A new rule just made every power company in India name a security chief. Here's what that job actually has to build.

Whats the big deal?

The rule covers anyone who owns or runs the computer systems that control power equipment — not just power generators and grid companies, but any factory running its own 50 MW-or-larger power plant. That's steel mills, aluminium smelters, cement plants, oil refineries, and fertiliser sites. Most of them have never thought of themselves as "power companies." They are now covered by a power sector law anyway.

What the rule says, in plain words

Every covered company must:

• Name a full-time security chief, on a three-year term, who cannot be left vacant

• Write down a security policy and a crisis plan, and keep a live list of every piece of equipment they run

• Get checked by an outside auditor every year, and switch auditors every two years

• Get certified to ISO 27001 or something equivalent

• Cut the computers that run the plant off from office computers and the open internet

• Report any hack within 6 hours, and any deliberate attack within 24

• Get proof from every vendor selling them equipment or software that the vendor's supply chain is secure too

That's the paperwork half. Most companies can figure that part out on their own — hire a person, write the policy, book the audit.

The part that's actually hard

Here's what doesn't show up on a checklist: the technical work of actually cutting plant equipment off from office computers, and actually watching it, without shutting the plant down by mistake.

A power plant runs on machines that were built to run for 20 or 30 years, not to get security patches every month. Many of them still run on old software nobody makes anymore. You cannot just install antivirus software on a piece of equipment that's been running unattended since 2008 — it can break the equipment. So the real work looks like this:

• Splitting the networks properly. Plant equipment and office computers need to be on separate networks, with a small number of tightly controlled gateways between them — not just a firewall rule, but a redesign of how the two sides talk to each other at all.

• Watching the plant's own language. Plant equipment talks in its own protocols — names like Modbus, DNP3, IEC 61850 — that ordinary office security tools don't understand. You need tools built to read that specific traffic and notice when something in it looks wrong.

• Finding out what's actually running, without touching it. Most plants don't have a full, accurate list of every device on their network. Building that list has to be done by quietly listening to network traffic, not by scanning the equipment directly — scanning can crash old machines.

• Patching what can't be patched. Since old equipment often can't take a security update, the fallback is a kind of shield around it — a rule that blocks the bad traffic from ever reaching the old machine, since the machine itself can't be fixed.

• Backing up in a way nobody can quietly break. If plant systems get hit, you need a copy of the data that an attacker cannot also reach and delete — a locked-away backup, not just a second copy on the same network.

• Watching all of it from one place, all the time. The rule's 6-hour reporting clock only works if someone is actually watching a screen, around the clock, that shows alerts from both the plant side and the office side together.

This is the real gap. Most of these companies have office IT security. Almost none of them have this.

Who's already positioned to do this work

• Kyndryl already runs this kind of work for large operators who answer to regulators and can't afford downtime — separating networks, round-the-clock monitoring, keeping the evidence trail an auditor will accept.

• ITC Infotech has a security practice sitting inside its supply chain and industry technology group, which is exactly where plant-floor security work naturally lives.

• SentinelOne covers the piece most plants overlook — protecting the ordinary Windows-based computers that plant engineers use to control equipment, which are usually the weakest point.

• Rubrik covers the locked-away backup piece — a copy of plant data an attacker can't quietly delete, which the rule doesn't spell out by name but which any real incident will expose as missing.

• Splunk covers the "watching it all from one place" piece — pulling plant alerts and office alerts into a single screen, which is what makes the 6-hour reporting rule actually achievable rather than theoretical.

No single one of these does the whole job. Most companies will end up combining two or three of them, plus a systems integrator to make them work together.

Why this is genuinely hard to pull off in 18 months

Plant engineers and security teams have historically not spoken the same language — one side's job is uptime, the other side's job is keeping things closed off, and those two goals fight each other daily. People who understand both plant equipment and computer security are rare and expensive. And a large share of these companies are approaching this for the first time, with no in-house playbook to copy from.

Frequently asked questions

1. What is the CEA Cyber Security in Power Sector Regulations, 2026?
   A rule from the Central Electricity Authority requiring power generators, captive power plants, grid operators, distribution companies, and power exchanges to build and prove specific cyber security controls, starting April 1, 2027.

   
   

2. Which companies actually have to comply?
   Any generator, captive power plant, or storage site of 50 MW or more; every distribution company regardless of size; grid operators; and power exchanges.

   
   

3. Does this apply to a steel or cement company that isn't a power company?
   Yes, if they run their own power plant above 50 MW to power their own site — which many large steel, aluminium, cement, and refining plants do.

   
   

4. What is OT cybersecurity, and how is it different from ordinary IT security?
   OT stands for operational technology — the computers that directly control physical equipment, like turbines and switches. Ordinary IT security tools are built for office computers and often can't be safely used on plant equipment without risking a shutdown, so OT security needs its own tools and approach.

   
   

5. What's the single biggest technical gap most companies will face?
   Properly separating plant networks from office networks while still letting the two sides share the data they legitimately need — that redesign work, not the paperwork, is where most of the effort and cost will go.

   
   

6. Who do I call first?
   Start with whoever already runs your plant equipment or your IT security — an outside partner is only useful once you know where your own gaps are.