Draft CEA Cybersecurity Regulation 2024: A Step to Secure India’s Power Sector
Regulatory drafts are written for lawyers; compliance lands on engineers. This whitepaper re-reads the Draft CEA Cyber Security Regulations, 2024 chapter by chapter in plain words: what each chapter says, who it makes responsible, and the checklist that follows from it.
Compliance / GRC
GRC
Pages:
13
Format:
PDF
Level:
Intermediate
Updated:
Sep 2026
Key Takeaways
- What CSIRT-Power is and why it matters: the sector's central point of contact for incidents, operating since April 2023, with sectoral CERTs for thermal, hydro, transmission, distribution, grid operations and renewables.
- Which 2 roles the draft makes you name on paper: a CISO and an Alternate CISO, with minimum qualifications and security documents handled as per IS 16335.
- Where IT and OT part company in the draft: separate audit cadences, physical and logical segregation between the 2 domains, and tighter remote access rules on the OT side.
- What vendors owe you once the draft applies: security updates and patches across the product lifecycle, and formal notice of end of life and end of support.
The draft runs 13 chapters, from general provisions to CII identification, and it reaches everyone in the chain: generating companies, transmission and distribution licensees, control centres, and the vendors and contractors who supply them. Skimming it tells you it is important. It does not tell you what to do on Monday.
That is the gap this whitepaper closes. Each chapter gets a short, plain-words insight naming what it requires and of whom, followed by a high-level checklist you can walk your own programme through. No clause numbers to decode, no legal phrasing to untangle.
What the 13 pages cover
01.
Introduction, scope and applicability
p.4
Who the draft binds, and how it builds on the CEA Guidelines of 2021.
02.
Key objectives of the proposed regulations
p.5
The 5 outcomes CEA is engineering for, from governance to supply chain.
03
Chapter-wise insights, Chapters I to XIII
p.6
SIRT-Power, CISO and ISD duties, CCMP, vendor obligations, audits, CII identification.
04
High-level compliance checklist
p.8
Governance, controls, training, vulnerability management, incident reporting, audits.
05
How Payatu can help
p.10
Policy development, training, pre-audit assessment, incident response, ongoing compliance.
06.
About the author
p.12
The SCADA security consultant who wrote it.
Look inside
A sample spread — the level of detail in every chapter.
Payatu's OT security practice
Keep the decode on your desk draft-cea-cybersecurity-regulation-2024-a-step-to-secure-indias-power-sector
The full 13-page PDF, written to be printed, annotated, and passed around. Chapter insights on one side, checklist on the other.
