Notification reg declares the Supervisory Control and Data Acquisition SCADA System installed at following locations of Power Grid Corporation of India Ltd. POWERGRID

## Report on Notification S.O. 5852(E) regarding Critical Information Infrastructure Protection **1. Executive Summary:** This report analyzes Notification S.O. 5852(E) issued by the Ministry of Power, Government of India, and published in the Gazette of India on December 14, 2022. This notification declares specific SCADA systems and associated computer resources of Power Grid Corporation of India Ltd. (POWERGRID) as Protected Systems under the Information Technology Act, 2000. This designation aims to enhance the cybersecurity and resilience of critical power infrastructure by providing these systems with greater legal protection against unauthorized access and cyber threats. The key finding is that this policy directly impacts POWERGRID's operations and security protocols at identified locations. **2. Introduction:** The purpose of this report is to provide an informative overview of Notification S.O. 5852(E) published in the Gazette of India on December 14, 2022. This analysis is based solely on the text provided and aims to clarify the notification's objective, provisions, impacted stakeholders, and potential implications. **3. Policy Overview:** * This is a *new* policy designation, not an amendment. * **Core Objective(s):** The core objective, as inferred from the text, is to protect the Supervisory Control and Data Acquisition (SCADA) systems and associated computer resources of Power Grid Corporation of India Ltd. (POWERGRID) from potential cyber threats by designating them as Critical Information Infrastructure under the Information Technology Act, 2000. **4. Background and Rationale:** Given that this is a new policy, the likely problem it addresses is the increasing vulnerability of critical infrastructure, specifically power grid systems, to cyberattacks. The increasing sophistication and frequency of cyber threats necessitates proactive measures to safeguard vital assets. By designating POWERGRID's SCADA systems as Protected Systems, the government aims to deter malicious activities and ensure the reliable operation of the power grid. **5. Key Provisions / Changes:** The key provision of this notification is the declaration that the SCADA systems installed at the following locations of POWERGRID, and the computer resources of their associated dependencies, are designated as Protected Systems under the Information Technology Act, 2000: * National Transmission Asset Management Centre (NTAMC), Manesar * Regional Transmission Asset Management Centres (RTAMC) at: * Northern Region 1, Manesar * Northern Region 2, Jammu * Northern Region 3, Lucknow * North Eastern Region, Shillong * Eastern Region 1, Patna * Eastern Region 2, Kolkata * Western Region 1, Nagpur * Western Region 2, Vadodara * Southern Region 1, Hyderabad * Southern Region 2, Bangalore * Odisha, Bhubaneswar This designation means that unauthorized access to these systems is now subject to stricter legal penalties as outlined in the Information Technology Act, 2000. This empowers POWERGRID to take stronger measures to protect these assets. **6. Target Audience and Stakeholders:** The primary target audience and stakeholders are: * Power Grid Corporation of India Ltd. (POWERGRID): The policy directly affects POWERGRID's security responsibilities and operational protocols at the specified locations. * The Ministry of Power: As the issuing authority, the Ministry is responsible for overseeing the implementation and enforcement of this policy. * Entities responsible for cybersecurity and critical infrastructure protection within the government. * Vendors and partners supporting POWERGRID's SCADA systems: These entities must adhere to enhanced security standards. **7. Implementation Aspects (Inferred):** * **Responsible agency/bodies:** The Ministry of Power is the responsible agency. POWERGRID is responsible for implementing the necessary security measures at the designated locations. * **Timelines or procedures:** The notification states that it "shall come into force on the date of its publication in Official Gazette," which is December 14, 2022. Specific procedures for implementation are not detailed in this text, and would likely be defined internally by POWERGRID or in conjunction with the Ministry of Power. **8. Expected Outcomes / Impact of Changes:** The intended outcome of this policy is to enhance the cybersecurity posture of POWERGRID's critical infrastructure by: * Deterring cyberattacks through increased legal protection. * Enabling POWERGRID to implement stronger security measures. * Improving the overall resilience and reliability of the power grid. * Increasing awareness of cyber threats within POWERGRID and related organizations. **9. Conclusion:** Notification S.O. 5852(E) is a significant step towards strengthening the cybersecurity of India's power infrastructure. By designating POWERGRID's SCADA systems as Protected Systems under the Information Technology Act, 2000, the government aims to safeguard critical assets from evolving cyber threats. This policy necessitates enhanced security measures at the specified locations, ultimately contributing to a more secure and reliable power grid. This will have ramifications on POWERGRID’s vendors, contractors and internal security protocols and investments.

Key Entities Referenced