The Central Electricity Authority (CEA) notified the Cyber Security in Power Sector Regulations, 2026 under the Electricity Act, 2003; they take effect from 1 April 2027. They apply to generators, captive plants and energy storage systems of 50 MW or more, as well as power exchanges and over-the-counter trading platforms. CSIRT-Power is the nodal agency, and incidents must also be reported to CERT-In. General cyber incidents must be reported within six hours and sabotage of critical systems within 24 hours. Operational Technology systems must be kept separate from IT systems, and sensitive data must be stored in India.