India's CEA Cybersecurity Regulations Set to Transform Power Sector Compliance

• •India's CEA regulations mandate cybersecurity compliance across the power sector.
• •Organizations must appoint a CISO and establish a dedicated Information Security Division.
• •The regulations emphasize operational resilience and supply chain security.

India's Central Electricity Authority (CEA) has introduced the Cyber Security in Power Sector Regulations, 2026, which will take effect on April 1, 2027. This framework mandates comprehensive cybersecurity practices across the power sector, affecting generation, transmission, distribution, and related entities. Key requirements include appointing a Chief Information Security Officer (CISO), establishing an Information Security Division, and creating a Cyber Crisis Management Plan. The regulations emphasize the importance of integrating cybersecurity into operational practices rather than viewing it as a mere compliance task. Vendors and service providers are also required to adhere to these regulations, ensuring supply chain security. The framework aims to enhance the resilience of India's critical energy infrastructure against growing cyber threats. As organizations prepare for compliance, they are encouraged to strengthen governance and improve asset visibility to address the evolving cyber threat landscape.