Appoint a dedicated CISO and Alternate CISO as regular senior employees, Indian citizen/resident, engineering degree, 15+ years of power-sector or IT experience. Minimum 3-year tenure, ring-fenced exclusively to cybersecurity, with contact details published publicly and notified to CSIRT-Power.

Stand up an in-house, India-based ISD, not an outsourced helpdesk — staffed by certified personnel providing round-the-clock monitoring, integrated with your OT network detection and incident response workflow.

Control systems must be physically separated from corporate IT and the internet. Any logical connection requires Board-level approval, ESP firewalls, and unidirectional gateway deployment, data flows one way, out, never in.

Maintain a complete, continuously updated Cyber Asset Register covering every PLC, RTU, HMI, and SCADA component — mapped to criticality tier, so nothing unmapped or undocumented slips through an audit.

A comprehensive audit with a CERT-In empanelled agency is due on a 9–15 month cycle. Any Critical or High finding must be remediated within a 1-month SLA, backed by documented evidence rather than a statement of intent.

OEMs must provide a Bill of Materials, ship digitally signed patches, and pass a formal vendor risk assessment — with contract addendums covering BOM disclosure and NDAs before they ever touch your infrastructure.

Report incidents to CSIRT-Power and CERT-In within 6 hours of discovery. If it qualifies as cyber sabotage, the window tightens to 24 hours for critical systems — with evidence retained for the full audit cycle.

No grandfathering for legacy systems — older control equipment is in scope from day one. All sensitive operational data, cloud systems, and historical logs must reside strictly within India, encrypted, with compensating controls documented, not assumed.