Notification regarding declares the systems being Critical Information Infrastructure of Grid Controller of India Limited GRID INDIA and the computer resources of their associated dependencies to be Protected Systems

## Report on Ministry of Power Notification Regarding Critical Information Infrastructure Protection **1. Executive Summary:** This report analyzes a notification (S.O. 5849(E)) issued by the Ministry of Power, Government of India, dated December 13, 2022. The notification declares specific systems belonging to Grid Controller of India Limited (GRIDINDIA) as Critical Information Infrastructure (CII) and designates the computer resources of their associated dependencies as Protected Systems under Section 70 of the Information Technology Act, 2000. Key systems protected include SCADA and URTDSM systems at various Regional Load Despatch Centres (RLDCs), SCADA systems at Renewable Energy Management Centres (REMCs), and Web Based Energy Scheduling Systems. The purpose is to enhance the security and resilience of the national power grid by safeguarding these critical digital assets from potential cyber threats. **2. Introduction:** This report aims to provide a detailed overview and analysis of the Ministry of Power's notification S.O. 5849(E), published on December 14, 2022, concerning the protection of Critical Information Infrastructure within GRIDINDIA, based solely on the information contained within the provided text. **3. Policy Overview:** * This is a **New Policy** declaration under the existing Information Technology Act, 2000. * **Core Objective(s):** To protect specific systems of GRIDINDIA, designated as Critical Information Infrastructure, from potential threats as per Section 70(1) of the Information Technology Act, 2000. The inferred objective is to ensure the reliable and secure operation of the national power grid. **4. Background and Rationale:** * **New Policy Rationale:** The notification suggests a perceived vulnerability or a recognized need to strengthen the cyber security posture of critical power grid infrastructure. The systems listed manage real-time data acquisition, control, and scheduling functions essential for grid stability. Designating these systems as CII and Protected Systems likely aims to mitigate the risk of cyberattacks disrupting power supply. **5. Key Provisions / Changes:** * **New Policy Provisions:** * The Central Government declares the following systems as Critical Information Infrastructure of GRIDINDIA and the computer resources of their associated dependencies to be Protected Systems: * Supervisory Control and Data Acquisition (SCADA) System and Unified Real Time Dynamic State Measurement (URTDSM) System installed at National Load Despatch Centre (NLDC), Northern Region Load Despatch Centre (NRLDC), North Eastern Region Load Despatch Centre (NERLDC), Eastern Region Load Despatch Centre (ERLDC), Western Region Load Despatch Centre (WRLDC) and Southern Region Load Despatch Centre (SRLDC). * Supervisory Control and Data Acquisition (SCADA) System of Renewable Energy Management Centre (REMC) installed at NLDC, NRLDC, WRLDC SRLDC. * Web Based Energy Scheduling System at NLDC, NRLDC, NERLDC, ERLDC, WRLDC and SRLDC * The notification comes into force on the date of its publication in the Official Gazette (December 14, 2022). **6. Target Audience and Stakeholders:** * The primary target audience is GRIDINDIA and its associated Load Despatch Centres (NLDC, NRLDC, NERLDC, ERLDC, WRLDC, SRLDC) and Renewable Energy Management Centres (REMCs). * Other stakeholders include: * Ministry of Power * Entities involved in the operation and maintenance of the listed systems. * Potentially, consumers of electricity whose supply depends on the reliable operation of the grid. **7. Implementation Aspects (Inferred):** * **Responsible Agency/Bodies:** The Ministry of Power is responsible for issuing the notification. GRIDINDIA is responsible for implementing the necessary security measures to protect the designated systems. * **Timelines/Procedures:** The notification is effective from the date of publication (December 14, 2022). The text does not specify further timelines or procedures. However, it is implied that GRIDINDIA will need to implement and maintain security measures to protect the CII. * The Additional Secretary, Ministry of Power, is mentioned as the signatory of the notification. **8. Expected Outcomes / Impact of Changes:** * **New Policy Outcomes:** * Enhanced cyber security and resilience of the national power grid. * Reduced risk of cyberattacks disrupting power supply. * Improved protection of critical data and control systems. * Increased confidence in the stability and reliability of the grid. * Potentially, increased investment in cyber security infrastructure and expertise within GRIDINDIA. **9. Conclusion:** The Ministry of Power's notification S.O. 5849(E) designates key systems within GRIDINDIA as Critical Information Infrastructure, marking a significant step towards strengthening the cyber security of the national power grid. This policy enhances the protection of vital systems responsible for managing real-time data, control, and scheduling functions, ultimately aiming to secure the power supply and ensure grid stability. This notification's significance lies in its formal recognition of the cyber risks facing the power sector and the proactive measures taken to mitigate those risks under the existing IT Act.

Key Entities Referenced