Resources Categories
INDUSTRY FACT FILE · POWER & ELECTRICITY
Industry Overview: Power and Electricity in India
Who generates, transmits, operates and distributes power, the new CEA cyber regulations, who buys cybersecurity and why each needs a distinct approach.
|
In this document 1. Why power sector cybersecurity matters now 2. The ecosystem at a glance 3. Categories of power sector organisations 4. The regulatory framework at a glance 5. Government, public-sector and private participants 6. Who buys cybersecurity inside a utility 7. Why each organisation type needs a different approach 8. How Codec Networks works with power utilities |
|
Sector scope Sector: power and electricity — generators, transmission utilities, DISCOMs, grid operators and electricity traders. Primary service proposition: IT/OT security, ICS/SCADA assessment, SOC, remote access reviews, resilience and sector compliance. Renewable and storage operators and oil and gas companies are covered in separate fact files. |
1. Why power sector cybersecurity matters now
India operates one of the world's largest synchronous power grids. Generators, transmission utilities, load dispatch centres and DISCOMs run SCADA, energy management, substation automation and plant control systems that must work around the clock—and they are interconnected, so one utility's incident can affect others.
|
31 Jul 2026 CEA Cyber Security Regulations notified |
1 Apr 2027 Regulations come into force |
6 hours To report incidents to CSIRT-Power and CERT-In (as reported) |
50 MW Threshold for generators and storage (as reported) |
Power grids are a known target. Cyberattacks caused power outages in Ukraine in 2015 and 2016, and in 2021 and 2022 threat intelligence firms reported state-linked intrusion activity targeting Indian load dispatch centres. Ransomware against utilities' IT systems and insecure vendor remote access add everyday risk.
The Central Electricity Authority notified the CEA (Cyber Security in Power Sector) Regulations, 2026 on 31 July 2026, coming into force on 1 April 2027. As reported, they require a senior CISO, a 24-hour Information Security Division, a cyber security policy and crisis management plan, annual audits of critical systems and incident reporting to CSIRT-Power and CERT-In within six hours.
|
Key takeaway For a utility, cybersecurity is grid reliability. Protecting operational technology—and proving it under the new CEA regulations—is now a core obligation. |
2. The ecosystem at a glance
Figure 1: India's power and electricity ecosystem.
3. Categories of power sector organisations
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Generators |
Thermal, hydro, nuclear and gas generating stations |
Central and state PSUs, private producers |
Electricity Act 2003; CEA Regulations 2026 (50 MW and above, as reported) |
|
Transmission utilities |
Inter-state and intra-state transmission networks |
Central and state transmission companies, private licensees |
Electricity Act; CEA Regulations 2026 |
|
Grid operators |
National, regional and state load dispatch centres |
Grid Controller of India and state LDCs |
Grid codes; CEA Regulations 2026 |
|
Distribution companies (DISCOMs) |
Distribution networks, metering, billing and consumer services |
State DISCOMs and private distribution licensees |
Electricity Act; state regulations; CEA Regulations 2026 |
|
Electricity traders and exchanges |
Trading licensees and power exchanges |
Private traders and exchanges |
CERC regulations; CERT-In |
|
Captive and industrial plants |
Self-generation for industry |
Industrial companies |
CEA Regulations 2026 where thresholds apply (as reported) |
|
OEMs and system integrators |
SCADA, DCS, protection and metering vendors |
Global and Indian vendors |
Vendor accountability under CEA Regulations; contracts |
4. The regulatory framework at a glance
|
Instrument |
Key requirements (as reported) |
|
CEA (Cyber Security in Power Sector) Regulations, 2026 |
Notified 31 July 2026; in force from 1 April 2027; cover OT linked to the interconnected grid and connected IT systems Generating companies, captive plants and storage operators of 50 MW and above are covered |
|
Governance under the regulations |
Senior-management CISO and alternate with a minimum three-year tenure; 24-hour Information Security Division Cyber security policy and Cyber Crisis Management Plan tested by at least one mock drill a year |
|
Assurance and technical controls |
Annual audit of critical systems; separation of OT networks from the internet; vendor accountability |
|
Incident reporting |
Incidents reported to CSIRT-Power and CERT-In within six hours; CERT-In Directions (2022) also require 180-day logs |
|
CEA Cyber Security Guidelines, 2021 |
Earlier guidelines for the sector, now complemented by binding regulations |
|
NCIIPC and DPDP |
Protection of systems notified as critical information infrastructure; consumer personal data safeguards with most DPDP obligations from May 2027 |
|
Verify the gazette text CEA Regulation details are summarised from public reporting. Confirm requirements, thresholds and timelines against the official gazette notification. |
5. Government, public-sector and private participants
- The Ministry of Power sets policy; the Central Electricity Authority (CEA) issues technical regulations, including the 2026 cyber security regulations.
- CSIRT-Power coordinates sector incident response alongside CERT-In and NCIIPC.
- CERC and state commissions regulate tariffs, markets and licensees.
- Central and state PSUs dominate generation, transmission and distribution, alongside private producers and licensees.
- OEMs and integrators supply and often support control systems remotely.
6. Who buys cybersecurity inside a utility
|
Stakeholder |
What they care about |
What they buy |
|
Board and CMD |
Grid reliability, compliance, reputation |
Board advisory, crisis exercises |
|
CISO (under the CEA Regulations) |
Compliance, incidents, OT risk |
Gap assessments, audits, SOC |
|
Director (Operations) / plant heads |
Uptime and safety |
OT assessments, segmentation |
|
SCADA / LDC heads |
Grid visibility and control |
SCADA/EMS assessments, monitoring |
|
DISCOM commercial heads |
Billing, metering and revenue |
Smart metering and billing security |
|
IT heads |
Corporate IT and ransomware |
VAPT, EDR, backups |
|
Procurement and contracts |
OEM and vendor obligations |
Vendor and equipment assessments |
7. Why each organisation type needs a different approach
|
Organisation type |
Highest-consequence risk |
Starting point for assurance |
|
Generator |
DCS compromise and IT-to-OT spread |
Plant IT/OT segmentation, DCS assessment |
|
Transmission utility |
Substation and relay manipulation |
Substation automation and remote access reviews |
|
Grid operator (LDC) |
Nation-state espionage in SCADA/EMS |
Separation, OT monitoring, threat hunting |
|
DISCOM |
Ransomware on billing and smart meter head-ends |
Head-end testing, SOC, segmentation |
|
Trader or exchange |
Platform DDoS and fraud |
Application testing, DDoS resilience |
|
Captive plant |
Flat networks and vendor access |
Segmentation and remote access review |
8. How Codec Networks works with power utilities
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For power utilities we deliver CEA Regulations gap assessments and audits, IT/OT security and ICS/SCADA assessments using OT-safe methods, remote access reviews, 24x7 IT/OT SOC and resilience and crisis exercises.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. CEA (Cyber Security in Power Sector) Regulations, 2026 details are summarised from public reporting; confirm obligations against the official gazette notification and CEA, CERT-In and NCIIPC instruments.