Central Electricity Authority (CEA) has issued these Regulations to ensure the cyber security of electrical plants and electrical lines. They apply to entities owning, operating, or managing OT infrastructure connected to the interconnected power system and associated IT infrastructure, including generating companies, transmission and distribution licensees, load dispatch centres, power exchanges, and certain vendors.

CSIRT-Power is designated as the nodal agency for cyber security incident reporting and coordination. Entities must appoint a Chief Information Security Officer (CISO) and establish an India-based, 24×7 Information Security Division. They must maintain a Cyber Security Policy, Cyber Crisis Management Plan, and Cyber Risk Assessment and Mitigation Plan.

OT systems must be isolated from the internet and IT systems (or protected through approved logical separation), with dedicated communication channels, perimeter security, encryption, and data residency within India. Annual cyber security audits, ISO/IEC 27001 (or equivalent) certification for critical systems, and vendor compliance with prescribed security requirements are mandatory.

Cyber security incidents must be reported to CSIRT-Power and CERT-In within 6 hours, while incidents involving cyber sabotage must be reported within 24 hours. The Regulations also prescribe annual self-audits and document retention and software update requirements under the Schedules.