India's Power Sector Faces New Cybersecurity Requirements

India's power sector will operate under new cybersecurity mandates following notification of the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026. The framework applies to entities owning, operating or managing operational technology infrastructure linked to the interconnected power system, with thresholds of 50 MW and above for generating companies and energy storage facilities.

Organisations must encrypt sensitive data, including cloud-hosted information, and ensure vendors handling such data meet security standards. The regulations require segregation of IT and OT systems, with operational technology equipment and services procured exclusively from trusted sources. Remote OT operations must use dedicated channels isolated from the internet and operate within India.

  • Report cybersecurity incidents to CSIRT-Power and CERT-In within six hours; cyber sabotage involving critical systems within 24 hours
  • Conduct vulnerability assessments and penetration testing before commissioning new critical systems; address critical vulnerabilities within one month
  • Appoint a chief information security officer and alternate, maintain 24-hour security functions, and conduct annual self-audits
  • Implement mandatory cybersecurity training for personnel operating critical systems and periodic security exercises

India's SHANTI Act Draft Rules Establish Single Licence Regime and Technology Criteria

Draft rules under India's SHANTI Act establish a single composite licence regime covering construction, ownership, operation, and decommissioning of nuclear power plants. The framework opens the sector to private developers and foreign technology, subject to specified conditions. Private applicants must maintain mandatory insurance coverage and financial security extending through decommissioning and waste management phases.

Foreign reactor designs are permitted only if operational and certified by regulatory authorities in their country of origin or other recognized nations. Eligibility is restricted to countries demonstrating self-reliance in nuclear reactor design and supply chain ecosystems with globally trusted regulatory approvals. Imported or domestically acquired technology must not adversely affect national interests. The Department of Atomic Energy opened the draft rules for public comment through September 4.

  • Single composite licence for all plant lifecycle stages
  • Mandatory insurance and financial security requirements for private operators
  • Foreign technology restricted to self-reliant nations with certified designs
  • Public consultation period extended through early September

Government shifts to producer price index for contract escalations

The Department of Expenditure has instructed ministries and departments to transition from Wholesale Price Index (WPI) to Producer Price Index (PPI) for price escalation clauses in government contracts. The shift aligns with international practice and International Monetary Fund recommendations for measuring inflation at the producer level rather than wholesale level.

Price escalation clauses allow contract payments to adjust based on changes in material, labour, and fuel costs during project execution, distributing inflation impacts between government and contractors. The commerce ministry began issuing monthly PPI data in June for both goods and services, with manufactured items representing 69.93 percent of output PPI, followed by agriculture, forestry, and fishing at 22.16 percent.

  • PPI adoption encouraged for all future government procurement contracts
  • Seven service sectors initially covered in Service PPI phase, with remaining sectors to follow
  • Transition supports phasing out wholesale price inflation metrics over five years