Government Of India Strengthens Cybersecurity For Power Grids

The Central Government has implemented a series of robust measures to enhance the cybersecurity of India’s power grid, ensuring the protection of critical infrastructure. Under the Information Technology Act, of 2000, the Indian Computer Emergency Response Team (CERT-In) has been designated as the national agency for addressing cybersecurity incidents. Additionally, the National Critical Information Infrastructure Protection Centre (NCIIPC) has been established to safeguard critical information infrastructure, including the power sector.

In April 2023, the Computer Security Incident Response Team Power (CSIRT-Power) was specifically established for the power sector. Further, Sectoral Computer Emergency Response Teams (CERTs) have been set up for various segments such as Thermal, Hydro, Transmission, Distribution, Grid Operation, and Renewable Energy.

Key Steps to Enhance Cybersecurity:

1. GRID-India’s Security Operation Centre (SOC): Established to monitor security events and incidents across Regional Load Despatch Centres (RLDCs) and National Load Despatch Centres (NLDCs). The NLDC’s IT infrastructure has been upgraded with advanced security features.
2. POWERGRID’s SOC: Operational for 24×7 monitoring of critical assets.
3. State-Level IT Infrastructure Upgrades:

• Manipur SLDC: Two new firewalls and web servers were commissioned.
• Chhattisgarh SLDC: Network Management System (NMS) and next-generation firewall implemented.
• Kerala SLDC: Centralized End Point Protection implemented.
• Bihar SLDC: Security Operation Centre (SOC) set up.
• Multiple States: Implementation of next-generation firewalls in Madhya Pradesh, Punjab, and Delhi SLDCs.
• ISO27001 Certification: Acquired by 11 SLDCs including those in Madhya Pradesh, Assam, Meghalaya, Odisha, and others.
• SCADA System Upgrade: In progress at Andhra Pradesh SLDC with new firewalls commissioned.

As of March 2024, 30 out of 35 State Load Despatch Centres have conducted Vulnerability Assessment & Penetration Testing (VAPT) cyber security audits over the past five years.

Cybersecurity Awareness and Training:

Regular workshops, training sessions, awareness programs, conferences, and cybersecurity exercises are conducted by NCIIPC, CERT-IN, and CSIRT-Power for utilities, industry, and academia. “Cyber Jaagrukta Diwas” is organized on the first Wednesday of every month to promote employee cybersecurity awareness. Power sector employees are encouraged to obtain certifications and attend courses offered by agencies such as the National Power Training Institute (NPTI) and Rashtriya Raksha University.

No significant cybersecurity incidents have been reported that affected the operations of the Indian Power Grid, thanks to these proactive measures.

The Minister of State provided this information for Power, Shri Shripad Yesso Naik, in a written reply in the Lok Sabha.

ANNEXURE

Grid Utilities – Status of VAPT Cyber Security Audit