India sets binding cybersecurity rules for the power sector from April 2027

What happened. India's Central Electricity Authority issued regulations for power sector cybersecurity, taking effect on 1 April next year. They require visibility, monitoring, governance, asset management, risk assessment, incident response and supply chain controls across IT and operational technology (OT). Nozomi Networks commented on them.

Who is affected. Generation, transmission, distribution, load dispatch, energy storage, power exchanges and other covered power sector entities in India. Vendors and service providers also have specific obligations.

What to do. Brief your team on the new regulations. Check whether your organisation or its vendors are covered before they take effect on 1 April next year.