Grid cyber security rules around the world: what applies, what to do, and when

How to use this page

Find your country, then read three things: WHAT law or rule applies to your sites, WHAT it asks you to do, and WHEN it applies. Your regulator's own text is the authority — this page tells you where to look and what to prepare.

Whatever the jurisdiction, the work is the same shape: know your assets, decide which are critical, protect and monitor them, control access and change, be ready to respond and recover, and keep evidence that you did all of it.

United States and Canada — NERC CIP

• What applies — the NERC Critical Infrastructure Protection standards (CIP-002 to CIP-015), applied to the Bulk Electric System. In Canada they are adopted province by province through the provincial regulator.
• What to do — categorize BES Cyber Systems (CIP-002), then apply the requirements for their impact level — low-impact sites have the CIP-003 plan obligations; medium and high add CIP-004 to CIP-011, CIP-013 and, for monitoring inside the perimeter, CIP-015.
• When — CIP-003-9 (vendor remote access at low impact) applies from April 1, 2026. CIP-015-1 applies in the U.S. from October 1, 2028 at Control Centers and backup Control Centers, and to other medium-impact systems with External Routable Connectivity by October 1, 2030.

European Union — NIS2 and the Network Code on Cybersecurity

• What applies — the NIS2 Directive (EU) 2022/2555 makes electricity undertakings essential or important entities under national law; Member States had to transpose it by October 17, 2024. For cross-border electricity flows, the Network Code on Cybersecurity (Commission Delegated Regulation (EU) 2024/1366) entered into force on June 13, 2024 and applies directly.
• What to do — register with your national authority, run cyber risk management measures (asset management, access control, supply-chain security, incident handling, business continuity), report significant incidents on the national timelines, and take part in the network code's risk assessments if you are in scope.
• When — now for NIS2 where your country has transposed it; the network code's obligations phase in through its own risk-assessment cycle — check your national competent authority.

United Kingdom — NIS Regulations 2018 and the CAF

• What applies — the Network and Information Systems Regulations 2018, in force since May 10, 2018. Electricity operators of essential services in Great Britain are overseen by Ofgem (with DESNZ).
• What to do — assess yourself against the NCSC Cyber Assessment Framework (CAF) using Ofgem's supplementary guidance and CAF overlay for the downstream gas and electricity sector, act on the gaps, and report incidents.
• When — in force now; Ofgem's guidance for these operators was last updated in January 2026.

Australia — SOCI Act and the risk management program

• What applies — the Security of Critical Infrastructure Act 2018 and its Critical Infrastructure Risk Management Program (CIRMP) Rules 2023, which cover electricity assets.
• What to do — keep a written risk management program, and meet a recognized cyber security framework — for energy, the Australian Energy Sector Cyber Security Framework (AESCSF) at security profile 1 is one of the accepted choices — then report on the program every year.
• When — the framework had to be met by August 17, 2024; annual reports are due each year (the first by September 28, 2024).

Saudi Arabia — NCA Operational Technology Cybersecurity Controls

• What applies — the National Cybersecurity Authority's OTCC-1:2022 — minimum controls for OT and industrial control systems at Critical National Infrastructure, alongside the NCA's Essential Cybersecurity Controls.
• What to do — apply the controls at the level (L1–L3) set for each facility's criticality, across four domains: governance, defense, resilience and third-party cybersecurity.
• When — in force since 2022 for organizations that own, operate or host Critical National Infrastructure.

India — Central Electricity Authority

• What applies — the CEA's cyber security guidelines for the power sector; in August 2024 the CEA published draft Cyber Security in Power Sector Regulations for consultation.
• What to do — set up an information security division, follow CERT-In / CSIRT-Power direction, and expect vendor obligations (tested recovery procedures, security patches for the supply period).
• When — follow the CEA's current notification — check whether the 2024 regulations have been finalised for your entity.

International standards everyone leans on

• IEC 62443 — the series for industrial automation and control system security, used by operators and by vendors for product requirements.
• NIST Cybersecurity Framework — a common language for mapping one regime's controls to another.
• ISO/IEC 27001 with ISO/IEC 27019 — information security management, with the energy-utility extension.

General information, not legal advice. Dates were checked on October 8, 2026 against the regulators' published texts; always confirm with your regulator.