Nozomi Networks outlines IT and OT priorities for India’s 2027 power sector cybersecurity mandate

Nozomi Networks stated that India’s upcoming power sector cybersecurity regulations demand more than simple compliance from chief information security officers and operational technology managers. According to a report by Industrial Cyber, the company emphasized that policies alone will not satisfy the new legal framework taking effect in April 2027.

The Central Electricity Authority notified the Cyber Security in Power Sector Regulations in July, establishing the country’s first comprehensive, legally binding cybersecurity framework for the electricity sector. Nozomi Networks described these rules as one of the most extensive compliance frameworks ever applied to India’s power ecosystem, requiring embedded security disciplines at every stage of operation.

Regulatory Scope and Requirements

The regulations replace the previous CEA Guidelines from 2021 and apply to a wide range of entities, including generation, transmission, distribution, load dispatch, energy storage, and power exchanges. Specific obligations also extend to vendors and service providers supporting these sectors. The rules mandate visibility, monitoring, governance, asset management, risk assessment, incident response, and supply chain controls across both IT and OT environments.

Malcolm Bailie, senior manager for solutions delivery and projects in the Asia-Pacific region at Nozomi Networks, wrote in a company blog post that the framework transforms historically inconsistent cybersecurity practices into regulatory requirements. He noted that the new rules bring together various security practices that were previously implemented unevenly across the power sector.

Strategic Window for Security Leaders

Nozomi Networks advised that the next 18 months represent a strategic window for security professionals to strengthen governance and improve asset visibility. The company stated that organizations should modernize monitoring capabilities and establish operational resilience standards that will remain valuable after the compliance deadline passes. The regulations aim to strengthen the resilience of India’s power system by reflecting growing recognition of cyber threats to critical infrastructure.

Bailie added that the CEA Cyber Security Regulations mark a significant evolution in India’s approach to protecting critical energy infrastructure. Rather than focusing narrowly on compliance, the regulations encourage organizations to build long-term cyber resilience across both IT and OT environments, ensuring security is treated as an operational discipline.

What should you do?

Security leaders in the power sector should review the specific obligations for their entities, including vendor and service provider requirements. Organizations should assess their current visibility and monitoring capabilities across IT and OT environments to identify gaps. Teams should begin developing incident response and supply chain control procedures that align with the new regulatory expectations.

What to do and how to stay safe: Nozomi Networks

• Inventory all IT and OT assets to ensure complete visibility as required by the new regulations.
• Review current governance and risk assessment processes to align with the CEA Cyber Security Regulations.
• Evaluate vendor and service provider contracts to ensure they meet the extended supply chain control obligations.
• Plan for modernizing monitoring capabilities to support long-term operational resilience beyond the compliance deadline.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When do India’s new power sector cybersecurity regulations take effect?

The regulations take effect on April 1, 2027, replacing the CEA Guidelines from 2021.

Which entities are covered by the new CEA Cyber Security Regulations?

The regulations cover generation, transmission, distribution, load dispatch, energy storage, power exchanges, and their vendors and service providers.

What does Nozomi Networks recommend for security managers ahead of the deadline?

Nozomi Networks recommends using the next 18 months to strengthen governance, improve asset visibility, and build long-term cyber resilience.