CEA Highlights.xlsx

	A	B	C	D	E	F	G
1	Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2024.
2	Chapter	Title	Responsible Entity	Mandatory Tasks	Frequency	Key Standards	Additional Requirements
3	1	Short title and Commencement	All Responsible Entities, RPCs, Appropriate Commissions, Governments, Training Institutes, Vendors	Comply with regulations	Ongoing	N/A	Regulations come into force 6 months after publication
4	2	ICSIRT-Power	CSIRT-Power	Collect traffic data from Responsible Entities Lay down cyber security framework Serve as point of contact for incidents Coordinate threat analysis Issue alerts Implement crisis management plans	Ongoing	As directed by Authority	Collaboration with CERT-In and NCIIPC
5	3	General Cyber Security Requirements	All Responsible Entities	Designate CISO and alternate CISO Document Cyber Security Policy and Crisis Management Plan Deploy security devices (firewalls, IDS/IPS) Conduct security audits for web applications Report incidents to CSIRT-Power, CERT-In, NCIIPC Conduct awareness programs and exercises Maintain backups	CISO: Ongoing audits: before hosting awareness: Periodically backups: as per Policy	ISO/IEC 27001	CISOs must be Indian nationals
6	4	Roles of Responsible Entities	Responsible Entities	Establish Information Security Division (ISD) Obtain ISO/IEC 27001 certification Ensure personnel undergo cyber security training Prohibit control of power system elements over Internet Ensure physical/logical separation of OT and IT systems Test all equipment for malware before deployment	Certification: As per standard 3 year and recert cycle Training: As directed - As needed frequecy Testing: Before deployment - every time	ISO/IEC 27001	N/A
7	5	Functions of ISD	Information Security Division	Review Cyber Security Policy Act on directives from NCIIPC, CERT-In, CSIRT-Power Maintain asset inventory and network architecture documentation Implement vulnerability management processes Retain cyber security documents	Policy review: Annually Others: Ongoing	As directed by Authority	N/A
8	6	CISO and Alternate CISO	CISO, Alternate CISO	Serve as nodal officer for all cyber security issues Meet qualification requirements	Ongoing	N/A	Engineering degree with 15 years power sector experience or 10 years IT/cyber security experience
9	7	Cyber Security Policy	Responsible Entities	Include policies on or Build policies for Asset management Risk assessment Access control Training Change management Backup Incident response Other key areas	Review annually	ISO/IEC 27001 ISO/IEC 27019 IS 16335	N/A
10	8	Cyber Crisis Management Plan	Responsible Entities	Develop CCMP including:<br>- Event categorization Stakeholder responsibilities SOPs Communication methodologies	Review annually	N/A	To be prepared in consultation with Sectoral-CERTs and vetted by CERT-In
11	9	Vendor Requirements	Vendors	Provide documented recovery procedures Ensure availability of security patches Inform about end-of-life for components Provide Software Bill of Materials for critical applications	As applicable	IEC 62443-4	N/A
12	10	Cyber Security Audit	Responsible Entities, CERT-In empaneled auditors	Conduct cyber security audits Address vulnerabilities	IT: Twice a year OT: Once a yea Critical vulnerabilities: Within one month	ISO/IEC 27001, ISO/IEC 27019, IS 16335, ISO/IEC 27017	No three consecutive audits by same agency
13	11	Physical Security	Responsible Entities	Secure all access points to critical systems Restrict physical access to OT and ICS systems	Ongoing	N/A	Use physical, human, and procedural controls
14	12	Critical Information Infrastructure	Responsible Entities	Provide information to NCIIPC for CII identification Apply for "Protected System" status	Within 15 days of CII declaration	N/A	Submit details of new cyber assets within 30 days of commissioning
15	13	Monitoring and Compliance	Responsible Entities, CISO MoP	Conduct self-audits Submit compliance reports	Annually (by 31st March)	N/A	CISO, MoP may order independent third-party audits
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100