CYBERSECURITY OF POWER GRIDS

Central Government has taken several steps to ensure Cyber Security of the Power grid. Under the Information Technology Act, 2000, Indian Computer Emergency Response Team (CERT-In) has been designated as the national agency for responding to cyber security incidents. Further, National Critical Information Infrastructure Protection Centre (NCIIPC) has been established to

ensure protection of critical information infrastructure in the country including power sector. Computer Security Incident Response Team Power (CSIRT - Power) has been established in April, 2023 exclusively for the Power Sector. Additionally, Sectoral Computer Emergency Response Teams (CERTs) have been setup for Thermal, Hydro, Transmission, Distribution, Grid Operation and Renewable Energy sectors.

The following key steps have been taken to improve cyber security infrastructure relating to the power grid:

1. GRID-INDIA has established a Security Operation Centre (SOC) to monitor security events and incidents across Regional Load Despatch Centres (RLDCs) and National Load Despatch Centres (NLDC). Information Technology (IT) infrastructure of NLDC has been improved with advanced security features.
2. A Security Operation Centre (SOC) has been set up in POWERGRID for 24X7 monitoring of critical assets.
3. Several IT infrastructure upgrades have been performed to improve cyber security across multiple states in the past five years viz.,

• Manipur SLDC - Two new firewalls and web servers commissioned.
• Chhattisgarh SLDC - Network Management System (NMS) and next generation firewall implemented.
• Kerala SLDC - Centralized End Point Protection implemented.
• Bihar SLDC -Security Operation Centre (SOC) set up.
• Madhya Pradesh, Punjab, Delhi SLDCs - Next generation firewall implemented and
• 11 SLDCs (Madhya Pradesh, Assam, Meghalaya, Odisha, Nagaland, Arunachal Pradesh, Damodar Valley Corporation, Tripura, Bihar, Uttar Pradesh and Bhakra Beas Management Board) have acquired ISO27001 (Information Security Management System) certification.

1. Upgradation to the existing Supervisory Control And Data Acquisition (SCADA) system in Andhra Pradesh SLDC is in progress. Firewalls for the IT infrastructure have been procured and commissioned.

As of March, 2024, 30 out of 35 State Load Despatch Centres managing the grid operations have conducted Vulnerability Assessment & Penetration Testing (VAPT)cyber security audits in the past five years (Annexure).

No such cyber security incident has been reported which affected the operations of Indian Power Grid.

Workshops, trainings, awareness sessions, conferences and cyber security exercises are being organized regularly by various agencies including NCIIPC, CERT-IN and CSIRT-Power for utilities, industry and academia to spread awareness among the stakeholders. Cyber Jaagrukta Diwas is organized on first Wednesday of every month to create cybersecurity awareness among all employees. Power sector employees are also encouraged to obtain certifications and attend courses offered by agencies such as National Power Training Institute (NPTI) and Rashtriya Raksha University.

This information was given by the Minister of State for Power, Shri Shripad Yesso Naik, in a written reply in the Lok Sabha today.

******

MJPS/SK

ANNEXURE

Grid Utilities - Status of VAPT Cyber Security Audit