RERC Rejects RVUNL’s ₹377 Crore Cyber Security Upgrade Petition Over Documentation Gaps In Rajasthan

The Rajasthan Electricity Regulatory Commission (RERC) has rejected a petition filed by Rajasthan Rajya Vidyut Utpadan Nigam Ltd. (RVUNL) seeking in-principle approval for additional capitalization of ₹377.77 crore, excluding GST, to comply with cyber-security guidelines set by the Central Electricity Authority (CEA). The petition, submitted on April 6, 2025, under Regulation 17(5)(C) of the RERC Tariff Regulations, 2025, was dismissed in an order dated December 11, 2025, on the grounds that it was incomplete and lacked the necessary technical documentation, approvals, and justifications.

RVUNL had proposed the additional expenditure to establish a centralized Cyber Security Operations Centre (C-SOC), replace obsolete IT hardware, and upgrade its Availability-Based Tariff (ABT) systems along with 46 Distributed Control Systems (DCS) across its power stations. The utility highlighted that its current IT and operational technology (OT) systems are outdated, running on unsupported software versions such as Windows XP and Windows 7/8. According to RVUNL, these systems are vulnerable to cyber-attacks and lack mandatory security features like log collection and monitoring, making them non-compliant with the CEA Cyber Security Guidelines of 2021. The proposed upgrades were aimed at reducing the cyber-attack surface, ensuring uninterrupted system availability, and preventing operational disruptions or generation loss.

Several stakeholders, including Jaipur, Ajmer, and Jodhpur Vidyut Vitran Nigam Ltd., as well as Rajasthan Urja Vikas Nigam Ltd. and Rajasthan IT Services Ltd., opposed the petition. They argued that RVUNL had approached the Commission prematurely without securing the required approval from the State Government. The respondents also maintained that the proposed overhaul of IT-OT infrastructure resembled routine Operation and Maintenance (O&M) activities and should be funded through O&M expenses, especially since RVUNL’s actual O&M expenditure is consistently below normative levels. They further noted that Regulation 17(5) does not allow additional capitalization for minor assets like computers. A major portion of the requested expenditure, Rs. 368 crore, was for DCS upgrades, but the justification for this cost was found inadequate as it was based on an old Renovation and Modernization (R&M) purchase order from KTPS. The respondents questioned the necessity of replacing DCS systems in relatively new plants commissioned between 2014 and 2021.

The Commission supported several of these concerns, observing that RVUNL had submitted only cost estimation sheets and did not provide critical supporting documents. The submission lacked Detailed Project Reports (DPRs) for each power station, Board of Directors’ approval for the estimated expenditure, and firm approval or commitment for equity infusion from the Government of Rajasthan. Additionally, a comprehensive security audit of the cyber infrastructure had not been conducted, and the cyber risk assessment and mitigation plan were not yet finalized. The Commission also advised RVUNL to prepare a phase-out plan for certain generating units before finalizing the DPRs.

Given these shortcomings, RERC did not grant the in-principle approval for the proposed capitalization. RVUNL has been allowed to file a fresh petition after completing all required documentation, approvals, and justifications, while also considering the provisions of the latest draft or final CEA (Cyber Security in Power Sector) Regulations, 2025. This decision emphasizes the importance of thorough planning, proper approvals, and detailed justification before seeking regulatory sanction for large-scale IT-OT upgrades in the power sector.

The Commission’s order reflects the growing focus on cyber security in the power sector, highlighting the need for detailed risk assessment, compliance with updated guidelines, and clear financial planning for modernization projects. RVUNL now has the opportunity to address the deficiencies and resubmit its proposal in line with regulatory expectations.