CEA notifies India’s first comprehensive and legally binding cyber security regulatory framework for the power sector

In brief

The Central Electricity Authority (CEA) has notified¹ the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026 (Regulations), establishing India’s first comprehensive and legally binding cyber security regulatory framework for the power sector. These Regulations will come into force on 1 April 2027 replacing the CEA (Cyber Security in Power Sector) Guidelines, 2021 (Guidelines). The Regulations reflect the increasing recognition of cyber threats to critical infrastructure and aim to strengthen the resilience of India’s power system across generation, transmission, distribution, load dispatch, power exchanges and other covered power sector enterprises.