Protect operational data across sites, contractors, and control-room adjacencies

The Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026 were published in the Gazette of India on 31 July 2026 and, by Regulation 1(2), come into force with effect from 1 April 2027, with certain regulations to be notified separately. They apply to entities that own, operate, or manage operational technology infrastructure associated with the interconnected power system and the information technology infrastructure connected to it, with a 50 MW threshold for generating companies, captive plants, and energy storage. Among the required measures, Regulation 5(33) sets a data retention policy for documents and records including cyber security test certificates, Factory and Site Acceptance Test results, and audit reports, and a proviso to Regulation 5(11) allows a detailed procedure restricting physical and logical access to those documents and records.

The CEA (Cyber Security in Power Sector) Guidelines, 2021 apply to Responsible Entities including transmission utilities and licensees, load despatch centres, generation and distribution utilities, trading exchanges, and regulatory commissions, as well as system integrators, equipment manufacturers, suppliers, and service providers. Article 11(c) makes the Chief Information Security Officer the custodian of all cyber security related documents, and Article 12 requires a detailed sabotage report to the sectoral CERT and CERT-In within 24 hours, with a report to NCIIPC within 24 hours where the sabotage is classified as an incident on a Protected System.

Where a computer resource is declared a protected system by notification under Section 70 of the Information Technology Act, 2000, the Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018 apply. They require the Chief Information Security Officer to share information security audit reports, post-audit compliance reports, and IT security service level agreements with NCIIPC, and to establish a process for sharing logs of the protected system. Applicability depends on the specific notification.

The Petroleum and Natural Gas Regulatory Board (Codes of Practices for Emergency Response and Disaster Management Plan (ERDMP)) Regulations, 2010, as amended with effect from 17 September 2020, list cyber attack among the man-made emergencies an entity's ERDMP has to address. The regulations require the ERDMP to exist as a document, and provide that periodical review of the ERDMP document is approved by the authority that approved it, namely the entity's Board of Directors.

The Ministry of Petroleum and Natural Gas describes the National Data Repository as set up by the Directorate General of Hydrocarbons on its behalf, on the basis that exploration and production data is a national asset, to validate, store, maintain, and reproduce reliable E&P data and to facilitate data reporting, exchange, and trading among existing players. The repository requires a confidentiality agreement to be completed and signed before data purchase, which places the practical weight on what a recipient can do with the data afterwards.

The CERT-In Directions of 28 April 2022 require service providers, intermediaries, data centres, body corporate, and Government organisations to report the cyber incidents listed in Annexure I within six hours of noticing them or being brought to notice about them. Annexure I expressly includes attacks on critical infrastructure, SCADA and operational technology systems and wireless networks, alongside data breach and data leak.

Section 8(5) of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to protect personal data in its possession or under its control, including processing carried out on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach. The Schedule provides a penalty that may extend to two hundred and fifty crore rupees for breach of that obligation, as determined by the Board. For an energy business this reaches consumer, employee, and contractor records rather than the drawing itself.

The SEBI (Listing Obligations and Disclosure Requirements) (Second Amendment) Regulations, 2023 inserted Regulation 27(2)(ba), under which details of cyber security incidents or breaches or loss of data or documents are to be disclosed along with the quarterly corporate governance report, as may be specified. Listed energy companies have separately made material-event intimations under Regulation 30 about such incidents.

Many of India's largest generation, transmission, refining, and exploration businesses are Central Public Sector Enterprises. The Department of Public Enterprises Guidelines on Corporate Governance for CPSEs, continued on a mandatory basis, require board members and senior management to respect the confidentiality of information relating to the affairs of the company and to maintain the confidentiality of unpublished information about its business and affairs, and require the board to integrate risk management into normal business practice. These are governance duties rather than technical security standards.

Article 1(b) of the CEA Guidelines, 2021 states that the Responsible Entity shall be ISO/IEC 27001 certified, including sector specific controls as per ISO/IEC 27019. ISO describes ISO/IEC 27019:2024, the second edition, as providing information security controls for the energy utility industry based on ISO/IEC 27002:2022, for controlling and monitoring the production or generation, transmission, storage, and distribution of electric power, gas, oil, and heat. The 2017 first edition is marked withdrawn on the ISO catalogue.

The IEC 62443 series addresses security for industrial automation and control systems. IEC/TS 62443-1-1 defines the terminology, concepts, and models for IACS security and establishes the basis for the remaining standards in the series. Article 9(e) of the CEA Guidelines, 2021 asks that supplied equipment carry a certificate obtained by the OEM from a body accredited to assess conformance to IEC 62443-4 during design and manufacture.

The North American Electric Reliability Corporation publishes the Critical Infrastructure Protection standards and lists which versions are subject to enforcement. The series includes CIP-011, Cyber Security, Information Protection, alongside standards on electronic security perimeters, incident reporting and response planning, and recovery plans for BES Cyber Systems. An Indian operator encounters these through a North American affiliate, asset, or customer requirement rather than directly, and the applicable versions should be read against the entity's own registration.

The Transportation Security Administration announced a second Security Directive on 20 July 2021 requiring owners and operators of TSA-designated critical pipelines to implement specific mitigation measures against ransomware and other known threats to information technology and operational technology systems, to develop and implement a cybersecurity contingency and recovery plan, and to conduct a cybersecurity architecture design review. The initial May 2021 directive required incident reporting to CISA and a Cybersecurity Coordinator available at all times. These directives reach designated United States pipelines rather than Indian assets.

Directive (EU) 2022/2555 sets measures for a high common level of cybersecurity across the Union and treats the energy sector, including electricity, oil, gas, district heating, and hydrogen, as a sector of high criticality. It applies through national transposition to entities established or providing services in the Union, so it reaches an Indian group through its European subsidiaries or operations rather than directly.