INDUSTRY FACT FILE · POWER & ELECTRICITY

Cybersecurity FAQs for Power Utilities

Forty frequently asked questions and answers in five categories, written for Boards, CISOs, operations, SCADA, DISCOM and procurement teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: CEA Regulations and compliance 3.  Category 3: OT, SCADA and substations 4.  Category 4: SOC, incidents and resilience 5.  Category 5: Vendors, metering, privacy and markets

Audience: Boards, CMDs and CISOs

Q1. Why is the power sector a cyber target?

The grid is critical infrastructure; disruption has economic, safety and national-security impact.

Q2. What are the biggest risks?

Nation-state OT intrusion, ransomware spreading to OT, vendor remote access, substation and SCADA compromise, smart meter attacks and weak OT monitoring.

Q3. Which incidents illustrate the risk?

Cyberattacks caused outages in Ukraine in 2015 and 2016, and state-linked activity against Indian load dispatch centres was reported in 2021 and 2022.

Q4. Who must lead cybersecurity?

Under the CEA Regulations, as reported, a senior-management CISO with an alternate and a minimum three-year tenure.

Q5. What should the Board review?

CEA compliance status, audit findings, OT risks, incidents, drills, vendor risks and SOC performance.

Q6. What is an Information Security Division?

A 24-hour team of trained professionals required under the CEA Regulations, as reported.

Q7. How should we prioritise investment?

Close CEA gaps, separate IT from OT, control vendor access, then build OT monitoring and hunting.

Q8. How can Codec Networks help?

Codec Networks provides CEA gap assessments and audits, IT/OT and SCADA assessments, remote access reviews, IT/OT SOC and crisis exercises.

Audience: Compliance, CISO offices and regulatory teams

Q9. When were the CEA Regulations notified?

The CEA (Cyber Security in Power Sector) Regulations, 2026 were published in the Gazette on 31 July 2026.

Q10. When do they come into force?

On 1 April 2027, with some provisions reportedly on separately notified dates.

Q11. Who is covered?

As reported, entities managing OT linked to the interconnected power system and connected IT; generators, captive plants and storage operators of 50 MW and above.

Q12. What about smaller entities?

As reported, smaller entities are encouraged to implement basic CERT-In-recommended controls for MSMEs.

Q13. What governance is required?

A senior CISO and alternate, a 24-hour Information Security Division, a cyber security policy and a Cyber Crisis Management Plan (as reported).

Q14. How often must audits happen?

As reported, critical systems must be audited annually.

Q15. How quickly must incidents be reported?

As reported, to CSIRT-Power and CERT-In within six hours; CERT-In Directions also apply.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs gap assessments and IT/OT audits.

Audience: Operations, SCADA and substation teams

Q17. How should IT and OT be separated?

Use a DMZ, remove dual-homed systems and control every data flow; the regulations require OT separation from the internet (as reported).

Q18. How do we assess OT safely?

Use passive discovery, offline reviews and carefully planned testing coordinated with operations.

Q19. How should vendor remote access work?

Brokered, time-bound sessions with named accounts, MFA and recording, approved per request.

Q20. How do we protect protection relays?

Restrict configuration access, monitor settings for change and control engineering laptops.

Q21. What about legacy control systems?

Segment, restrict access, monitor and plan upgrades with OEMs.

Q22. How should removable media be controlled?

Use scanning kiosks, restrict USB use and track media entering plants.

Q23. Which standards help?

IEC 62443 for industrial security and IEC 62351 for power system communications security.

Q24. How do we secure renewable integration?

Assess connections, vendor access and inverter-based resource controls before connecting new assets.

Audience: SOC, incident response and operations teams

Q25. Do utilities need an OT SOC?

Yes. Monitoring IT and OT 24x7 supports the 24-hour ISD expectation and six-hour reporting.

Q26. What should the SOC monitor?

IT and OT networks, industrial protocols, remote access sessions, configuration changes and threat intelligence.

Q27. What is a Cyber Crisis Management Plan?

A plan for responding to and recovering from cyber crises, required with at least one annual mock drill (as reported).

Q28. What should incident playbooks include?

Operational safety, containment, coordination with load dispatch centres, CSIRT-Power and CERT-In reporting and restoration.

Q29. How long must logs be retained?

CERT-In requires ICT logs for a rolling 180 days within India; follow any longer CEA requirements.

Q30. How should OT backups be handled?

Keep offline, tested backups of configurations, logic and historians.

Q31. Should we hunt for threats?

Yes. State-linked actors aim for stealth; hunting finds what alerts miss.

Q32. When should forensics be engaged?

As soon as OT compromise is suspected, with OT-aware investigators.

Audience: Procurement, DISCOM, privacy and market teams

Q33. How should OEMs be assessed?

Review product security, update practices, remote support methods and incident commitments.

Q34. What do the regulations say about vendors?

As reported, they include vendor accountability requirements; build them into contracts.

Q35. How should smart meter head-ends be secured?

Strong admin controls, approval and rate limits for bulk commands, testing and monitoring.

Q36. How does DPDP affect DISCOMs?

Consumer personal data, including metering data, requires safeguards; most DPDP obligations take effect in May 2027.

Q37. How should billing systems be protected?

Test applications, protect privileged access, back up immutably and monitor for fraud.

Q38. What about trading platforms?

Test applications, protect against DDoS and secure settlement integrations.

Q39. What about equipment supply chains?

Assess suppliers and follow Ministry of Power guidance on testing imported power-system equipment.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your assets, control systems and the April 2027 timeline; Codec Networks will propose a gap assessment plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. CEA Regulation details are as reported; confirm against the official gazette notification.