The Central Electricity Authority notified the CEA (Cyber Security in Power Sector) Regulations on 31 July 2026. They take effect on 1 April 2027 and apply to power entities that own, operate or manage operational technology (OT) connected to the grid, and the IT systems linked to it, as MediaNama reported.
Among the requirements:
- Isolation: IT networks containing critical information infrastructure must be physically or logically isolated from the internet and other IT networks.
- Fast reporting: cyber incidents must be reported to CSIRT-Power and CERT-In within six hours.
- Accountability: a qualified CISO reporting directly to the head of the organisation.
- Audits: public-facing web services only after a cybersecurity audit, with audit reports kept for three years.
What this means for plant digitalisation
Utilities are digitalising fast: sensors, analytics and digital twins that help plants run more flexibly. Many of these tools assume a cloud connection. Under the new rules, anything that touches critical OT has to respect isolation.
That raises practical questions for any digital twin or analytics project:
- Where does the data go? Does the system send plant data outside the network?
- Can it run fully on-premise? Including licensing and updates.
- How is it connected to OT? One way, through a controlled gateway, or not at all?
- What does the vendor's software send home? Telemetry should be off unless agreed.
Why on-premise twins fit
A digital twin that runs inside the plant, on the utility's own infrastructure, keeps plant data where the regulations expect it to be. Edge computing keeps it working even without an external connection. It is easier to audit, and easier to explain to a CISO.
How Maquette-XR fits
Maquette-XR builds to-scale 3D twins that stream 150+ live parameters from existing sensors. It can be deployed on-premise so data stays in your facility, with edge computing keeping latency low on-site. Read more about digital twins for energy and industry and our approach to air-gapped, on-premise systems.
This article is a summary, not legal advice. Check the regulations with your compliance team. Planning a twin under the new rules? Book a technical call.