It
On July 31, 2026, the Central Electricity Authority (CEA) published the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026 in the Gazette of India, under Section 177 read with Section 73(c) of the Electricity Act, 2003 [cea.nic.in]. The rules take effect April 1, 2027 — an eight-month runway — and designate CSIRT-Power, the sector-specific incident response team the Ministry of Power set up in April 2023 as an extension of CERT-In, as the statutory nodal agency for the sector (GKToday).
The substance is sweeping. Covered entities — generating companies, captive plants and energy storage systems of 50 MW and above, plus all transmission utilities, distribution licensees, load dispatch centres, power exchanges and OTC trading platforms regardless of size — must appoint a senior Chief Information Security Officer and an alternate for a minimum three-year tenure, backed by a 24/7 in-India security division; obtain ISO/IEC 27001 certification or an equivalent; physically segregate operational technology (OT) and critical information infrastructure from the internet and general IT networks; run pre-commissioning vulnerability assessments plus annual audits; and report cyber incidents to both CSIRT-Power and CERT-In within six hours, with cyber-sabotage of critical systems escalated within 24 hours (Renewable Watch) (MediaNama).
Steelmanning the Rule: This Grid Has Actually Been Attacked
Unlike much of the world's critical-infrastructure cybersecurity regulation, which is precautionary, India's power sector has a documented adversary. Between roughly May 2020 and early 2021, researchers at Recorded Future identified a Chinese state-linked group they named RedEcho deploying the ShadowPad backdoor against at least ten Indian power-sector organizations, including four of the country's five Regional Load Despatch Centres, alongside transmission substations and a thermal plant — activity that tracked the Ladakh border standoff and that analysts read as pre-positioning or signaling rather than routine espionage (The Record). A follow-up 2022 Recorded Future report found continued targeting of grid infrastructure near Ladakh specifically.
Given that history, mandatory OT/IT segregation, a named accountable security officer, and a fast, standardized incident-reporting channel to a coordinating agency are not bureaucratic theater — they are the baseline a sector under active nation-state probing should have had years ago. CSIRT-Power itself is nearly three years old; this regulation mostly gives its existing coordinating role legal teeth, including the power to compel network architecture, asset and forensic data from entities during an incident. That is a defensible, narrowly scoped power for a body handling grid-security emergencies.
Where the Rule Overreaches: One-Size-Fits-All Localization and Thresholds
The problem is not the incident-response architecture — it is two design choices that don't track risk.
First, the data-localization clause requires that sensitive operational and historical grid data be encrypted and stored exclusively within India, including data held on third-party cloud platforms, with no carve-out for cloud vendors with strong contractual and technical safeguards operating from abroad. Data localization is a blunt instrument for a threat that is about access controls and segmentation, not physical server geography — a breached India-hosted database is exactly as exposed as a breached foreign-hosted one if the OT/IT segregation and encryption requirements elsewhere in the rule are doing their job properly. If those controls work, geography is redundant; if they don't, geography doesn't save you. Layering a hard localization mandate on top of segregation and encryption requirements adds compliance cost — data-residency architecture, potential re-platforming of existing cloud-based grid analytics tools — without a clear, additive security benefit over the technical controls the same regulation already imposes.
Second, the 50 MW threshold treats a small captive solar-plus-storage project the same as a multi-gigawatt thermal station: both need the same CISO, the same ISO 27001 certification, the same 24/7 in-India security division. That is a meaningfully different compliance bill relative to revenue for a mid-sized renewable IPP than for NTPC or Power Grid Corporation, which already run dedicated security operations. Comparable regimes elsewhere calibrate for this: the US NERC CIP standards for the bulk power system tier obligations by an asset's impact rating, not a flat capacity cutoff, and the EU's NIS2 directive similarly distinguishes "essential" from "important" entities with different obligation weights. A flat MW line is administratively simple but not risk-proportionate — it is exactly the kind of rule that raises entry costs for smaller renewable and storage developers India is simultaneously trying to attract at scale under its clean-energy buildout.
The Bottom Line
CSIRT-Power's statutory upgrade, mandatory OT segregation and six-hour reporting are proportionate responses to a documented state-sponsored threat and deserve support, not the reflexive skepticism regulation often gets in this publication's pages. But the CEA should revisit the localization mandate's cost-benefit case and consider tiering the ISO 27001/CISO obligations by capacity or grid-criticality rather than a flat 50 MW line — before the April 2027 deadline turns a threat-justified rule into an unnecessary tax on smaller clean-energy entrants.