Nozomi outlines IT and OT security priorities ahead of India's April 2027 CEA power sector ...

Following the July move by India’s Central Electricity Authority (CEA) that notified the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026, creating the country’s first comprehensive, legally binding cybersecurity framework for the power sector, Nozomi Networks identified that the framework is far more than a compliance exercise for chief information security officers (CISOs), IT security managers, and operational technology (OT) managers, and that policies alone will not deliver compliance. The company described it as one of the most comprehensive cybersecurity compliance frameworks ever applied to the country’s electricity ecosystem.

With regulations taking effect on Apr. 1 year, replacing the CEA Guidelines, 2021, the power regulations apply to generation, transmission, distribution, load dispatch, energy storage, power exchanges, and other covered power sector entities. Specific obligations also extend to vendors and service providers. The Regulations require visibility, monitoring, governance, asset management, risk assessment, incident response, and supply chain controls across both IT and OT environments. They set a formal expectation that cybersecurity be embedded as an operational discipline at every stage of power generation, transmission, and distribution.

These regulations reflect growing recognition of cyber threats to critical infrastructure and aim to strengthen the resilience of India’s power system.

“The new framework brings together many cybersecurity practices that have historically been implemented inconsistently across the power sector and transforms them into regulatory requirements,” Malcolm Bailie, senior manager, solutions delivery and projects for APAC at Nozomi Networks, wrote in a company blog post.

The CEA Cyber Security Regulations represent a significant evolution in India’s approach to protecting critical energy infrastructure. Rather than focusing narrowly on compliance, the regulations encourage organisations to build long-term cyber resilience across both IT and OT environments.

“For CISOs, IT security managers and OT managers, the 18 months should be viewed as a strategic window to strengthen governance, improve asset visibility, modernise monitoring capabilities and establish operational resilience standards that will remain valuable long after the compliance deadline has passed,” the post added. “Organisations that begin now will be better positioned not only for regulatory compliance but also for the evolving cyber threat landscape facing the power sector.”

Among the key mandates, covered entities must appoint a CISO and an alternate CISO. They must also establish a dedicated Information Security Division operating within India, and develop a Cyber Security Policy that is reviewed annually. A Cyber Crisis Management Plan must be created, and annual cybersecurity audits must cover critical systems.

Entities are also required to maintain comprehensive cyber asset registers and carry out risk assessments, as well as continuously monitor their IT and OT environments. Structured incident response and reporting processes must be in place. The Regulations also set security requirements for vendors and supply chains, and require entities to procure equipment and services from approved or trusted sources.

Bailie added that “Perhaps most importantly, the regulations explicitly recognise the unique role of OT systems in power operations and introduce dedicated requirements for securing industrial control systems, communications infrastructure and operational networks.”

While traditional cybersecurity programmes have focused primarily on enterprise IT systems, hackers increasingly target control networks, substations, generation facilities and industrial communication systems because of their direct impact on operations.

“The CEA regulations directly address this reality,” Bailie assessed. “Entities operating OT environments must physically isolate OT systems from the internet and, wherever possible, from corporate IT systems. Where business requirements make connectivity unavoidable, organisations must implement hardened logical separation, risk assessments, approval processes and continuous monitoring.”

The regulations further require dedicated communication channels for operational data, monitoring of OT-specific protocols and traffic, segmentation of OT environments into different trust levels, protection of communications between operational entities, strong controls around remote operation and remote access, and security assessments before commissioning critical systems. For OT managers, this represents a clear shift toward defence-in-depth architectures that provide visibility across operational networks while preserving system availability and safety.

“A recurring theme throughout the regulations is visibility. Entities are required to maintain detailed cyber asset registers, classify critical systems, document network architectures, identify communication protocols and continuously assess cyber risks associated with those assets,” Bailie observed. “Organisations must also maintain risk assessment and mitigation plans and periodically update them. This requirement creates a significant challenge for power operators that have accumulated industrial assets over many years, often across multiple sites and business units.

He added that many organisations still lack a complete inventory of OT assets, firmware versions, communication pathways and externally connected devices. “Without this information, compliance becomes difficult and cyber risk remains poorly understood. A mature OT visibility programme can help operators establish and maintain the level of asset intelligence required by the regulations while simultaneously supporting vulnerability management , network segmentation and incident response .”

Tracking that the CEA cyber regulations place substantial responsibilities on vendors, Bailie said that suppliers must provide software updates, security patches, recovery procedures, bills of materials, lifecycle information, vulnerability disclosure processes and evidence that products are securely configured prior to deployment. Power sector entities must incorporate cybersecurity requirements into service agreements and perform appropriate risk assessments for vendors that have access to critical systems.

“This reflects a growing global recognition that supply chain compromise remains one of the most significant threats facing critical infrastructure,” he added. “For procurement and security teams, cybersecurity can no longer be treated as a post-purchase consideration. Vendor risk management must become an integral component of operational resilience.”

Power sector organisations should view the period before implementing their cybersecurity program and platform as an opportunity to build sustainable capabilities rather than rushing toward a compliance deadline. However, as of this writing, only six months remain to do so. Below is a roadmap of suggested activities, separated into five phases.

The roadmap begins with an assessment phase, in which organizations review regulatory applicability, identify their critical systems, and inventory IT and OT assets. They then conduct gap assessments against regulatory requirements.

In the second phase, which focuses on establishing governance, organizations appoint the required security leadership and develop or update their cybersecurity policies. They also establish reporting and oversight processes and define risk ownership across IT and OT teams. The third phase centers on increasing visibility. Organizations deploy asset discovery and monitoring capabilities, document communication pathways, and validate network segmentation. They also build comprehensive asset registers.

The fourth phase is aimed at strengthening operations. Organizations develop cyber crisis management plans, improve their incident response processes, and conduct tabletop exercises and simulations. They also implement continuous monitoring. The final phase is validating compliance. Organizations conduct vulnerability assessments and audits, review vendor compliance, and validate remote access controls. They also prepare audit evidence and documentation repositories.

Before April 2027, power sector operators should ensure they can answer ‘yes’ to a series of questions their cybersecurity readiness. They should be able to confirm that they have a designated CISO and a supporting security function, and that they have identified and classified all critical systems. They should also be able to confirm that their OT environment is appropriately segregated from IT and internet-connected networks.

Operators should likewise be able to say that they maintain a comprehensive cyber asset register and can continuously monitor their IT and OT environments. They should have documented cyber crisis management and incident response plans in place. Finally, operators should be able to confirm that vendor cybersecurity requirements are formally managed and that they can demonstrate compliance through documented audits, assessments, and evidence.